LEGAL

Privacy Policy

Effective date: 1 June 2025 · Version 1.0

This policy explains what data ACRES digital platforms collect, how it is used and stored, and your rights as a user. ACRES is committed to protecting your privacy and handling your research data responsibly.

1. Data Controller

The data controller for the cRhona platform is:

Center for Rapid Evidence Synthesis (ACRES)

Plot 24, Wampewo Close, Kololo, Kampala, Uganda

Email: info@acres.or.ug

Phone: +256 703 700 265

All data protection inquiries should be directed to safety@acres.or.ug.

2. Data We Collect

2.1 Account information

When you register to our platforms, we collect the following:

Full name and email address
Institutional or organisational affiliation
Job title or role (optional)
Authentication credentials (passwords are hashed; we never store plaintext passwords)
OAuth identity data when you sign in via Google, Microsoft, or OpenAthens (see Section 5)

2.2 Usage analytics

We also automatically collect certain usage data to improve the platforms, including:

Pages visited, features used, and actions taken within the Platform
Session duration, browser type, and operating system
IP address (used for security and geographic analytics; not shared with third parties for marketing)
Error logs and performance metrics

Analytics are collected in aggregate and are used solely to improve platforms’ performance and user experience.

2.3 Uploaded documents and metadata

When you upload research documents to any of our digital platforms, we collect and store:

The document files themselves (PDFs, Word documents, etc.)
Document metadata: filename, file size, upload timestamp, uploader identity
Synthesis task data: search queries, inclusion/exclusion criteria, generated outputs

3. Document Storage

How your documents are stored

All uploaded documents are stored on Amazon Web Services (AWS) S3, a cloud object storage service. Documents are encrypted at rest using AES-256 encryption and encrypted in transit using TLS.

Access controls

Access to stored documents is strictly limited:

You — can access documents uploaded to your own account or shared within your organisation on the Platforms.
ACRES technical staff— a small number of authorised ACRES engineers have infrastructure-level access to the S3 bucket for maintenance, debugging, and security monitoring purposes only. Access is logged, audited, and subject to ACRES’s internal data-handling policies.
No other ACRES staff routinely access your documents. Research documents are not reviewed for content except when required to resolve a specific support issue you have raised, and only with your knowledge.
Third-party services — documents may be transmitted to AI processing services as described in Section 4.

Geographic location of data

Data is currently stored in AWS infrastructure. The primary storage region is eu-west-1 (Ireland). If this changes, we will update this policy and notify users.

4. AI Processing

AI processing disclosure

Documents you upload to the digital platforms may be sent to Claude’s or OpenAI’s APIs for processing. By uploading documents to the platforms, you consent to this transmission.

Specifically, when you run a synthesis task, the relevant document content (or extracted text from documents) is transmitted to Claude’s or OpenAI’s servers via their APIs. This is necessary to provide AI-assisted analysis, summarisation, and synthesis features.

OpenAI and Claude data usage

ACRES uses Claude’s or OpenAI’s APIs under a data processing agreement. As of the effective date of this policy, OpenAI and Claude do not, by default, use APIs input or output data to train their models. You should review OpenAI’s current data usage policies directly:

Recommendation: Do not upload documents containing highly sensitive, classified, or legally privileged information unless you have reviewed and are satisfied with Claude’s or OpenAI’s data handling policies.

AI output accuracy

AI-generated synthesis outputs are assistive tools, not authoritative conclusions. You are responsible for verifying their accuracy before publication or use in policy decisions. See the Terms of Use for further details.

5. Third-Party Services

ACRES digital platforms integrate with the following third-party services that may process your data:

Service	Purpose	Data shared
OpenAI & Claude	AI document processing	Document content, synthesis queries
Amazon Web Services (AWS)	Cloud infrastructure & document storage	All uploaded files & account data
Google OAuth	Single sign-on (optional)	Name, email, profile picture
Microsoft OAuth	Single sign-on (optional)	Name, email, profile picture
OpenAthens	Institutional authentication (optional)	Institutional identity attributes

ACRES does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes.

6. Data Retention

Account data

Your account information is retained for as long as your account remains active. If you request account deletion, your personal data will be removed within 30 days of the request, subject to any legal obligations requiring us to retain it longer.

Uploaded documents

Documents you upload are retained on AWS S3 for as long as your account is active, or until you delete them. Deleted documents are permanently removed from our systems within 30 days (including from backups).

Synthesis outputs

Synthesis task outputs and logs are retained for 12 months from the date of generation and then automatically deleted, unless you save them to your account.

Analytics data

Aggregated, anonymised usage analytics are retained indefinitely for product improvement. Individual-level usage logs are retained for a maximum of 24 months.

Requesting deletion

To request deletion of your account or specific data, email info@acres.or.ug with the subject line “Data Deletion Request.”

7. Cookies & Analytics

Our digital platforms use the following types of cookies and tracking:

Essential cookies: Required for authentication and session management. You cannot opt out of these and remain logged in.
Functional cookies: Remember your preferences (e.g., language, layout settings).
Analytics: We use server-side analytics to measure Platform usage. We do not currently use third-party advertising trackers.

You can manage cookies through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform.

8. Your Rights

Under applicable data protection law, you have the following rights regarding your personal data:

Right of access — Request a copy of the personal data ACRES holds about you.
Right to rectification — Request correction of inaccurate or incomplete data.
Right to erasure — Request deletion of your personal data (subject to legal retention obligations).
Right to data portability — Request your data in a structured, machine-readable format.
Right to object — Object to processing of your data in certain circumstances.
Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at info@acres.or.ug. We will respond within 30 days.

9. Security

ACRES implements appropriate technical and organisational measures to protect your data, including:

Encryption at rest (AES-256) and in transit (TLS 1.2+)
Role-based access controls limiting staff access to production data
Regular security reviews and dependency audits
Secure OAuth-based authentication with support for institutional SSO

In the event of a personal data breach affecting your rights and freedoms, ACRES will notify affected users within 72 hours of becoming aware, where required by applicable law.

10. Children

Our platforms are intended for use by researchers and professionals and are not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email. The version number and effective date at the top of this page will always reflect the current version. Continued use of the Platform after updates constitutes acceptance.

12. Contact

For all privacy-related enquiries, including requests to exercise your data rights, please contact:

Data Protection Contact — Center for Rapid Evidence Synthesis