Open Altio Privacy Notice

What Altio keeps about you when you apply for or use Open Altio, why, and for how long.

This notice covers Open Altio: applying for access, signing in, and using the data through the explorer, exports, downloads and SQL. It sits alongside the data licence, which you accept for yourself when you apply.

Who is responsible

Altio AI Platform LLC ("Altio", "we") is the controller: it decides how this information is used and is responsible for it. You can reach us at contact@altioai.com.

What we store

Your application: your name, email address, role, where you work, country, how you intend to use the data, and how you heard about Open Altio (and what, if you chose Other and said). We also record when you accepted the data licence, and which version.
Your MedDRA subscriber ID, if you give one: the ID of your organisation's MedDRA subscription, each time we checked it with MSSO (the MedDRA Maintenance and Support Services Organization), what MSSO answered (whether the subscription is active, and the name of the organisation the ID belongs to) and when. If Altio turns MedDRA off for your account, we keep why.
Decisions about your access: who approved or denied your application, or ended your access, when, and the reason given.
Sign-ins: when you asked for a sign-in link, when you signed in, and your sessions.
Usage: each filtered export together with the filters used, each full release download, and the text of every SQL query you run, each with the time.
Notes you send: your words, the page and the part you pointed at, and what we decided. A note sent with Improve this from a copy of Open Altio running on your own computer, where you have no account, holds the same, an email address only if you give one so that we can reply, and two random ids that name no person or machine. It is kept on our improvements board like any other note.
Emails: the emails we send you, and the email that tells Altio about your application, are kept in Altio's email account at Google. We also log each email we send: when, to which address, its subject and whether it was sent.

We do not store passwords (you sign in with a link sent by email) and we do not take payment details. Open Altio uses cookies only to keep you signed in, for up to 30 days, and to protect its forms; it uses no tracking or advertising cookies. Your settings and the products you save stay in your browser. The custom MedDRA queries you save are kept in your account, and the ones you share are seen by the members of your organisation. When you use any of them in an export or a query, that use is logged like any other. The FAERS reports themselves are public FDA data; this notice is not about them.

Why we store it

to decide applications, and to give access only to the people we approve;
to check with MSSO, on each use, that your organisation subscribes to MedDRA, which MSSO requires before we may show you MedDRA's hierarchy and SMQs;
to send sign-in links, and emails about your access, your MedDRA subscription and your notes;
to read the notes people send, and to answer those who ask us to;
to enforce the data licence, including the ban on re-identification, and to look into misuse;
to keep the service secure and working, and to apply its limits fairly;
to notice when someone has not signed in for 365 days; Altio is told, but access does not end because of it;
to understand how the data is used, so we can improve it.

We use this information because it is needed to run the licence you accepted, and because we have a legitimate interest in running and approving a controlled, licensed data service. We do not sell it, and we do not use it for advertising.

How long we keep it

Usage records and sign-in records are kept for 365 days (12 months) and then deleted. Everything else is kept while you have access, and after that only as long as we need it to show who applied, who held access under the licence, and what was decided.

Who else sees it

Altio staff who run Open Altio. Service providers that host the service, serve its downloads and send its email process it on our behalf; email is sent through Google. When we check a MedDRA subscriber ID, MSSO receives the ID and nothing else about you. We disclose information to others only where the law requires it.

Deleting your account, and your other rights

You can delete your own account in Settings, by typing your email to confirm. Your access ends at once and your records in Open Altio are erased, your MedDRA subscriber ID and its checks included. Acts in the audit log, such as your application and the decision on it, are kept, with your email and name replaced by "a deleted person". We send one email to confirm. Emails sent to you before that, and our log of them, are not erased this way; ask us if you want them deleted too.

You can also ask us to show you what we hold about you, to correct it, or to delete it. Email contact@altioai.com from the address concerned, with "Open Altio privacy request" in the subject. We answer within one month. You may also complain to your local data protection authority.

Changes to this notice

Each version of this notice has a number and a date, shown at the top. If we change what we store or why, we publish a new version and tell everyone who has access by email.