Privacy Policy

Effective date: September 21, 2026
Last updated: September 21, 2026

This Privacy Policy explains how Wayturn AB (“Wayturn”, “we”, “us” or “our”) collects, uses, discloses, stores and protects personal information through:

• Our website at https://wayturn.com
• Study-specific recruitment pages
• Research-study prescreening forms
• Study-related email, telephone and SMS communications
• Related recruitment, verification and reporting services

Wayturn provides advertising and participant recruitment services for clinical and academic research studies in multiple countries. We help individuals express interest in studies and complete initial prescreening before their information is transferred or made available to the responsible research organization.

In this Privacy Policy, “personal information” includes personal data, personal health information, protected health information and similar terms used under applicable privacy laws.

1. Who We Are

Wayturn is operated by:

Wayturn AB
Skalla Hamnväg 3
647 35 Mariefred
Sweden

Privacy contact: info@wayturn.com

For privacy questions, complaints or requests, please write “Privacy Request” in the subject line.

2. Research Organizations and Wayturn’s Role

In this policy, “Research Organization” means the hospital, university, research institution, investigator, study sponsor or other organization responsible for the relevant study.

The Research Organization and study are identified in the applicable recruitment page, advertisement, prescreening form or study-specific notice.

Depending on the country, applicable law and contractual arrangement:

• The Research Organization may be described as a data controller, health information custodian, covered entity, study sponsor or responsible organization.
• Wayturn may be described as a data processor, service provider, agent, contractor or business associate.

Unless a study-specific notice states otherwise, the Research Organization determines why participant information is collected and how it will be used. Wayturn processes that information for recruitment purposes according to the Research Organization’s instructions and our agreement with it.

Where required for a particular study or jurisdiction, additional obligations may be established through a data-processing agreement, privacy and security agreement, business associate agreement or other written contract.

Wayturn acts independently in relation to limited activities necessary to:

• Operate and secure our website and services
• Prevent fraudulent or duplicate submissions
• Maintain consent, access and transfer records
• Respond to privacy requests and complaints
• Meet our own legal obligations
• Establish, exercise or defend legal claims

A study-specific privacy notice or consent statement may provide additional information. If it differs from this general Privacy Policy, the study-specific information applies to that study.

After personal information has been transferred or made available to a Research Organization, that organization is responsible for its own use and retention of the information under its privacy policies, research protocol and applicable law.

3. Applicable Privacy Laws

Wayturn operates from Sweden and provides services internationally.

Depending on the location of the participant, Research Organization and study, personal information may be subject to laws such as:

• The European Union General Data Protection Regulation
• The United Kingdom General Data Protection Regulation and Data Protection Act
• Canadian federal or provincial privacy laws
• Ontario’s Personal Health Information Protection Act
• United States federal or state privacy laws
• The Health Insurance Portability and Accountability Act where it applies to the particular Research Organization, information and service arrangement
• Other national, state, provincial or regional privacy and health-information laws

Not every law listed above applies to every study or individual. Study-specific notices and agreements may provide additional information about the rules applicable to a particular project.

4. Scope of This Policy

This Privacy Policy applies to personal information Wayturn receives when you:

• Visit our website
• Respond to a study advertisement
• Complete or partially complete a prescreening form
• Verify your telephone number
• Contact Wayturn by email, telephone or SMS
• Ask to access, correct or delete your information
• Withdraw consent or opt out of further study-related contact

This policy does not govern a Research Organization’s independent handling of information after it receives or controls that information.

5. Information We Collect

The information collected for a particular study depends on its eligibility requirements. We limit collection to information reasonably necessary for recruitment, verification, security and initial prescreening.

Contact information

This may include:

• Name
• Email address
• Telephone number
• Preferred contact method
• City, state, province, region, postal code or general location

Demographic information

This may include:

• Age or date of birth
• Sex or gender where relevant to study eligibility
• Language
• Other demographic characteristics required by the study

Health and medical information

Depending on the study, a prescreening form may ask about:

• Diagnosed conditions
• Symptoms
• Medical history
• Current or previous treatments
• Medication use
• Relevant procedures or test results
• Other health information directly related to study eligibility

We do not request complete medical records unless a study-specific process expressly requires them and the responsible Research Organization has authorized the collection.

Consent and verification information

We collect records showing:

• The consent statement presented to you
• Whether and when you provided consent
• The version of the form or policy accepted
• Telephone verification status
• Verification timestamps and delivery information
• Withdrawal or opt-out requests

Communications

We may collect information contained in study-related emails, telephone calls or SMS messages, including questions, scheduling information and contact preferences.

Technical and security information

When you access our website or forms, we or our providers may automatically receive:

• IP address
• Browser and device type
• Operating system
• Approximate location derived from an IP address
• Referring page, website, advertisement or campaign
• Pages visited
• Dates and times of access
• Cookie or similar identifiers
• Security and access logs
• Information used to detect duplicate, automated or fraudulent submissions

We do not obtain prospective participants’ health information from data brokers.

6. How We Use Personal Information

We use participant information only for the specific study for which it was collected and for related operational, legal and security purposes.

This includes:

• Confirming that a telephone number is valid
• Comparing answers against initial study criteria
• Identifying incomplete, duplicate or potentially fraudulent submissions
• Contacting you about the study for which you submitted information
• Responding to questions about that study
• Transferring or making information available to the responsible research team after you have consented
• Assisting the research team with recruitment administration
• Maintaining consent, access and transfer records
• Measuring recruitment performance using anonymized or aggregate information
• Protecting our systems, forms, Research Organizations and participants
• Responding to privacy requests, complaints or legal requirements

Wayturn does not make medical diagnoses, provide medical advice or decide whether someone is ultimately eligible or enrolled in a study. Initial prescreening is not a substitute for evaluation by the responsible research team.

We do not:

• Sell participant information
• Use health information for advertising
• Market unrelated products or services to participants
• Contact participants about future studies
• Add participants to general marketing lists
• Upload participant lists to advertising platforms as custom audiences
• Use prescreening answers to build advertising profiles

7. Consent and Telephone Verification

Each prescreening form includes an explicit consent step. A completed prescreening application cannot be submitted unless the required consent is provided.

The consent statement identifies or links to information about:

• The study
• The responsible Research Organization or team
• The information being requested
• Why the information is needed
• Who may receive it
• How consent may be withdrawn

Information collected in a prescreening form may be considered health information, sensitive personal information or a special category of personal data. Where Wayturn or the Research Organization relies on consent, explicit consent is obtained for this processing.

Required SMS verification

Telephone verification is a required part of our prescreening process. We use the telephone number provided to send a verification code through our SMS provider, Twilio.

The verification message is operational and is not a marketing message. If you do not wish to receive the required verification message, you will not be able to complete the relevant prescreening form.

Your telephone number may also be used for communications about the specific study if this is disclosed in the form. It will not be used to promote future studies or unrelated products or services.

Standard telephone or message charges imposed by your service provider may apply.

8. Legal Bases for Processing

Where Wayturn acts as a service provider, agent, contractor, business associate or processor, the Research Organization determines the legal authority or lawful basis for the study-related processing.

Where Wayturn is responsible for determining a processing activity, the applicable legal bases may include:

• Consent, for collecting and using information submitted through a study form
• Explicit consent, for health information and other sensitive personal information
• Legitimate interests, for protecting our services, preventing fraud, maintaining appropriate records and securing our systems, where those interests are not overridden by individual rights
• Compliance with legal obligations
• Establishment, exercise or defence of legal claims

Where consent is the legal basis, you may withdraw it at any time. Withdrawal does not affect processing that lawfully occurred before consent was withdrawn.

Withdrawing consent may prevent Wayturn or the research team from continuing to assess or contact you about the study.

9. Initial Prescreening

Some forms may automatically compare answers against rule-based eligibility criteria supplied by the Research Organization. This may result in a preliminary indication that you appear to meet or not meet certain study criteria.

This preliminary result:

• Is limited to the study for which the form was completed
• Does not constitute a medical diagnosis
• Does not guarantee eligibility or enrollment
• Does not replace assessment by qualified research personnel
• Is not used to market other studies or services to you

The responsible research team makes any final decision about further screening, eligibility or study participation.

10. When We Share Personal Information

We may disclose personal information in the following circumstances.

The responsible Research Organization or team

When you provide the required consent, we may securely transfer or make your information available to the hospital, university, investigator, research team, study sponsor or other organization identified in the study form.

That organization may contact you to conduct further screening or discuss possible participation.

Service providers

We use service providers to host forms, send communications, verify telephone numbers, host our website and protect our systems. These providers receive only the information reasonably necessary to perform their services.

Legal and safety requirements

We may disclose information where reasonably necessary to:

• Comply with applicable law, regulation, subpoena, court order or other binding legal process
• Investigate or respond to a privacy or security incident
• Prevent fraud, abuse or unlawful activity
• Protect the rights, safety or security of individuals, Wayturn or a Research Organization
• Establish, exercise or defend legal claims

We do not sell or rent personal information.

11. Service Providers and Processing Locations

Wayturn currently uses the following principal service providers:

Provider	Purpose	Information processed	Processing or storage information
Jotform	Hosting prescreening forms and storing submissions	Contact, demographic, health, consent and technical information entered in forms	Form data is stored in Frankfurt, Germany
Google Gmail	Study-related email and administration	Email addresses, contact details and the contents of email correspondence	Information may be processed through Google’s international infrastructure
Twilio	Sending required telephone verification codes and study-related SMS where applicable	Telephone number, message delivery information and verification metadata	Information may be processed internationally, including in the United States
VeeroTech	Hosting the Wayturn website	Website access logs, IP addresses and other technical information	Website-hosting infrastructure may process information in the United States

VeeroTech does not host completed Jotform prescreening submissions.

Service providers may retain limited technical, security, billing or audit records according to their legal obligations and service terms.

Where health information is subject to additional contractual or regulatory requirements, Wayturn and the Research Organization determine whether additional provider agreements or configurations are required.

12. International Processing and Transfers

Because Wayturn provides international services:

• Prescreening form data is stored through Jotform in Frankfurt, Germany.
• Authorized Wayturn personnel may access study information from Sweden.
• Authorized Research Organization personnel may access information from their own country.
• Email, SMS and website providers may process limited information in other countries, including the United States.

Information processed in another country may be subject to that country’s laws and may be accessible to courts, law-enforcement agencies or public authorities where legally permitted.

Where required, Wayturn and the Research Organization use contractual, organizational and technical safeguards for international processing and transfers. You may contact us for additional information about safeguards relevant to your information.

13. Website Cookies, Analytics and Advertising Technologies

Our general website may use cookies, analytics tools and advertising technologies to:

• Operate and secure the website
• Understand website use
• Measure the performance of advertising campaigns
• Determine which advertisements or referral sources brought visitors to the website
• Improve website functionality and recruitment campaigns

These technologies may receive technical information such as:

• IP address
• Browser and device information
• Cookie or advertising identifiers
• Referring website or advertisement
• Pages viewed
• General website interactions
• Approximate location derived from an IP address

Non-essential analytics and advertising technologies are used subject to applicable consent or opt-out requirements. Where available, you may manage them through our website’s cookie controls, browser settings or legally recognized privacy preference signals.

Prescreening forms

Wayturn does not place advertising tags, advertising pixels or session-replay technologies inside its Jotform prescreening forms.

We do not send the following information to advertising platforms:

• Information entered in prescreening forms
• Names, email addresses or telephone numbers collected through the forms
• Health or medical information
• Prescreening answers
• Eligibility results
• Participant lists

We do not upload study leads to advertising platforms as custom audiences.

Advertising platforms may independently process information when you use their own websites, applications or advertisements. Their processing is governed by their own privacy policies.

14. Data Retention and Anonymization

Wayturn retains identifiable participant and prescreening information for no longer than three months from the date of collection, unless:

• The Research Organization requires a shorter period
• Applicable law or a binding agreement requires limited information to be retained for longer
• Information must be preserved temporarily in connection with a complaint, investigation, security incident or legal claim

At the end of the retention period, direct identifiers and other information that could reasonably identify the participant are deleted from Wayturn-controlled recruitment records.

Wayturn may retain irreversibly anonymized information for:

• Aggregate recruitment reporting
• Campaign performance measurement
• Service planning
• Fraud and quality analysis
• Statistical purposes

Anonymized information does not contain names, contact details or other information that can reasonably be used to identify a participant. Wayturn does not attempt to reidentify anonymized information.

The Research Organization may retain its own copy under a different retention schedule. Questions about information already transferred or made available to a Research Organization should be directed to that organization or the contact identified in the study materials.

15. Security Safeguards

Wayturn uses administrative, technical and organizational safeguards appropriate to the sensitivity of the information handled.

These safeguards include:

• Encryption protections within Jotform
• Encrypted connections when forms and website pages are transmitted
• Authenticator-based multifactor authentication for Wayturn’s Jotform access
• Access restricted according to study responsibilities
• Access logging within Jotform
• Periodic access reviews
• Annual privacy and security training
• Institution-controlled email addresses for client access invitations
• Removal of access when it is no longer required
• Documented incident-response procedures
• Secure deletion or anonymization after the retention period

Within Wayturn, access to identifiable prescreening information is restricted to one designated person per study.

Authorized representatives of the Research Organization may be invited to access study information directly through Jotform. Invitations are issued only to institution-controlled email addresses approved for that study.

No internet transmission or storage system can be guaranteed to be completely secure. We therefore maintain procedures for detecting, investigating and responding to suspected privacy or security incidents.

16. Privacy and Security Incidents

If Wayturn becomes aware of a suspected or confirmed privacy or security incident affecting identifiable study information, we will:

• Take reasonable steps to contain and investigate the incident
• Protect affected systems and information
• Notify the affected Research Organization within 24 hours of becoming aware of the incident
• Preserve relevant evidence and access records
• Cooperate with the Research Organization’s investigation, risk assessment and notification obligations
• Notify affected individuals or regulators where Wayturn is legally required to do so

A Research Organization may have additional breach-response and notification obligations under applicable healthcare, privacy or research requirements.

17. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• Ask whether Wayturn holds personal information about you
• Request access to that information
• Request information about its sources, purposes and recipients
• Request correction of inaccurate or incomplete information
• Request deletion of information held by Wayturn
• Withdraw consent
• Request restriction of certain processing
• Object to certain processing
• Request a portable copy of information you provided
• Opt out of certain targeted advertising, sale or sharing activities where applicable
• Limit certain uses of sensitive personal information where applicable
• Appeal the denial of a privacy request where applicable
• Submit a complaint without being discriminated against for exercising a privacy right
• Complain to an applicable privacy or data-protection authority

Wayturn does not sell participant information and does not use participant or prescreening information for targeted advertising.

To exercise a privacy right, contact info@wayturn.com with the subject line “Privacy Request.”

We may request enough information to verify your identity before responding. We will not request more information than reasonably necessary for verification.

If your information has already been transferred or made available to a Research Organization, Wayturn may forward your request to that organization or provide its contact information. Wayturn cannot independently delete information controlled by another organization.

We will respond within the period required by applicable law.

You may also complain to:

• The responsible Research Organization or its privacy office
• The Swedish Authority for Privacy Protection
• The privacy or data-protection authority responsible for your country, state or province
• The Office of the Privacy Commissioner of Canada, where applicable
• The Information and Privacy Commissioner of Ontario, where applicable
• The appropriate United States federal or state authority, where applicable

18. Children and Minors

Wayturn does not knowingly collect information from children for a study unless:

• The study permits recruitment of children or minors
• The responsible Research Organization has authorized the recruitment process
• Applicable ethical, legal and consent requirements are followed

A child under 13 may not independently submit a Wayturn prescreening form. The form must be submitted by, or with the verified authorization of, a parent or legal guardian.

A particular country or study may impose a higher age threshold or stricter guardian-consent requirements. Those requirements will be stated in the study materials or form.

If we learn that information from a child was collected without the required authorization, we will delete it or refer the matter to the responsible Research Organization as appropriate.

19. Third-Party Websites

Our website, advertisements and forms may contain links to websites operated by Research Organizations, study sponsors, social-media platforms or other third parties.

Wayturn is not responsible for the independent privacy practices of those organizations. We encourage you to review their privacy notices before providing information directly to them.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, providers, security practices or legal obligations.

The revised policy will be posted on this page with a new “Last updated” date. Where required, we will provide additional notice or obtain new consent before using personal information for a materially different purpose.

21. Contact Us

For privacy questions, requests or complaints:

Wayturn AB
Attn: Privacy Officer
Skalla Hamnväg 3
647 35 Mariefred
Sweden

Email: info@wayturn.com