Privacy Policy

Last updated: 23 July 2026

Pedro Torrecillas, operating as Nacar.ai (“Nacar”, “we”, “us”), respects privacy in its clinical-trial recruitment and pre-screening services. Contact us at privacy@nacar.ai or support@nacar.ai.

1. Scope and who we are

This policy describes how Nacar handles personal data through nacar.ai, its services, and related business and support interactions. Nacar is operated by Pedro Torrecillas, operating as Nacar.ai.

2. Who this policy applies to

This policy applies to website visitors and business contacts; Professional Users such as authorised staff of customers, sites, sponsors, CROs and service providers; and Participants or Candidates contacted or using a clinical-research recruitment or pre-screening flow.

3. Our privacy roles

Nacar acts as controller for the public website, business contacts, account administration, authentication, security, support and its legal obligations. For Customer Clinical Data, Nacar acts as processor or subprocessor under documented instructions. A processing chain can be a hospital or study site (controller), a management or service company (processor), and Nacar (subprocessor), or the customer can act as controller directly. The relevant form, invitation, communication or study information identifies the responsible controller.

4. Personal data we process

Depending on the interaction, this includes:

identifiers, contact details, demographic information and preferences;
organisation, account, role, access, authentication and support information;
technical, device, browser, IP, audit, security and service-log data;
study, protocol, site, workflow and configuration information;
health and other special-category data, including medication, medical history and screening answers, where the controller provides or collects it;
communications, appointments, calls, messages and WhatsApp interactions;
audio recordings and transcripts where applicable; and
Google account and Calendar information for authorised integrations.

5. Sources of personal data

We receive data directly from an individual; from a customer, controller, referral source or authorised representative; from approved integrations; and automatically through use of the website or services. Where Article 14 GDPR applies, the controller or the relevant first-contact notice provides the information required by law, including the source where appropriate.

6. Purposes and legal bases

As controller, Nacar processes data to respond to enquiries, manage business relationships and accounts, authenticate users, secure and improve service operations, provide support, communicate about a request or relationship, comply with legal obligations, and establish, exercise or defend claims. The applicable basis is performance of a contract or requested pre-contractual steps, legitimate interests balanced against rights, consent where required, or legal obligation. The relevant customer or controller determines the Article 6 and, where applicable, Article 9 GDPR basis for Customer Clinical Data. This policy is not consent to processing, contact, recording or research participation.

7. Customer Clinical Data

Nacar processes Customer Clinical Data only under documented controller or customer instructions and applicable law. We apply data minimisation, separation of identity from clinical responses where practicable, pseudonymisation and opaque references where appropriate. Clinical content does not enter ordinary application logs or telemetry. The core application and primary database are located in Madrid, Spain. Neither Nacar nor AI providers use Customer Clinical Data to train general-purpose models or for independent purposes.

8. AI and automated processing

Nacar uses AI-assisted tools to extract and organise protocol and evidence information, generate questions, prepare summaries, and show criterion-level coverage or status. An AI-assisted interaction is disclosed at its start. These tools can produce inaccurate or incomplete results and are subject to meaningful human review. Nacar does not make a final eligibility, participation or enrolment decision solely by automated means, and the services do not diagnose conditions, recommend treatment or replace clinical judgement.

9. Communications, calls, recordings and WhatsApp

Communications use channels appropriate to the interaction, including calls, email, text, messaging services and WhatsApp. Contact, recording, transcription and research-participation notices and permissions are distinct and apply where required. Individuals can use the channel’s available opt-out method or contact us to stop non-essential communications. Audio recording or transcription occurs only with the required notice and applicable authority or permission.

10. Google sign-in and Calendar

Google sign-in is separate from the optional Google Calendar integration for authorised Professional Users. Calendar access uses calendar.readonly and calendar.events to check availability and create, update or cancel selected recruitment-visit events. Patients do not connect a calendar. Our use of Google API data follows the Google API Services User Data Policy, including Limited Use. We do not sell Google user data, use it for advertising, or use it to train unrelated or general-purpose AI models. We do not read Google Calendar data except to provide the described integration. Routine human access is not permitted, subject to limited access for security, legal compliance, support with permission, or as otherwise allowed by that policy. A user can disconnect the integration in the service and revoke access through Google account controls.

We do not sell personal data. We share it with the relevant controller, customer and authorised users; service providers supporting hosting, storage, communications, AI, transcription, scheduling, security and support; and professional advisers, corporate successors or public authorities where required. Recipients process data under contracts and safeguards appropriate to their role. International transfers use an adequacy decision, standard contractual clauses, or another lawful mechanism, with supplementary safeguards where appropriate.

12. Retention and security

For data Nacar controls, retention reflects the purpose, sensitivity, account and security needs, legal obligations and limitation periods. Customer Clinical Data follows controller instructions, the applicable customer agreement and law. Deletion instructions apply to active storage and relevant providers; backups age out under defined cycles, and a lawful legal hold can delay deletion. We use proportionate technical and organisational safeguards, including access controls, tenant separation, encryption in transit and security logging. No system is completely secure.

13. Your rights

Subject to applicable law, individuals may request access, rectification, erasure, restriction, objection or portability; withdraw consent without affecting earlier lawful processing; and object at any time to direct marketing. For Customer Clinical Data, requests normally go to the controller identified in the relevant communication or study information. We route requests to that controller and assist as required. We may ask for information to verify identity. You can complain to the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

14. Children and representatives

We do not knowingly collect children’s data through the public website. Where a study concerns a minor or a person represented by another, participation and communications follow the responsible controller’s process, applicable law and the authority of a parent, guardian or other authorised representative.

15. Cookies

The public website does not use advertising or analytics cookies. The application uses necessary authentication, session and security technologies. Where a notice, choice or consent is required, the applicable service flow presents it separately.

16. Third-party links, changes and contact

Third-party sites and services have their own terms and privacy notices. We may update this policy to reflect legal, service or processing changes and display the current version here. For privacy questions or requests, contact privacy@nacar.ai.