Skip to content
VSQRD
Log inSign up

Privacy

Last updated 15 September 2026. This policy covers vsqrd.com and the VSQRD Portal at portal.vsqrd.com, both run by VSQRD, Inc. Where your organization's signed agreement with VSQRD says something more specific, the agreement governs.

The short version

The VSQRD Portal is a shared workspace where sponsors and CROs meet: requests for proposals, the confidentiality agreement before a brief is shared, and the study itself once it is awarded. We hold what that work needs and the record of who did what. We do not sell your data, we do not use it for advertising, we do not train AI models on it, and we run no analytics or trackers on the site or the portal.

Who we are and who this covers

VSQRD, Inc. runs the portal and this site. This policy covers people who visit vsqrd.com and people who use the portal: the staff of the sponsors and CROs whose organizations are on it, and people who ask to join.

For the account details and activity described here, VSQRD decides how the portal works and is responsible for that data. If you are in the EU or UK, that makes VSQRD the controller. What an organization chooses to put into the portal — a brief, a proposal, an update, a file — is that organization's to share, and it is responsible for having the right to share it.

What we collect

  • Your account: your email address, the name you choose to show, your organization, your role in it (owner, member, or viewer), when your account was made, and when you last signed in.
  • How you sign in: sign-in is handled by WorkOS, with an emailed code, a password, your Google account, or your Microsoft account. We receive your email address and an ID for you; we do not receive or store a password. If you sign in with Google or Microsoft, that company shares your name and email address with WorkOS, and Google also shares your profile picture; we keep only your email and the ID.
  • Asking to join: the email and organization name you give on the sign-up form, and, for an invitation, the address it went to and who sent it.
  • Your organization's profile: its name, logo, description, website, LinkedIn page, locations, services, past studies, and the materials it uploads, such as brochures and certificates.
  • The work: requests, briefs and their attachments, questions and answers, proposals (including the names of the study director and pathologist proposed), contracts, milestones, updates, and delivered files. Every change records the person who made it.
  • Confidentiality agreements: when you accept one, we keep the name you typed, the time, your IP address, and your browser, as evidence of who accepted it and when.
  • Emails we send you: a copy of each one, with who it went to and whether it was delivered.
  • Two small cookies that keep you signed in, listed below.

What we do not collect

  • No analytics, advertising, or tracking scripts, and no third-party cookies, on the site or the portal. Fonts and scripts are served from our own servers, not from outside networks.
  • No location data.
  • Your IP address and browser are not stored with your account or in our server logs. They are passed to WorkOS when you sign in, for its fraud checks, and kept by us only when you accept a confidentiality agreement, as described above.
  • No passwords. If you choose to set one, WorkOS holds it; we never see it.

We never sell personal data and never share it for marketing.

Why we hold it

  • To run the portal: to sign you in, show you the work your organization is part of, and let the right organizations see the right things.
  • To keep the record of who did what and when, which is what makes a request, an agreement, or a study's history something both sides can rely on.
  • To send you the emails the work calls for: invitations, and notices when something on a study or request needs you.
  • To keep the portal secure and to stop misuse.

Who else can see it

The portal exists so that two organizations can work together, so some of what you enter is meant to be seen by another organization. Exactly who sees what:

  • People in your own organization, according to their role.
  • A CRO's profile, past studies, and materials are visible to the other organizations on the portal. A confidentiality agreement you upload is visible only to the organizations it concerns.
  • A request's summary is visible to the CROs it is put to. The full brief is visible only to a CRO that VSQRD has approved and that has accepted a confidentiality agreement with the sponsor.
  • A question is shown to the sponsor with the name of the person who asked it; the sponsor's answer is shown to every CRO bidding on that request. A proposal is visible to the sponsor it was sent to.
  • A confidentiality agreement, including the acceptance details above, is visible to both organizations it binds.
  • A study, and everything in it, is visible to the organizations that are parties to it.
  • A small number of VSQRD staff can see every organization and every person on the portal (email, role, and last sign-in), to set organizations up, approve them, and support them.

We rely on a few service providers, each for one job and each bound by its own data-protection terms: WorkOS, which signs you in; Google or Microsoft, only if you choose to sign in with an account from them; Resend, which delivers our emails and so handles your address and the email's contents; and Amazon Web Services, which hosts the portal, its database, stored files, and backups in the United States. None of them may use your data for anything but providing that service to us. We may also disclose data where the law requires it.

The portal is hosted in the United States. If you use it from the EU or UK, your data is transferred to and processed in the United States.

How we keep it safe

  • Everything moves over encrypted connections. The database and its backups are encrypted at rest, and the database cannot be reached from the internet.
  • Delivered files sit in private storage. A download link works for five minutes and only for someone allowed to see the file.
  • Sign-in cookies are encrypted so their contents cannot be read or forged.
  • The record of who did what can only be added to. The database refuses any change or deletion, and each entry is chained to the one before, so an attempt to alter history would show.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell your organization promptly, and you where we can.

How long we keep it

  • Your account is kept while you use the portal. When you are removed from your organization, your account is deactivated, not deleted: you can no longer sign in, but your name and email stay on the things you did.
  • The record of who did what is kept for as long as the portal runs. It cannot be edited or deleted, by anyone, including us, and it includes the email addresses of the people it names.
  • Accepted confidentiality agreements are kept, because both organizations may need to show one years later.
  • A study's contents and files are kept while the organizations on it use the portal. Delivered files keep their earlier versions.
  • A request that was never shared with anyone can be deleted by the sponsor, and everything in it goes with it.
  • Backups are kept for seven days.

Your choices and rights

  • See the personal data we hold about you, and get a copy of it.
  • Correct it. You can change the name you show in your settings; write to us for anything else.
  • Leave. An owner of your organization can remove you, or you can write to us.
  • Ask us to stop using your data in a way you did not expect, or to delete it. We will tell you what we can delete and what we must keep: the record of who did what, and the agreements you accepted, stay, because other people rely on them.

Depending on where you live, you may have further rights under the law there, and the right to complain to your data protection authority. Write to us first and we will try to put it right.

Cookies

vsqrd.com sets no cookies. The portal sets two, both needed to sign you in, and none from anyone else:

  • A session cookie that keeps you signed in. Its contents are encrypted. It ends when you sign out or close your browser.
  • A short-lived cookie, ten minutes at most, used only while you sign in, to protect the sign-in handshake.

The portal also remembers two display choices in your own browser, whether you picked a light or dark look and whether the side menu is open. They stay on your device and are never sent to us.

Children

The portal is a professional tool for people working at sponsors and CROs. It is not directed at, and not to be used by, anyone under 18.

Changes to this policy

If we change this policy in a way that matters, we will tell the organizations on the portal before the change takes effect, and the date at the top of this page will change. We will not quietly widen what we collect or who sees it.

Getting in touch

Questions, requests, or concerns about any of the above go to vikram@vsqrd.com. We read every message and will answer within a reasonable time.