Privacy Policy

Draft · Last updated [date]

This Privacy Policy explains how RoundTableConsensus,Inc. ("we", "us", "EviGap") collects, uses, and protects personal information in connection with the EviGap service and website (the "Service"). EviGap is intended for verified healthcare professionals and researchers, not the general public.

1Information we collect

• Account & verification data — name, professional email, institution, and professional license number, provided to create an account and verify your status as a healthcare professional or researcher.
• Content you submit — the clinical or research questions and context you enter. You must not submit patient names or any protected health information (PHI); the Service is designed for general, de‑identified questions only.
• Usage & technical data — log data, IP address, device/browser information, and interactions with the Service.
• Payment data — handled by our payment processor (Stripe). We do not receive or store full card numbers.
• Cookies — strictly necessary cookies to operate the Service [and analytics cookies, if used — confirm].

2How we use information

• To provide, secure, and improve the Service;
• To verify professional eligibility and manage accounts and entitlements;
• To process subscriptions and payments;
• To communicate service, security, and administrative messages;
• To comply with legal obligations and enforce our terms.

3No protected health information

EviGap is not intended to receive PHI and is not offered as a HIPAA "business associate." Users are instructed not to enter patient‑identifying information. If you believe PHI was entered, contact us so it can be addressed.

4Service providers

We share personal information with vendors who process it on our behalf, under contract, only to run the Service — for example hosting and database ([Supabase]), AI model providers used to generate evidence syntheses ([OpenRouter / model vendors]), payments (Stripe), and email delivery. We do not sell personal information.

5International transfers

We may process information in countries other than yours, including the United States. Where required, we use appropriate safeguards for such transfers. [Confirm transfer mechanism / regions.]

6Retention

We retain personal information for as long as needed to provide the Service and for legitimate legal, security, and business purposes, then delete or anonymize it. [Confirm retention periods.]

7Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing (e.g., under GDPR or CCPA/CPRA). To exercise these rights, contact us at info@evigap.com.

8Security

We use administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure.

9Children

The Service is for professionals and is not directed to individuals under 18. We do not knowingly collect information from children.

10Changes

We may update this Policy from time to time. Material changes will be posted here with a revised date.

11Contact

RoundTableConsensus,Inc. — info@evigap.com, [registered address].