Privacy Policy

How Evidex handles information used in the evidence workspace
Sep 11, 2026

Scope

This policy explains how Evidex handles information when authorized users evaluate the oncology evidence workspace, use a pilot integration, or access an Evidex deployment managed by their organization.

Evidex supports evidence review. It is not an electronic health record, a diagnostic service, or a substitute for independent clinical judgment.

Information handled by the service

Depending on the deployment and features enabled by an organization, Evidex may process:

  • account information supplied by an administrator, such as a name, work email, organization, role, and access permissions;
  • structured query inputs, such as disease, biomarker, alteration, jurisdiction, and interface language;
  • technical and security records needed to operate the service, such as timestamps, browser information, request status, and audit events; and
  • feedback or support information intentionally submitted by an authorized user.

The public evidence demo is designed for the structured examples shown in its interface. Users should not enter names, medical record numbers, contact details, free-text clinical notes, or other directly identifying patient information into that demo.

Purposes

Information is used to provide and secure the service, return evidence results, maintain traceability, investigate errors, support authorized users, and improve product reliability. Evidex does not use structured evidence queries to make autonomous treatment decisions.

Service providers and disclosure

Information may be handled by infrastructure and model service providers that support an Evidex deployment, subject to the deployment's configuration and contractual controls. Information may also be disclosed when required by law or necessary to protect the security and rights of users, organizations, or the service. Evidex does not sell personal information.

Retention and security

Retention periods and available controls depend on the agreement and configuration for each deployment. Evidex uses access controls and operational safeguards appropriate to the service, but no Internet service can guarantee absolute security.

Requests and contact

For access, correction, deletion, retention, or privacy questions, contact the Evidex administrator or implementation lead identified by your organization. The responsible deployment operator will handle requests under the applicable agreement and law.

Changes

This policy may be updated as Evidex capabilities and deployment controls mature. The date above identifies the current version.