Privacy policy

Last updated October 9, 2026

Policy version 2026-10-09. This notice covers the Corvid website and invitation-only evaluation. The legal operator is Ayan Mishra, a sole proprietor at 6 Elliot Circle, Shrewsbury, Massachusetts, United States. Corvid is the product name; no incorporated company or registered business name is represented here. Contact ayan@corvid.health with privacy requests. Use synthetic study information until a working request channel, provider configuration, institutional authorization and launch requirements are resolved. Actual account emails and technical access information are still processed during evaluation.

Corvid may store a sidebar display preference in your browser. This preference contains no account credentials or study data and is not used for tracking.

Information we process

• Account email, authentication records and session information, managed by Supabase Auth.
• Onboarding profile and institutional preferences; study documents and versions, inherited institutional rules, staff training records, preparation requests and drafts, recorded human decisions, pseudonymous consent record IDs and permissions, payment-plan totals, grant budgets, cleaning codebooks and analysis references that users enter.
• Terms-acceptance versions and timestamps, and an audit history of study reads, changes, approvals and exports. Drafting reservations, selected model, token usage, source snapshots, billing receipts and external delivery or analysis-run receipts are retained even when a request fails.
• Technical request logs held by our hosting and infrastructure providers, such as IP address, browser information, time and requested route.

Information you must keep out

Do not enter participant names, contact information, signatures, direct identifiers, patient health information, clinical-trial records or protected student records. Coded or pseudonymous data can remain personal information and is not automatically de-identified under privacy law. Keep the identifying key at your institution. Document text and free-text fields are not automatically screened or redacted. You are responsible for checking them before upload.

Why and where we process it

We use this information to authenticate users, operate the lab workspace, prepare drafts at your request, preserve study history, prevent abuse and respond to support requests. We do not sell personal information or use it for advertising. Supabase provides authentication and database storage; Render hosts the application. Access is restricted to invited accounts and study members. Infrastructure administrators may access records to operate or secure the service.

AI drafting

Drafting is optional. Each request requires your explicit authorization before the server sends information to OpenAI. Requests send the saved request and selected study documents, institutional policies and retrieved regulatory excerpts. Grant-section requests also send the selected grant and institution-cleared staff records with current training, including names and roles. Methods preparation may include recorded analysis provenance. Preview sources and remove prohibited information before authorizing a request. You may use the records workspace without requesting AI. Your authorization is not consent on behalf of staff or participants; the institution must establish an appropriate basis for processing their information.

Corvid-1.0 and Corvid-Pro-1.0 use OpenAI as the configured processing provider. Corvid-Pro-1.0 allocates additional reasoning effort. Requests set response storage to false. Corvid does not implement model training. OpenAI states that API data is not used for training by default; voluntary data-sharing settings must be verified and remain disabled before institutional use. Provider abuse-monitoring logs and temporary prompt caches can still retain content, with longer retention in some circumstances. This is not zero retention, and deleting Corvid records does not delete provider-retained copies. See OpenAI’s data controls.

Imports and connections

Document imports extract text from Word, plain-text or Markdown files for your review. Original files are processed temporarily and are not stored; file names and import actions are recorded in the study audit trail. Imported text is saved only when you save the document. CSV imports save only the mapped fields after validation. Remove identifiers and other prohibited information before choosing a file.

An optional, read-only REDCap connection uses an institution-issued token configured on the server for one study. It requests only the configured coded record ID, consent version, language and signing date. A preview is temporary; a separate import action saves validated records. Corvid does not write to REDCap. Tokens stay on the server. Calendar and re-consent exports are downloads; adding them to another service is your choice and may disclose the exported information to that service.

Optional server-configured Google Drive, Box and OneDrive connections retrieve selected files for preview and saved document provenance. Qualtrics retrieves configured survey definitions or coded exports. Tremendous retrieves external payment status; Corvid does not issue participant payments. Connections require institution-issued access and are restricted to the configured study. External providers keep their own access and retention records.

A configured GitHub Actions workflow can execute an explicitly authorized analysis run. The configured repository receives study and analysis identifiers, source-version references, commit and hash bindings. Run and artifact metadata and a verified result manifest are saved in Corvid. Review the repository, workflow access, inputs and potential external compute charges before authorizing execution.

Billing

When billing is configured, an authorized lab administrator can open Stripe checkout or the customer portal. Stripe processes payment information; Corvid stores customer, subscription, pricing and webhook references, plan capacity, discounts and usage receipts. Corvid does not store payment-card numbers. Lab administrators can see subscription information; study members see scoped usage percentages. Billing access does not grant research approval authority.

Cookies and communications

Essential cookies keep your session and authentication flow working. The site does not use advertising cookies or analytics trackers. Authentication and recovery emails are sent through Supabase’s configured email delivery service. Workspace reminders are available without external delivery. Optional email through Resend and Slack notifications require an explicit saved preference and configured destination. Messages contain minimal status and authenticated record links, rather than document text or participant information. A configured inbound email webhook records reply metadata linked to the request; an email sender is not proof of approval authority. A reply requests authenticated review and never approves a packet. Resend may retain received email content under its own settings even though Corvid does not fetch or save reply bodies or attachments. When you email us, we use your message to respond and provide support.

Retention, export and deletion

There is no automatic age-based purge of study records, audit history or drafting snapshots. They remain until the owning study or account is deleted. Shared records remain while their owning study exists. JSON export includes accessible study history and, for an account export, your email, user ID and policy-acceptance receipts. Export and account deletion remain available to an authenticated eligible user without accepting a later policy revision.

Study deletion removes its live records and history. Account deletion removes owned studies, sessions and membership in shared studies. In remaining shared audit events, the actor column is cleared; entity references, historical snapshots and collaborator text can still contain your identifiers or information about you. Account deletion does not automatically anonymize all shared history. Contact us for a scoped correction or erasure request; required research records may need to be retained by the institution.

Provider backups, technical logs, legal records and copies exported elsewhere are not erased by the application's deletion action. The actual backup/log retention and data regions have not yet been verified for an institutional deployment; no fixed deletion deadline for those copies is promised here. Confirm a written retention and backup schedule before adding real study data.

Roles, international processing and your choices

Before institutional use, the operator and institution must identify their respective controller/processor responsibilities, the purposes and lawful bases for processing, data locations, subcontractors and any required data-processing or international-transfer agreements. Accepting these terms is not a substitute for those arrangements. Providers may process information outside your country; a specific transfer notice and safeguards must be established where required.

Contact ayan@corvid.health for access, correction, restriction, deletion or applicable portability rights. Where applicable, you may object to processing, withdraw consent for processing based on consent without affecting earlier lawful processing, and complain to your data-protection authority. We will verify identity using only necessary information and respond within applicable legal deadlines, explaining any lawful refusal or extension. Institutional retention duties and legal holds must be checked before deleting records. Self-service account export and deletion do not require agreement to new terms.

Security and incidents

Data is transmitted over HTTPS in production, and access is controlled by verified accounts and study permissions. No system can guarantee absolute security. Report suspected exposure or inadvertently uploaded prohibited information to ayan@corvid.health; do not send participant information in the report. The operator must investigate, contain incidents and notify affected institutions, individuals or authorities when applicable law or agreements require it. This pilot does not claim SOC 2 certification, HIPAA eligibility, FERPA approval or university security approval.

Changes

We will update the policy date when practices change. Material changes require acceptance of the current policy and terms before continued workspace use.