Privacy Policy

ClinicalTrials.gg is run by Yongjang Jo, an individual, at Sanseong-daero 136, Seongnam, Gyeonggi, Republic of Korea. “ClinicalTrials.gg” is the name the site trades under; the person responsible for your data is the named individual above.

Yongjang Jo is also the data protection officer for the purposes of Korean law. Privacy enquiries, and any request about your own data, go to contact@clinicaltrials.gg.

This site is operated from the Republic of Korea, so Korean personal data protection law applies to it.

The site is in English and open to anyone, so people in the European Economic Area and the United Kingdom use it too. Where that is the case, the GDPR and UK GDPR apply to their data as well, and this policy is written to meet both. Nothing in our Terms of Use changes that — data protection law applies by its own terms and cannot be contracted away.

We treat people in the EEA and the UK as an intended audience rather than an incidental one. This site is in English, carries records from European sponsors and trial sites, and applies no geographic limit, so any other reading would not be credible. Article 3(2) therefore applies to us directly, and we do not rely on being outside its reach.

There is no analytics script, no advertising network, no tracking pixel and no third-party script on any page of this site. Visits are counted from the server logs described below, in aggregate, and nothing is added to the page to do it. We do not sell or share personal data with advertisers or data brokers, and we do not build profiles for advertising.

The only cookie we set is the sign-in session cookie described below. Signed-out visitors are set no cookies at all.

Your email address, when you sign in. Either you give it to us for a sign-in link, or Google gives it to us when you sign in with Google. It is how we identify your account and how we send the mail you have asked for. We also store Google’s stable account identifier so that signing in again reaches the same account.

A display name. It is pseudonymous by default and it is the only name this site ever shows beside anything you write.

A real name, optionally. We ask researchers and industry accounts for one. It is displayed nowhere today and is not used for anything today. You can leave it empty.

What kind of person you said you are — researcher, industry, investor or patient — asked once at sign-up. It is displayed nowhere and, in particular, never appears next to a comment. It sets two starting points and nothing more: whether pages invite you to make an eligibility set, and whether drug pages first count related medicines too (for a patient, participant or caregiver). You can change either, and neither is shown to anyone.

Your IP address, recorded with a sign-in link request so that the same address cannot request an unlimited number of them. It is not attached to your browsing.

What you write and what you follow — your comments, your reports of other comments, the studies you follow, and the searches you save to watch, with the studies each one matches and its weekly reports.

The days you use the site signed in — the last one, and how many there have been, to improve the service. They are counted only in total, to see how often accounts come back; weekly totals record how many accounts were back, never which. Nothing is recorded while you are signed out, and the days are not taken from the server logs. They are in your data download.

Every request to this site is recorded, whether or not you are signed in: your IP address, the page or file requested, the page you came from (the referrer), your browser’s self-description (the user agent), the response, and the time. No cookie is involved and nothing identifies your account in these records.

They are kept in three places: on our server in Korea; by Amazon CloudFront, which delivers the site, in Amazon S3 in Seoul; and by AWS WAF, the firewall in front of the site, in the United States.

We use them for two things. Security — telling people from automated traffic, blocking abusive crawlers and attacks, and investigating incidents. Counting visits — how many pages are read, which studies, which sites send readers here, and how visits move from page to page and where they end — reported only as totals. To count a visit as one, its requests are grouped by address and browser while the count is made; only the totals are kept, and no route through the site is reported unless several visits took it. We do not build a profile of anyone from them, link them to an account, or share them with anyone.

The exception. Where malicious use is suspected, or where security otherwise requires it, we may look at the requests from a particular address or address range, and at the account those requests used, to find out what happened and to stop it. We look at no more than that needs, use it for nothing else, and keep nothing from it beyond the periods below unless it is needed as evidence.

The legal basis is our legitimate interest in keeping the site secure and knowing whether it is used (Article 6(1)(f) GDPR), and for Korean law the equivalent provision for a controller’s legitimate interest. Server and CloudFront logs are deleted after 90 days and firewall logs after 14 days.

Company pages ask readers to tell us when a name, relationship, date or source on them is wrong, or a company is missing. A study page whose main condition we classified differently from the registry asks whether we got it right. Sending either needs no account, and nothing you send is linked to one, even if you are signed in.

We keep what you write and the page it was about, and a keyed hash of your IP address, so that one address cannot send unlimited feedback. The address itself is not stored. The forms ask about companies and studies, not people: please leave out personal details, and anything about your own health.

We use it only to check and correct those pages and our classification. The hash is deleted when we close your feedback; what you wrote is kept as the record of why a page changed. If you included personal details by mistake, write to us and we will delete what you sent entirely. The legal basis is our legitimate interest in keeping the pages accurate (Article 6(1)(f) GDPR), and for Korean law the equivalent provision for a controller’s legitimate interest.

Some drug pages ask readers to report a study they show wrongly. Unlike the feedback above, this needs an account: you sign in to send one, and your report is linked to your account. We keep what you write, the drug and study it was about, how the page showed that study, and what we did about it.

We use it to check and correct our pages, and the link to your account to limit how many reports one account can send and to know whose reports corrected a page. You can see your reports in the file “Download your data” gives you. If you close your account, your reports stay as the record of why a page changed, but nothing ties them to you any more. The forms ask about studies, not people: please leave out personal details, and anything about your own health. If you included any by mistake, write to us and we will delete the report. The legal basis is the same as for the feedback above.

A drug page that has not been read study by study lets a signed-in reader ask for it. We keep which drug you asked for, when, whether you want an email when it is done, and when it was done and mailed. We use it to decide which drugs to read first, counting readers rather than naming them, and to send that one email, to the address your account mails to. You can withdraw a request from the drug’s request page or from your account page, and it is deleted. It is in the file “Download your data” gives you, and closing your account deletes it. The legal basis is providing what you asked for (Article 6(1)(b) GDPR), and for Korean law the equivalent provision for performing a service the person requested.

Four things on this site can say something about your health, and we would rather be blunt about them than bury them.

The studies you follow. A list of the trials one person watches can imply a diagnosis, especially alongside a sign-up answer of “patient”. We treat that combination as health-related information: it is shown to nobody, never used to target anything, and deleted outright when you close your account. The sites you choose to watch on a followed study say roughly where you are; they are kept with the follow, used only for your follow email, and go when you stop watching them, unfollow the study, or close your account.

The searches you save. A saved search such as “breast cancer, Seoul, recruiting” says what someone is looking for as plainly as a follow list does, so it is treated the same way: shown only to you, used for nothing but your weekly report, and deleted outright — with its reports — when you remove it or close your account. A weekly report is kept for a year and then deleted on its own, even while the search stays.

Your eligibility sets and checklists. An age and sex you save to filter searches, and your yes / no / not sure answers to a study’s criteria, are kept in your browser’s own storage, not on our servers and not with your account, and a saved search does not keep them. Your answers leave your browser only in what you take yourself: copied text, the print page, or an email draft in your own mail app. When you switch a set on, its values become part of that search’s address, so they reach our server and its logs as part of that request, like any search (see Server logs). Delete a set on your account page, or clear this site’s data in your browser. Questions you saved for yourself on study pages before 8 November 2026 are deleted from your browser the next time you open any study page.

What you write in a comment. Comments are public, visible to anyone on the internet, and indexed by search engines. If you describe your own condition or treatment in one, you are publishing it. Please do not post anything about your health, or anyone else’s, that you would not want attached to your display name permanently.

You can report a comment that exposes personal data — yours or somebody else’s — and it is hidden pending review rather than after it.

“I’d join this” on a Patient Circle. Condition pages ask whether you would want a Patient Circle for that condition. Pressing it adds one to that condition’s count, and that is all we store: not your account, not anything else about you. Your browser remembers that you pressed it, so it counts once from there. The request itself reaches our server logs like any other (see Server logs).

The basis for holding that answer is your explicit consent — nothing else. Health-related information is special-category data under Article 9 of the GDPR and 민감정보 under Article 23 of the Korean Act, and both want a consent asked separately rather than folded into signing up. So we ask separately: choosing “patient, participant or caregiver” shows a box explaining what the answer implies, and the answer is not stored unless you tick it. We record when you did.

Change that answer, or close the account, and the consent is withdrawn — we delete the record of it rather than keep it, because a note saying you once answered “patient” would carry the same implication the consent was protecting. Choosing that answer again asks again.

The answer decides which group’s tools your account page gathers in a tab of its own, and one space is for this answer only: Patient Circles are for patients, participants and caregivers who gave this consent. Everything that is not for one group — searching, saved searches, following studies, the discussion — works the same with “Prefer not to say”. Following a study is not gated on the answer either, and following alone, without it, is not treated as a statement about your health.

Sign-in links and confirmations, because you asked to sign in.

A digest about studies you follow, if you have left it on. Turning it off does not unfollow anything.

Each kind of email we send you has its own switch under Email on your account page, and every message carries a one-click unsubscribe that turns off that kind and nothing else. The unsubscribe button some mail apps show uses the same link. Sign-in links and notices about your account are sent regardless, because the account depends on them.

No marketing email. We send no newsletters or offers. If that ever changes, they will go only to people who have said yes first, and saying no later will be as easy as any other unsubscribe.

Questions to study contacts. When a comment is marked as a question for the study team, we may email the contact address ClinicalTrials.gov itself publishes on that study’s record. Those people never signed up here, so every such message carries a way to stop — for that study or for all of them — and we honour it permanently. There are daily limits per study and per asker.

We use these outside services, and no others:

• Google, if and only if you choose to sign in with Google. Google tells us your email address and account identifier; we tell Google nothing about what you do here.
• Amazon SES delivers our email, from the AWS us-east-1 region in the United States. It necessarily handles the recipient address and message content. This is the only part of the service that sends personal data outside Korea, and the terms it travels under are set out below. When a message bounces or is marked as spam, SES reports it back to us — the address, which message, and why — through a queue in the same region that keeps each report for at most 4 days. We use those reports for two things only: to stop mailing an address that no longer exists, and to turn off the kind of email someone marked as spam.
• Amazon S3 stores encrypted database backups, in the AWS ap-northeast-2 region in Seoul. They are deleted automatically after 30 days.
• Amazon CloudFront delivers the site. Your request is answered by the CloudFront server nearest you, wherever that is, and CloudFront’s request log is stored in Amazon S3 in Seoul for 90 days.
• AWS WAF screens requests before they reach the site. Its log of requests is stored in the AWS us-east-1 region in the United States for 14 days.

Study records themselves come from ClinicalTrials.gov and contain no information about you. We do not send anything to the registry when you read a study.

Two things leave Korea: email, and the firewall’s request log. Requests themselves are handled by whichever CloudFront server is nearest you, which for a visitor abroad is abroad. Database backups were moved to Seoul on 30 August 2026 and no longer leave.

For users in the European Economic Area and the United Kingdom, those transfers are made under the Standard Contractual Clauses adopted by the European Commission. Those clauses form part of the AWS Service Terms and apply automatically whenever AWS services move data out of the EEA; a UK Addendum on the same terms covers the United Kingdom.

For users in Korea, it is a transfer abroad under the Personal Information Protection Act. What is transferred, to whom, where, why, for how long, and how to avoid it are set out under Transfers abroad below.

One cookie, set only after you sign in. It holds a signed token identifying your account, is marked httpOnly so scripts cannot read it, is restricted to this site, and expires after 30 days. Signing out deletes it.

There are no analytics, preference or advertising cookies, so there is nothing here to consent to or opt out of.

Your browser also keeps a few things for this site in its own storage, which are not sent to us: which What’s New entry you have seen, how many pages you have opened this visit (so the What’s New notice does not interrupt your first one), any eligibility sets you save, and your answers to a study’s criteria checklist.

• Sign-in links expire after 15 minutes and work once.
• A link that also grants a study team badge expires after 7 days; a badge confirmation link expires after 48 hours.
• Your session expires 30 days after you sign in.
• Account data is kept until you close the account.
• Encrypted backups are deleted automatically after 30 days, which is the outer limit on how long anything survives a deletion.
• A request to stop receiving study questions is kept indefinitely — deleting it would mean emailing that address again. The same goes for a registry contact address that bounced or marked a question as spam.
• Bounce and spam reports from our email service wait in its queue for at most 4 days. What we keep from one is a note on your sign-in address that it bounced, which goes when the account does.
• Server and CloudFront request logs are deleted after 90 days, and firewall logs after 14 days.
• The address hash kept with feedback on a company page or a study’s condition is deleted when we close the feedback; the feedback itself is kept as the record of why the page changed.

You can close your account from your account page. When you do:

• Your email addresses and sign-in methods are deleted.
• Every study you follow is deleted.
• Every search you saved, and its weekly reports, is deleted.
• Your real name is deleted and your category is reset.
• Your comments have their text erased and are marked removed. The empty row stays so that replies underneath a question do not lose their shape — nothing you wrote remains readable.
• Every device is signed out immediately.

What is left is an account row with no name, no address and no content. Backups taken before you closed the account expire on their own within 30 days.

You can ask us what we hold about you, correct it, have it deleted, or get a copy of it. You can also object to how we use it, or ask us to restrict that use. Two of these need nobody’s help: under “Your data” on your account page you can download a copy of everything held about your account, as a file you can keep or take elsewhere, and closing your account deletes it immediately.

For anything else, write to contact@clinicaltrials.gg. We will answer within 30 days.

If you are in Korea, you may complain to the Personal Information Protection Commission. If you are in the EEA or the UK, you may complain to your national supervisory authority.

You must be 18 or older to hold an account here. We ask you to confirm it when you set your account up, and we record that you did and when. We do not knowingly keep data about anyone younger; if we learn that an account holder is under 18, we close the account and delete the data.

Reading needs no account. Every study record on this site, including the many that concern children, is readable by anyone without signing in or being asked anything.

We do not ask for your date of birth. A confirmation that you meet the age requirement tells us what we need; a birth date would be one more piece of personal information to hold and protect for no further benefit.

The site is operated from Korea, so the 개인정보 보호법 (Personal Information Protection Act) applies. Article 30(1) lists what a processing policy must contain. Everything above already says most of it; this section restates it in the order and under the names the Act uses, so that each required item can be found.

1. Purposes of processing

To operate an account and sign you in; to show a name beside what you post; to run the discussion, including moderation and reports; to send the study digest you asked for; to improve the service by counting, in total, how often accounts come back; to report weekly on the searches you saved; to stop mailing addresses that bounce and turn off email marked as spam; to pass a question you marked to the study’s registry contact; to confirm a study team badge against the address the registry publishes; to check and correct company pages and study conditions from readers’ feedback; to limit abuse of the sign-in link and of that feedback; and, from server logs, to keep the site secure and count visits in aggregate. Personal data is used for nothing else, and for no advertising purpose.

2. Processing and retention periods

See “How long we keep it” above. In summary: sign-in links 15 minutes, badge-grant links 7 days, badge confirmations 48 hours, sessions 30 days, backups 30 days, server and CloudFront request logs 90 days, firewall logs 14 days, bounce and spam reports from the email service 4 days, the address hash kept with feedback on company pages and study conditions until that feedback is closed, and account data until you close the account.

3. Provision to third parties

None. We do not provide personal data to any third party for that party’s own purposes. The outside services listed above are entrusted processors, which is a different thing and is item 4.

One case is worth naming because it looks like an exception and is not: when you mark a comment as a question for a study team, the comment text and the fact that it came from this site are emailed to the contact address ClinicalTrials.gov publishes. Your email address is not disclosed to them.

3-2. Destruction procedure and method

Data is destroyed when the purpose ends — for account data, when you close the account, which happens immediately and without review. Identities, follows, saved searches and the real name are deleted outright from the database; comment text is overwritten with an empty value. Encrypted backups holding earlier copies expire automatically 30 days later under a storage lifecycle rule, which is the outer bound on destruction.

3-3. Sensitive information that may become public

Comments are public. If you write about your own health in one, that information becomes public, and this site cannot make it private again for you once it is indexed elsewhere.

You can avoid this entirely: reading needs no account, and following a study is private and shown to nobody. To keep something non-public, do not put it in a comment. You may delete your own comment at any time, and closing your account erases the text of everything you wrote.

4. Entrusted processing

Signing in with Google is deliberately not in this table. Nothing is handed to Google to process on our behalf: you authenticate with Google, and Google tells us an address. That is neither entrusted processing nor provision to a third party, and listing it as either would describe the arrangement wrongly. What Google receives, and when, is set out under “Who else sees it” above.

4-2. Pseudonymised data

None. We do not process pseudonymised data under Articles 28-2 or 28-3.

5. Your rights, and how to exercise them

See “Your rights” above. Most of them you can exercise yourself from your account page without asking anyone; for the rest, write to contact@clinicaltrials.gg. Accounts are for people aged 18 or over, so no request is expected from a legal representative acting for a child; one would be handled at the same address.

6. Data protection officer

Yongjang Jo — contact@clinicaltrials.gg. The same address receives requests to see your own data.

7. Automatic collection devices, and how to refuse them

The only cookie is the sign-in session cookie described above. There is no analytics cookie, no advertising cookie and no third-party script. Requests are logged by the server, as any web server does, as set out under “Server logs” above; that involves no device on your side and cannot be refused from the browser.

You can refuse cookies in your browser settings, under privacy or site data. Refusing them does not affect reading anything on this site; it does prevent staying signed in, because the cookie is what holds the session.

8-1. Transfers abroad

One transfer: Amazon Web Services, United States, receiving the recipient address and message content of email we send, for the purpose of delivering it, for as long as delivery and its logs require. It happens at the moment each message is sent, over an encrypted connection to the AWS Simple Email Service API; there is no bulk export and no scheduled batch. Reports of a bounce or a spam complaint come back the other way, through a queue in the same region that keeps each one for at most 4 days. You can avoid it entirely by not holding an account, since no email is sent to anyone who does not have one.

Second: Amazon Web Services, United States, receiving the request log of AWS WAF — IP address, page, user agent and time of each request — for security, kept 14 days. It happens as each request is screened. It cannot be avoided while using the site, since every request passes the firewall.

Requests are also answered by the Amazon CloudFront server nearest the visitor, which may be outside Korea; CloudFront’s own log is stored in Seoul. Backups were moved to Seoul on 30 August 2026 and no longer leave Korea.

8-2. Security measures

• There are no passwords to steal — sign-in is by emailed link or Google, so no password is set, stored, or reused from elsewhere.
• Sign-in and confirmation links are stored only as hashes, so a copy of the database cannot be replayed as a login.
• The session cookie is httpOnly, restricted to this site, and sent only over HTTPS.
• All traffic is encrypted in transit.
• Each outside service has its own credentials with its own limited permissions, so one leaked key does not reach the others.
• Backups are encrypted and expire automatically after 30 days.

8-3. Where to complain

Write to us first if you can. You may also go to any of these, independently of us:

• Personal Information Dispute Mediation Committee — kopico.go.kr, 1833-6972
• Personal Information Infringement Report Centre — privacy.kisa.or.kr, 118
• Supreme Prosecutors’ Office, cybercrime — 1301; National Police Agency, cybercrime — 182

If this policy changes in a way that affects what we collect or who we share it with, we will say so on this page and date it. This version is dated 2026-11-09.