Privacy Policy

01Who we are

DataOrigin ("DataOrigin", "we", "us") is the operator of this website. This policy explains how we handle personal data when you visit dataorigin.ai, contact us, apply to join our expert network, or work with us as a data partner or customer.

We are the controller of the personal data described in this policy under the data protection laws that apply to you, including the EU/UK GDPR and applicable US state privacy laws.

02What we collect

We collect only what we need to respond to you and run the business.

Contact and enquiry data — name, work email, organisation and the content of your message when you use the contact form or email us.
Expert application data — professional credentials, qualifications, work history, exam and trial results, and payment details needed to pay you, if you apply to or join the expert network.
Partner and customer data — contact details, contract terms and correspondence for the organisations we license data from or deliver data to.
Technical data — IP address, browser type, pages visited and referring URL, collected by our hosting provider's server logs.

03Personal data inside licensed datasets

The datasets we license and prepare for AI training may originate from records that contained personal data — for example clinical notes, support tickets or code review threads. We treat this separately from your data as a visitor or contact:

Source institutions license data to us under written agreements that set out the lawful basis, consent framework and permitted use.
We remove direct identifiers and reduce quasi-identifiers before data leaves the source environment, and every transformation is logged.
Residual risk is reviewed by a person before any record is packaged, and records that cannot be adequately de-identified are dropped.
We do not sell personal data. Licensed datasets are delivered only to customers bound by contractual restrictions on re-identification and use.

If you believe a dataset we prepared contains personal data about you that should not be there, contact us at the address below and we will investigate.

04How we use your data

To respond to enquiries and sample requests.
To assess expert applications, run screening exams and paid trials, and pay experts for work.
To negotiate, perform and enforce contracts with data partners and customers.
To operate, secure and improve the website.
To comply with legal obligations, including tax, accounting and lawful requests from authorities.

We do not use your data for advertising and we do not send marketing newsletters. We reply to you by email.

05Legal basis

Where GDPR or a similar law applies, we rely on: performance of a contract or steps taken at your request before entering one (enquiries, applications, partner and customer agreements); our legitimate interests in running and securing the business, balanced against your rights; and legal obligations. Where we rely on consent, you can withdraw it at any time.

06Contact form and third-party processors

Our contact form is processed by Formspree, which transmits your submission to us by email and stores it for a limited period on our behalf. The website is hosted by Netlify, whose servers may be located outside your country. Fonts are served by Google Fonts, which receives your IP address when the font files are requested. Each of these providers processes data under its own terms and our agreements with them.

07Cookies and analytics

This website sets no cookies of its own and runs no analytics or tracking scripts. The only data collected automatically is standard server-log data held by our hosting provider for security and capacity planning.

We share personal data only with: service providers who process it on our behalf under contract (hosting, form handling, payments, professional advisers); counterparties where necessary to perform a contract you are party to; and authorities where required by law. We do not sell personal data and we do not share it with data brokers.

09International transfers

Our team and service providers operate in several countries, so your data may be stored or processed outside the country you live in. Where a law restricts such transfers, we use appropriate safeguards such as standard contractual clauses.

10Retention

Enquiries are kept for up to 24 months after our last contact. Expert application data is kept for 12 months after an unsuccessful application and for the duration of the engagement plus statutory record-keeping periods for admitted experts. Contract and financial records are kept for the period required by applicable law. Server logs are rotated within 90 days.

11Security

We use encryption in transit and at rest, role-based access, logging of access to data pipelines, and contractual security obligations for every provider and customer. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the relevant authority as the law requires.

12Your rights

Depending on where you are, you have the right to access the personal data we hold about you, to correct or erase it, to withdraw consent, to nominate someone to exercise your rights on your behalf, to object to or restrict certain processing, and to receive a copy of data you provided. To exercise any of these, email us at the address below. We will respond within the time the law allows, and we may ask you to verify your identity first. You also have the right to complain to your local data protection authority.

13Children

Our services are for organisations and working professionals. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

14Changes and contact

We may update this policy as our services or the law change. The date at the top of this page shows when it was last revised, and material changes will be flagged on this page.

Questions, requests and complaints: partnerships@dataorigin.ai.