Privacy Policy

Effective Date: May 14, 2026 Last Updated: October 22, 2026

1. Introduction

Erudio Health Inc. ("Erudio," "we," "us," or "our") provides AI-enabled education, medical affairs, research, analytics and reporting services. This policy explains how we collect, use, disclose and protect personal information through our public websites, including www.erudio.com, website forms, demo requests and downloads, Erudio Reports purchases and delivery, and Erudio MCP, including free and paid use. It also covers the clinicians and other speakers whose public commentary appears in our reports, as described in section 13.

If you or your organization have an applicable signed agreement with Erudio, such as an MSA, order form, SOW or DPA, that agreement controls our contractual obligations for the services and processing it covers where it conflicts with this policy. This policy does not amend that agreement or authorize additional processing. For personal information we process on a customer's behalf, the customer's instructions and applicable agreement govern that processing. Other products may have additional privacy notices. Neither a signed agreement nor this policy removes disclosures, individual rights or obligations required by applicable law.

2. Information We Collect

The information we receive depends on how you use the service. A free catalog lookup does not require all the information needed for a paid order or an authenticated organization connection.

Contact and business information: name, work email address, company, job title, inquiries, demo or download requests, support messages and our responses.
Account and connection information: where sign-in or authorization is used, profile information supplied by the sign-in provider (such as Google name, email and profile image), organization and access permissions, registered MCP client names and redirect addresses, authorization records, tokens and session information. Report access may instead use a license key.
MCP requests and service records: queries, questions, tool parameters, requested reports and other content you or your client send; generated answers and saved research or watch requests where those features are used; and tool-use records such as timestamps, client or account identifiers, success or failure, response counts and performance. Some tool parameters and queries are retained in service records even when diagnostic logs redact them.
Order and delivery information: buyer email, organization where supplied, selected reports, editions, subscription terms, quotes, order and payment status, transaction references, invoices, license and access records, and email delivery records. Payment providers such as Stripe process payment details; we receive records needed to confirm, deliver and support the purchase. Where a machine payment uses a blockchain, wallet addresses and transaction details may also be publicly visible on that network.
Technical and website analytics information: IP address, browser and device details, referring pages, pages viewed, timestamps, approximate location inferred from IP address, website events, traffic sources, performance, session information and cookie or similar identifiers where applicable.

Do not submit PHI, patient information or sensitive medical information through public website forms or free or self-service MCP use. A separate signed agreement must expressly authorize an appropriate contracted channel before such information may be submitted there. If we receive it through an inappropriate channel, we may restrict processing, delete it or redirect the request.

3. How We Use Information

We use information to respond to inquiries and support requests; provide downloads and free reports; authenticate users and authorize clients and report access; process orders, payments, refunds and license recovery; deliver purchased reports and updates; answer requests and operate research and watch features; understand service usage and improve service quality; prevent abuse, troubleshoot errors and maintain security; manage business communications; and meet legal, accounting, tax and dispute obligations. We send marketing communications where permitted by law and applicable consent requirements.

Where the GDPR or UK GDPR applies, we rely on performance of a contract for orders, delivery and access; on our legitimate interests for responding to inquiries, security, analytics, service improvement and business communications; on consent where the law requires it; and on legal obligations for tax and accounting records.

4. Cookies and Analytics

We use essential cookies or similar mechanisms for sign-in, sessions, authorization consent and security where those connection flows are used. Blocking them may prevent a connection from working. These are separate from optional public website analytics and advertising tools.

Our public websites may use Vercel Web Analytics, Google Analytics, PostHog or similar tools to understand traffic, performance and campaign activity. Some use cookies or similar identifiers. You can manage cookies through browser settings and any available website consent controls. We do not knowingly use website analytics to collect PHI.

5. How We Disclose Information

We disclose information as needed to provide and support the service, including to:

Hosting, database, search, authentication, AI processing and monitoring providers. Depending on the feature, these include Vercel, Google Cloud, Turbopuffer, AI model providers and Sentry. Queries and relevant context may be processed by search, embedding or generative AI providers to fulfill requests.
Payment and email providers, including Stripe and Resend, to process purchases and deliver reports, receipts, license keys and other requested messages.
Communication, analytics, CRM, collaboration and business operations providers; professional advisers; legal or regulatory recipients when required by law or necessary to protect rights, safety or security; and counterparties in a merger, acquisition, financing, reorganization or similar transaction.

When you connect a third-party AI assistant or MCP client, it sends requests to Erudio and receives the results it is authorized to access. Your client may send information from your conversation or other context with a tool request. Its provider controls how it handles that information and the returned content under its own terms, privacy policy and your settings. Review those before connecting; disconnecting does not itself delete copies already received by that provider.

We do not sell the personal information of website visitors, buyers or MCP users. Section 13 covers the information about clinicians and other speakers in our reports. Where public website marketing pixels or conversion APIs are enabled, we may share limited website event data and hashed contact identifiers with advertising and measurement providers, such as LinkedIn and X, for conversion measurement, retargeting and campaign analytics. This may be considered "sharing" for cross-context behavioral advertising under some privacy laws. These tools are limited to public marketing pages and non-PHI workflows, and legally required opt-outs must be honored. We do not use MCP credentials or MCP tool-request content for cross-context behavioral advertising.

6. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this policy. Periods vary by record type and purpose, including account and access administration, requested research and watches, order fulfillment, business records, security, disputes and legal obligations, and by applicable signed agreements. Tokens and sessions have their own validity periods; expiration or disconnection does not automatically delete order, usage or other retained records. Contact us about deletion or retention questions.

7. Security

We use reasonable technical and organizational safeguards designed to protect personal information. No internet transmission or storage system is guaranteed to be completely secure. Keep license keys and tokens private and connect only clients you trust. If you believe information or credentials may have been compromised, contact privacy@erudio.com.

8. Your Choices and Rights

Depending on your location and applicable law, you may have rights to request access, correction, deletion, portability, restriction, objection or withdrawal of consent, or to opt out of certain marketing communications, sales or sharing. These rights may be subject to legal exceptions and identity verification. If you are in the EU or UK, you may also complain to your data protection authority.

To exercise privacy rights, contact privacy@erudio.com. If we process information on behalf of your organization, we may direct your request to it or assist it under the applicable agreement. You can unsubscribe from marketing emails using their unsubscribe link or by contacting us; necessary service and purchase messages may still be sent.

You can disconnect an MCP client through its controls and contact us for help revoking access or deleting retained information. Disconnection and deletion are separate actions. Use available browser, platform, device and website privacy controls to limit advertising or analytics tracking. We honor legally required opt-out mechanisms where applicable.

9. International Transfers

Erudio is based in the United States. Your information may be processed in the United States or other countries where we or our vendors operate. Those countries may have privacy laws that differ from those where you live. We apply safeguards required by applicable law and any governing signed agreement.

10. Children's Privacy

Our websites, report services and MCP are intended for business and professional audiences, not children under 13. We do not knowingly collect personal information from children under 13 through these services.

11. Third-Party Links

Our websites and reports may link to third-party websites or resources. Their privacy practices are governed by their own policies. Review those policies before providing personal information.

12. Changes to This Policy

We may update this policy. The "Last Updated" date shows the latest revision. We will provide notice of material changes where required by applicable law. A policy update does not itself amend a signed customer agreement.

13. Clinicians and Other Speakers in Our Reports

Erudio reports and Erudio MCP describe what clinicians and other speakers have said in public about clinical trials. This section is for those people. We do not contact them, so we publish this notice instead.

What we collect: name, role, specialty, credentials and affiliations; public statements in talks, podcasts, videos and posts, with short quotes and links to the originals; public social media accounts and profile pages; the NPI and its public registry record; summaries of CMS Open Payments records; and ORCID, OpenAlex and publication affiliations. Reports do not include contact details such as email addresses or phone numbers, and they never identify a patient.
Sources: public talks, podcasts, videos and posts on X and Bluesky; public profile and institutional pages, such as LinkedIn; the NPPES registry; CMS Open Payments; ORCID, OpenAlex and clinical trial registries.
How we use it: AI models transcribe, summarize and attribute public commentary and judge whether two public records belong to the same person. We use the results to write reports and answer Erudio MCP requests. We do not use this information to make decisions with legal or similarly significant effects about anyone.
Legal basis: where the GDPR or UK GDPR applies, our legitimate interest, and our customers', in an accurate, sourced account of public professional commentary on clinical trials. We use what people have made public in a professional capacity, keep each view attributed to the person who expressed it and link to the original.
Who receives it: organizations that license reports or Erudio MCP, people who request the free report, and the service providers in section 5, including AI model providers. Our terms prohibit using reports or clinician identifiers for promotional purposes.
Retention: as long as we offer the reports and services that use it, and afterward only as long as needed for records, disputes and legal obligations.

You may ask us for access to, correction of or deletion of information about you, and you may object at any time to our use of it. Write to privacy@erudio.com. We respond under the law that applies to you and tell you what we changed. If you are in the EU or UK, you may also complain to your data protection authority.

14. Contact

Erudio Health Inc. 1014 S Westlake Blvd PMB 405 Ste 14 Westlake Village, CA 91361 privacy@erudio.com