Plain-language summary: Vasl AI is a B2B software platform used by teams working across clinical trials, pharmaceutical, cosmetic, and medical device regulatory affairs to structure and analyze publicly available and licensed regulatory data. We collect the personal data needed to run your account, operate the platform, and support you. Where a customer uploads its own data, including data that may contain health related or special category information, Vasl AI processes that data solely as a data processor, under contract and on the customer's documented instructions. See Section 6 for details.
1Introduction and scope
Vasl AI Ltd ("Vasl AI") provides an AI-powered platform that crawls, structures, and analyzes data across clinical trials, pharmaceutical products, cosmetics, and medical devices, built for regulatory, research, medical affairs, and commercial teams (the "Platform" or "Services"). This Privacy Policy applies to:
- Visitors to www.vaslai.com and related subdomains (the "Site");
- Prospects and customers who register for a free trial, demo, or paid subscription;
- Authorized users who access the Platform on behalf of a customer organization; and
- Individuals who otherwise contact us, for example by email, phone, or a contact form.
This Policy does not apply to information that our customers upload to the Platform for processing on their behalf. That is instead governed by the Data Processing Agreement ("DPA") between Vasl AI and the customer, as described in Section 6.
By using the Site or Services, you accept the practices described in this Policy. If you do not agree with it, please do not use the Site or Services.
2Who we are
For the purposes of UK GDPR and the EU General Data Protection Regulation ("EU GDPR"), the data controller responsible for personal data collected through the Site, and for account and billing data collected through the Services, is:
Vasl AI Ltd, a company forming part of the QALB Holdings group
Registered address: 184 High Street North, East Ham, London, E6 2JA
Email: sales@vaslai.com · Phone: +44 (0)20 8470 4967
Where a customer uploads its own data to the Platform, Vasl AI acts as a data processor on that customer's behalf. The customer, or its own upstream sponsor, remains the data controller for that data.
3Key definitions
- Personal Data: any information relating to an identified or identifiable natural person.
- Special Category Data: personal data revealing health, racial or ethnic origin, genetic or biometric data, and similar categories that receive heightened protection under Article 9 UK/EU GDPR.
- Trial and Regulatory Data: structured or unstructured information that Vasl AI crawls, indexes, and normalizes from public and licensed sources across our four coverage areas, clinical trials, pharmaceuticals, cosmetics, and medical devices. This includes protocols, trial registrations, marketing authorizations, product and ingredient notifications, safety filings, and approval records. It is generally organizational or product level in nature rather than data about an identifiable individual.
- Customer Content: data, files, or records that a customer or its authorized users upload into the Platform for their own analysis.
- Processing: any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
4Data we collect
4.1 Information you provide directly
- Account and registration data: name, work email, job title, organization, phone number, password, and billing details when you sign up for a free trial or subscription.
- Communications: information you submit through contact forms, demo requests, support tickets, or email correspondence.
- Marketing preferences: details you provide when subscribing to newsletters, webinars, or events, along with your consent and opt-out choices.
4.2 Information collected automatically
- Usage data: pages visited, features used, dashboard views, search queries within the Platform, session duration, and click patterns.
- Device and log data: IP address, browser type and version, operating system, device identifiers, referring URLs, and timestamps.
- Cookies and similar technologies: as described in Section 7.
4.3 Information from third-party sources
- Publicly available clinical trial registries, pharmaceutical and medical device regulatory databases, cosmetic product and ingredient notification databases, scientific publications, and press sources that the Platform crawls and structures.
- Business contact information obtained from professional networking platforms or data enrichment providers, used solely for legitimate B2B sales and marketing outreach.
- Information from single sign-on providers if your organization enables SSO login.
5How we use data, and our legal bases
We only process personal data where we have a valid legal basis to do so under UK/EU GDPR. The table below summarizes our primary purposes.
| Purpose | Categories of data | Legal basis |
|---|---|---|
| Creating and administering your account, and delivering the free trial or subscription | Account data, billing data | Performance of a contract |
| Operating, maintaining, and improving the Platform and dashboards | Usage data, device/log data | Legitimate interests |
| Responding to support requests and service communications | Account data, communications | Performance of a contract / legitimate interests |
| Sending product updates, newsletters, or marketing (B2B) | Contact data, marketing preferences | Consent, or legitimate interests with an opt-out |
| Fraud prevention, security monitoring, and enforcing our Terms | Device/log data, account data | Legitimate interests / legal obligation |
| Complying with tax, accounting, and regulatory obligations | Billing data | Legal obligation |
| Processing Customer Content on a customer's instructions | Customer Content (may include special category data) | Performed as processor; controller's legal basis applies |
We do not sell personal data, and we do not use Customer Content to train models shared with other customers without that customer's prior written agreement.
6Trial and regulatory data
Vasl AI's core Platform is built to crawl, normalize, and analyze study level, product level, and organizational data across four connected areas: clinical trials, pharmaceutical products, cosmetics, and medical devices. Sources include national and international trial registries, pharmaceutical and medical device regulatory filings and approvals, cosmetic ingredient and product notification databases, safety and post-market surveillance disclosures, and licensed publications. In the ordinary course of providing the Platform, we do not seek to identify individual trial participants, patients, or consumers, and data at this level is not typically special category data about an identifiable person.
6.1 When customers upload their own data
Some customers upload their own datasets into the Platform for analysis, such as trial trackers, investigator lists, regulatory dossiers, formulation or ingredient records, adverse event logs, or research notes ("Customer Content"). If Customer Content includes personal data or special category health data relating to identifiable individuals, whether patients, trial subjects, or adverse event reporters, Vasl AI processes that data:
- Solely as a data processor, acting only on the documented instructions of the relevant customer, who remains the data controller or acts on behalf of an upstream sponsor;
- Under a written Data Processing Agreement that reflects Article 28 UK/EU GDPR requirements, including confidentiality, security, sub-processing, and assistance obligations; and
- With appropriate technical and organizational safeguards, including encryption, role-based access controls, and audit logging, as described in Section 10.
If your organization intends to upload data containing patient or consumer identifiable information, or other special category health data, please contact us in advance at sales@vaslai.com so we can put the right Data Processing Agreement, sub-processor disclosures, and de-identification options in place. Vasl AI does not independently verify the lawful basis a customer relies on to upload such data. Each customer remains responsible for ensuring it has the necessary rights, consents, and legal basis, including any applicable cosmetic or medical device reporting obligations, to share that data with us.
9International data transfers
Vasl AI is based in the United Kingdom. Personal data may be transferred to, stored, and processed in countries outside the United Kingdom or European Economic Area, including where our hosting and service providers operate. Where we transfer personal data internationally, we rely on recognized transfer mechanisms, which may include the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or a determination that the destination country provides an adequate level of protection, together with supplementary safeguards where appropriate.
10Data security
We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, or destruction, including:
- Encryption of data in transit (TLS) and at rest within our data warehouse and production systems;
- Role-based access controls and the principle of least privilege for internal system access;
- Segregated, access-controlled cloud infrastructure with logging and monitoring;
- Regular review of security practices and vendor security posture; and
- Incident response procedures to investigate and, where required by law, notify affected parties and regulators of a personal data breach.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at sales@vaslai.com.
11Data retention
We retain personal data for as long as necessary to fulfil the purposes described in this Policy, including to provide the Services, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements. In general:
- Account and billing data is retained for the duration of your subscription and for a period afterward as required for tax, accounting, and audit purposes.
- Free trial account data is retained for a limited period following trial expiry, after which inactive accounts may be deleted or anonymized.
- Customer Content is retained and deleted in line with the applicable Data Processing Agreement and the customer's instructions, including on termination of the relevant subscription.
- Marketing contact data is retained until you unsubscribe or object, or until it is no longer necessary for the purpose it was collected for.
12Your privacy rights
If UK GDPR, EU GDPR, or another applicable data protection law applies to you, you may have the following rights in relation to your personal data, subject to certain exceptions and limitations:
- Access: request a copy of the personal data we hold about you.
- Rectification: request correction of inaccurate or incomplete data.
- Erasure: request deletion of your personal data in certain circumstances.
- Restriction: request that we limit how we use your data in certain circumstances.
- Portability: request a machine-readable copy of data you provided to us, where technically feasible.
- Objection: object to processing based on legitimate interests, including direct marketing.
- Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
To exercise any of these rights, contact us at sales@vaslai.com. We may need to verify your identity before responding, and we will respond within the timeframe required by applicable law. If you are located in the UK, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO). If you are located in the EEA, you may lodge a complaint with your local supervisory authority. If other regional privacy laws apply to you, for example US state privacy laws, we will honor the rights those laws provide upon a verifiable request.
13AI and automated processing
The Platform uses AI-assisted tools to crawl, cleanse, normalize, and structure data across clinical trials, pharmaceuticals, cosmetics, and medical devices, and to generate dashboards, summaries, and insights for our customers. These features are designed to support, not replace, the professional judgment of your research, regulatory, and commercial teams. Vasl AI does not use automated processing to make decisions that produce legal or similarly significant effects concerning individual data subjects without appropriate human oversight.
14Children's privacy
The Site and Services are intended for business use by professionals working in pharmaceutical, cosmetic, medical device, and clinical research sectors, and are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate steps to remove it.
15Third-party links
The Site and Platform may contain links to third-party websites, registries, or services that we do not own or control, including the public clinical trial, pharmaceutical, cosmetic, and medical device registries we reference as data sources. This Policy does not apply to those third-party sites, and we encourage you to review their privacy policies before providing any personal data.
16Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the revised policy on this page with an updated "Last updated" date, and where changes are material we will provide additional notice, such as by email or an in-app notification. We encourage you to review this Policy periodically.
17Contact us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out using the details below.