Comtrak Lite Mobile App Privacy Policy

This Policy covers only the Comtrak Lite mobile app. It is separate from, and does not replace, DM Clinical Research's general website privacy policy at https://www.dmclinicalresearch.com/privacy-policy/, which continues to govern DM Clinical's website and any data practices not described here.

1. About This Policy

Comtrak Lite (the “App”) is a professional tool used by DynaMed Clinical Research, LP d/b/a DM Clinical Research (“DM Clinical”, “we”) site staff to contact and manage clinical study participants. It works alongside the Comtrak platform, requires an account we issue, and is not available to the general public.

Comtrak (the parent platform) manages the full participant journey end to end and holds the complete set of PHI and PII for a study. Comtrak Lite is a mobile companion to that platform, purpose-built for site staff who are not at a desk. It gives you the subset of Comtrak's calling, messaging, and participant information you need in the field and syncs with and depends on the Comtrak platform rather than operating as a separate system.

Two groups are affected, and this Policy treats them differently. Where it says "you," it means an authorized user — DM Clinical staff who sign in to the App. Participants are the people whose contact details, study information, and communications are handled through the App; they do not use it and do not see this Policy.

Participant information is not governed by this Policy. It is governed by the study's IRB-approved Informed Consent Form and HIPAA Authorization, the study protocol, and DM Clinical's website privacy policy at https://www.dmclinicalresearch.com/privacy-policy/. Where they differ, the consent documents control. Section 7 explains how Participants make requests.

Acceptance of this Policy. By creating an account, signing in, or otherwise using the App, you (as an authorized user) acknowledge that you have read and agree to this Policy. If you do not agree, do not use the App, and contact your DM Clinical administrator to have your account deactivated. This Policy does not require any acceptance step from Participants, who do not use the App directly.

2. What the App Collects

What the App does not do. It does not collect your precise location. If you use fingerprint or Face ID sign-in, your device handles it — the App never receives or stores biometric data. The App contains no advertising, no advertising SDKs, and no advertising identifiers, and does not track you or Participants across other companies' apps or websites. We do not sell personal information.

3. Device Permissions

4. How We Use and Share Information

We use information to sign you in and apply your role's access rights; provide calling, messaging, voicemail, follow-ups, alerts, and interaction logging; sync records with the Comtrak platform; show activity dashboards; record calls for quality and compliance; diagnose faults; and meet our legal, regulatory, sponsor, and clinical-research obligations. We do not use App information for advertising or ad tracking.

We may also disclose information where required by subpoena, court order, or other valid legal process, or to protect rights, safety, and security. Service providers may use information only to provide services to us, not for their own purposes. We do not disclose information to third parties for their own marketing.

5. Call and Message Recording

Calls placed and received through the App are recorded, and SMS messages are retained as part of the study communication record. Recording laws vary by state, and a number of states require the consent of every party to a call. When a caller reaches us on an inbound call through our phone menu, a recording notice is played before the call is recorded. Outbound calls placed from the App, and inbound calls connected directly without the phone menu, do not currently play a recording notice.

Where a Participant is on the call, recording and text messaging are also covered by the study's Informed Consent Form and HIPAA Authorization for that study.

6. Security and Retention

Access to Participant records is limited by role, reviewed periodically, and revoked when someone changes role or leaves. Access and actions are logged with user identity, record, and timestamp. Data in transit is encrypted with TLS. Call recordings are stored on our servers with encryption at rest and never on your device; data the App holds on the device is kept in secure storage and cleared at sign-out. Sign-in requires credentials, with optional biometric unlock; sessions time out on inactivity, suspended during active calls. On deactivation, tokens are revoked, you are signed out, and local App data is cleared. No system is completely secure, and we cannot guarantee absolute security.

Retention. The interaction note you record is part of the study record and is kept accordingly. The underlying call recording is a supporting artifact and is kept far more briefly.

7. Your Rights and Requests

7.1 Authorized users

Comtrak Lite accounts are created and managed by DM Clinical Research for work purposes. Because activity in the App forms part of clinical trial and employment records, you cannot delete your account or its records from within the App. When your access ends, your account is deactivated and your credentials are revoked; the underlying records, call logs, recordings, subject-interaction entries, and audit trails — are retained for the period required by applicable regulations, including 21 CFR 312.62, ICH GCP, and FDA Part 11 audit-trail requirements, and by our contracts with study sponsors. Part 11 in particular prohibits deleting audit-trail entries, so account and identity data (name, work email, phone, role) is deactivated rather than deleted, removing it would break the integrity of the audit trail.

What you can request. You may ask us to deactivate device-level data associated with your use of the App, device identifiers, push notification tokens and cached content by using the contact details in Section 9.

7.2 Participants

To access, correct, or remove information we hold about you, or to stop being contacted about studies, contact us below or speak to your study coordinator. Reply STOP to any text to stop messages. Your rights are set out in the Informed Consent Form and HIPAA Authorization you signed and are subject to the retention requirements in Section 6 — records forming part of a clinical trial generally cannot be deleted, and we will explain if that applies. Because DM Clinical acts as a business associate (Section 8), some HIPAA requests are handled through the covered entity responsible for the study or your care; we will route your request accordingly.

7.3 U.S. state privacy laws (California and others)

California residents, including DM Clinical staff who are California residents, have the right to know what personal information we collect, its sources, purposes, and the categories of third parties we disclose it to; to delete it, subject to applicable exceptions; to correct it; to opt out of sale or sharing for cross-context behavioral advertising — we do not sell or share for that purpose; to limit use of sensitive personal information; and not to be discriminated against for exercising these rights. You may use an authorized agent.

For DM Clinical staff, a deletion request is handled as described in Section 7: device-level data (device identifiers, push tokens, cached content) is deactivated on request. Account and identity data, and regulatory and operational records such as call logs, recordings, subject-interaction entries, and audit trails, are retained under the CCPA's legal-obligation and record-keeping exceptions, given the requirements in 21 CFR 312.62, ICH GCP, and FDA Part 11, and our contracts with study sponsors — we will tell you what was retained and why. Information collected under a HIPAA Authorization, or that otherwise qualifies as Protected Health Information, is outside CCPA/CPRA's scope entirely. We log every request and its disposition.

Residents of other states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, Utah, and Texas) may have comparable rights to know, access, correct, delete, and opt out, subject to similar exemptions for information governed by HIPAA or generated in the course of clinical research. Contact us using the details in Section 9 to make a request; we will confirm your identity and respond within the time the applicable law requires.

7.4 International users (GDPR / UK GDPR)

The App is intended for DM Clinical staff and Participants engaged in clinical research conducted in the United States and is not directed to individuals in the European Economic Area or United Kingdom. We do not knowingly process the personal information of EEA/UK-based individuals through the App. If a specific study involves participants or staff based in the EEA or UK, the additional disclosures and rights required by the GDPR or UK GDPR are provided through that study's Informed Consent Form, HIPAA-equivalent authorization, and any study-specific data protection notice, which control for that study.

8. Health Information

Information handled through the App — Participant contact details, study status, and recorded calls — may be Protected Health Information (PHI) under HIPAA.

DM Clinical acts as a business associate under HIPAA for the services described in this Policy. We handle PHI on behalf of the covered entities we contract with, under Business Associate Agreements that define what we may do with it. Our uses and disclosures are limited by those agreements, by the applicable Informed Consent Form and HIPAA Authorization, by IRB approval, and by HIPAA itself. Where we engage a subcontractor that handles PHI for us, we put a Business Associate Agreement in place with that subcontractor as HIPAA requires.

Because we act as a business associate rather than a covered entity, we do not issue a Notice of Privacy Practices. The covered entity responsible for the study or for your care provides that notice. HIPAA requests to access or amend your records are handled through that covered entity, and we support those requests as our agreements require.

9. Children, Changes and Contact

The App is for authorized adult staff and is not directed to children; we do not knowingly collect children's information through it. Where a study enrols minors, information is collected under the IRB-approved consent process with a parent or guardian's permission.

We may update this Policy. For any questions related to this policy or to make a request under Section 7 please contact us at privacy@dmclinical.com. We will post the update and revise the effective date. Where a change materially affects how we use information already collected, we will give additional notice and require you to accept the updated Policy at your next sign-in before you can continue using the App, and obtain consent where the law requires it