Privacy Policy

Last updated September 15, 2026

Modality.AI, Inc. (for its address, please refer to https://modality.ai/contact) is committed to protecting and preserving your privacy.

This Privacy Policy describes how Modality.AI, Inc. ("Modality," "we," "our," or "us") processes personal data that we collect from you, that you provide to us, or that we otherwise obtain in connection with your use of our websites, participant assessment platform, research and clinical study management tools, application programming interfaces (APIs), and related products and services (collectively, the "Service").

We may update this Privacy Policy from time to time. The "Last Updated" date indicates when we most recently revised this Privacy Policy.

By accessing or using the Service, you acknowledge that your personal data will be processed as described in this Privacy Policy and, where applicable, as further described in any study-specific privacy notice, informed consent materials, or other documentation provided in connection with the Service.

1. Data Processing on Behalf of Clinical Trial Sponsors and Other Study Organizations

Modality may provide the Service directly or as part of a clinical trial, observational study, healthcare program, or other engagement conducted by, or in collaboration with, a sponsor, research institution, healthcare provider, or other organization.

Depending on the circumstances, Modality may process personal data either as the organization responsible for determining the purposes and means of the processing or on behalf of such an organization. Depending on applicable law, such an organization may be referred to as a controller, business, covered entity, processor, service provider, or business associate.

Modality processes personal data in accordance with applicable law, customer instructions, and any applicable signed agreement. Where required by applicable law, Modality will obtain consent or rely on another lawful basis before processing personal data, as described in the rest of this section.

The organization responsible for the applicable study, program, or service generally provides additional information through study-specific privacy notices, informed consent forms, authorization forms, or similar documentation. Questions regarding study-specific processing should generally be directed to that organization.

Where Modality processes personal data subject to the EU/UK General Data Protection Regulation ("GDPR"), our lawful bases typically include: performance of a contract (Article 6(1)(b)); compliance with a legal obligation (Article 6(1)(c)); our or a third party's legitimate interests in operating, securing, and improving the Service (Article 6(1)(f)); and, where required, your consent (Article 6(1)(a)). Because audio and video recordings ("Recordings") and study data may include health data and biometric data, we process this special category data under Article 9(2)(a) (explicit consent), Article 9(2)(h) (health or social care purposes, subject to appropriate safeguards), or Article 9(2)(j) (scientific research purposes, subject to appropriate safeguards), as applicable to the relevant study.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to lodge a complaint with your local supervisory authority if you believe our processing of your personal data violates applicable law.

We are committed to working collaboratively with our customers and research partners to help ensure that personal data is processed transparently, responsibly, and in accordance with applicable laws, ethical standards, and contractual obligations.

2. Processing for Service Improvement and Compliance

Where permitted by applicable law and our agreements with our customers, Modality may process personal data to improve, maintain, secure, support, validate, and enhance the Service, including artificial intelligence and machine learning technologies using de-identified, anonymized, aggregated, or otherwise appropriately authorized data; to monitor quality and reliability; to detect and prevent security incidents, fraud, or misuse; and to comply with applicable legal, regulatory, contractual, and professional obligations.

Automated Processing. Some features of the Service use machine learning models to analyze Recordings and other study data (for example, to score, classify, or flag responses). 

3. General Privacy Practices

Except as otherwise described in this Privacy Policy or required by applicable law, Modality processes personal data only as necessary to provide and support the Service, fulfill contractual obligations, comply with applicable legal requirements, and protect the security, integrity, and availability of the Service. Where Modality processes personal data on behalf of a customer, our agreements with that customer and applicable law govern such processing.

4. Privacy Notice for the Service

To provide, operate, maintain, secure, and improve the Service, we collect and process certain personal data as described below.

4.1 Information We Collect

Certain features of the Service are designed for use in clinical trials, observational studies, healthcare programs, and other research activities. Participants may provide responses in questionnaires, cognitive or behavioral task responses, and audio and video Recordings, which may include speech, voice, facial expressions, eye gaze, hand and body movements, and other observable behaviors. 

We store recordings using a unique participant identifier rather than your name or other direct identifiers (a process known as pseudonymization). However, because Recordings may include your voice, likeness, or other identifiable characteristics, they remain personal data and are not anonymous. We transmit and store personal data using appropriate technical and organizational safeguards, including encryption.

The categories of personal data we collect depend on your relationship with the Service.

Customer Personnel: If you are affiliated with one of our customers (such as a sponsor, research institution, healthcare provider, contract research organization, or study site), we collect personal data when your organization evaluates or uses the Service, when you are granted access to the Service, or when you register for an account. This information may include your name, job title, professional specialty, business email address, business telephone number, business postal address, account credentials, and records relating to your use of the Service, including training and support activities.

Participants: If you participate in a clinical trial, observational study, healthcare program, or other research activity using the Service, we collect information submitted through the Service; Recordings; study data; information supplied by the applicable organization where necessary; device information, dates, times, and system logs; and other information necessary to provide the Service. 

4.2 Use of Your Information

We use personal data to provide and support the Service; manage accounts; communicate with users; conduct customer engagements; improve quality, usability, and security; develop and validate technologies where permitted; conduct analytics, quality assurance, and audits; comply with legal obligations; and protect against fraud, misuse, and other unauthorized activities.

4.3 Security

We maintain appropriate administrative, technical, and physical safeguards designed to protect personal data. Although we use reasonable measures, no transmission or storage method can be guaranteed to be completely secure.

4.4 Disclosing Your Information

We may disclose personal data to customers and their authorized personnel, affiliated companies and service providers, regulators or governmental authorities where required or permitted by law, and successor entities in connection with corporate transactions. Where required by law, research disclosures will use de-identified, anonymized, or aggregated data.

We do not share personal data for cross-context behavioral advertising. We disclose personal data only as described in this Privacy Policy — principally to the customer/sponsor organization associated with your study, to service providers and contractors who process data on our behalf under written contracts limiting their use of it, and as required by law.

4.5 Third-Party Websites and Services

The Service may contain links to third-party websites or services not operated by Modality. This Privacy Policy does not apply to those websites or services.

4.6 Children and Minors

For purposes of this Privacy Policy, a "child" or "minor" means an individual under the age of 18, or such other age as may be defined as a minor under applicable law in the relevant jurisdiction. Where the Service is used in connection with research or care involving children or other individuals who cannot independently provide legal consent, participation and data collection occur only with the informed authorization of a parent, legal guardian, or other legally authorized representative, and in accordance with the applicable study protocol, informed consent documentation, and applicable law (including, where relevant, the U.S. Children's Online Privacy Protection Act). We do not knowingly permit children to create accounts or use the Service independent of such authorization.

4.7 Data Retention

We retain personal data, including Recordings and study data, for as long as necessary to fulfill the purposes described in this Privacy Policy. In determining specific retention periods, we consider: (a) the retention requirements specified in the applicable clinical trial protocol, sponsor instructions, or data processing agreement; (b) legal, regulatory, and professional recordkeeping obligations applicable to clinical research (which, for FDA-regulated trials, commonly require retention for a minimum number of years following study completion or marketing approval, as specified by the sponsor and applicable regulation); (c) the period necessary to resolve disputes and enforce our agreements; and (d) any shorter period requested by the applicable customer or required by applicable law.

Where Modality acts as a processor or service provider on behalf of a customer, that customer's instructions and its own data retention schedule govern, and Modality will delete, return, or de-identify personal data upon the customer's written and dated instruction, consistent with the parties' agreement. At the end of the applicable retention period, personal data is deleted or de-identified using commercially reasonable methods, except where retention in identifiable form is required by law.

4.8 International Transfers

Personal data may be transferred to and processed in countries other than your own, including the United States. Where required by applicable law, Modality implements appropriate safeguards for such transfers, including the European Commission's Standard Contractual Clauses or another lawful transfer mechanism, as applicable.

4.9 Cookies and Tracking Technologies

Our websites and certain Service features use cookies, web beacons, SDKs, and similar tracking technologies to operate the Service, remember preferences, authenticate users, and understand usage through analytics. We use only the tracking technologies necessary to support the functions of a study. You can control cookies through your browser settings; disabling certain cookies may limit functionality. We do not currently respond to browser "Do Not Track" signals because no common industry standard for such signals has been adopted.

4.10  HIPAA and Protected Health Information

In some engagements, Modality creates, receives, maintains, or transmits protected health information ("PHI") on behalf of a covered entity or another business associate under the U.S. Health Insurance Portability and Accountability Act ("HIPAA"). In those cases, Modality's processing of PHI is governed by a Business Associate Agreement ("BAA") with the applicable covered entity or business associate, and that BAA — together with HIPAA's Privacy, Security, and Breach Notification Rules — governs Modality's use and disclosure of PHI, which may impose obligations in addition to, or in place of, the general practices described elsewhere in this Privacy Policy. Where the Service is used outside of a HIPAA-covered relationship (for example, in connection with research not subject to HIPAA), this Privacy Policy and the applicable study documentation govern instead.

Direct questions about how a specific study or program treats PHI to the sponsor, covered entity, or institution responsible for that study in the first instance, or to Modality's Data Protection Officers using the contact information in Section 5.

4.11  Sub-processors and Data Breach Notification

We engage service providers and sub-processors to help us provide the Service (for example, cloud hosting and infrastructure providers). We require these parties to protect personal data under written agreements that are no less protective than the commitments in this Privacy Policy, and we remain responsible for their handling of personal data to the extent required by applicable law and our customer agreements.

If a security incident affects personal data, we will notify affected customers and, where required by applicable law or contract, affected individuals and/or regulators, without undue delay and in accordance with applicable legal timeframes and our contractual commitments.

5. Contact Us and Your Privacy Rights

Depending on your location and the applicable law, you may have some or all of the following rights with respect to your personal data:

• Access — to obtain confirmation of, and a copy of, the personal data we hold about you.

• Correction — to request correction of inaccurate or incomplete personal data.

• Deletion — to request deletion of your personal data, subject to applicable exceptions (for example, where retention is required for the integrity of a clinical trial record, or by law).

• Portability — to receive certain personal data you provided to us in a portable format, where applicable.

• Restriction or objection to processing — to request that we limit how we use your data, or to object to certain processing, including processing based on legitimate interests.

• Withdrawal of consent — where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

• California residents (CCPA/CPRA): the right to know what personal information (including sensitive personal information, such as health and biometric data) we collect, use, and disclose; the right to delete; the right to correct; the right to opt out of the sale or sharing of personal information (Modality does not sell or share personal information as described in Section 4.4); the right to limit use of sensitive personal information; and the right not to receive discriminatory treatment for exercising these rights.

• Right to lodge a complaint — with a supervisory authority (EEA/UK/Switzerland) or applicable regulator, in addition to contacting us directly.

Many of these rights are subject to exceptions and limitations under applicable law — for example, where data is needed to preserve the scientific integrity of a clinical trial, or where a sponsor or institution, rather than Modality, controls the relevant data and is the appropriate party to respond. We will direct your request accordingly when applicable and will respond to verifiable requests within the timeframe required by applicable law.

To exercise any of these rights, please contact your study coordinator first, because in almost all circumstances we have no way of verifying your identity. We will need to verify your identity before fulfilling certain requests, consistent with applicable law. However,  if you have questions, comments, complaints, or requests regarding this Privacy Policy, please contact our Data Protection Officers:

Modality.AI, Inc.
Attn: Data Protection Officers
Email: dpos@modality.ai

(For the mailing address, please refer to https://modality.ai/contact)