Inato Website Privacy Policy


This Privacy Policy is intended for any natural person who browsed Inato’s website, has contacted the company or is present on Inato’s database.

The purpose of this policy is to explain what kind of information we process about you, how and why we collect it, how it is used, and how we keep it secure. This Privacy Policy also tells you about your rights and how you can exercise them.

Finally, it tells you how you can exercise your preferences to manage the information we have about you, and, if for some reason you do not want to be in Inato’s database anymore, how to ask us to take you off.

This Privacy Policy forms an integral part of the Terms of Use and by agreeing to the Terms, you fully and unconditionally acknowledge the use of your personal data as described below.

All terms in capital letters have the meaning given whether in the GDPR, or in the Terms of Use.

About Inato

Inato’s marketplace matches the best untapped sites for any given clinical trial based on the site’s capabilities as a fit of a study protocol.

As such, Inato complies with the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”).

Inato is qualified as Data Controller regarding the personal data processed on its website. That means we are fully responsible for the data collected on the Website and which we process. Our full contact details are as follows:


176 avenue Charles de Gaulle – 92200 Neuilly-sur-Seine

About Inato's Database

The following provisions only apply to marketplace members, as personal data are necessarily processed to the extent necessary for using the marketplace.

Inato helps pharmaceutical companies find the best Investigators and Sites to participate in a clinical trial, for a specific therapeutic area. Inato acts as the sole Data Controller regarding its processing pipeline and in the creation of its database.

The purpose of such processing is to evaluate the relevance of both Investigators’ and Sites’ historical experience in the designated therapeutic area. Inato’s mission is to help pharmaceutical companies identify and select the best hospitals to participate in a trial.

What personal information we collect:

Inato limits the information collected by applying the principle of data minimization to the data which we think is likely to enable our Clients to engage with Investigators in a meaningful and targeted way.

The data collected directly from marketplace members include basic information that help us match sites to trials such as:

  • name;
  • job title;
  • affiliation;
  • site address;
  • telephone number;
  • professional email address;
  • title and content of publication;
  • in certain cases: your past publications and the trial(s) you participated in.

Inato does not hold any sensitive personal data about you.

How we collect your personal data:

The vast majority of the information we hold about you comes from publicly available sources (this includes all publications available on PubMed and all trials published on Clinical

We also collect data from other sources including:

  • other publicly available data;
  • pharmaceutical companies that previously worked with you;
  • your coworkers who may redirect us to you;
  • the information you provided us through our website (contact forms, demo request).

The purpose for which we will use your personal data:

Inato uses this information to create an Investigator profile for its Client, which is included in Inato’s database. Our pharmaceutical or CRO company Clients have access to Inato’s database through our Marketplace allowing them to view your profile and send you a questionnaire on a clinical trial that they think you might be interested in (as described hereinafter in section “The Questionnaire”).

Therefore, Inato’s main purpose for using your personal data is to create a repository of data regarding Investigators (the Inato database) and make it available to our Clients on a paying basis, for the benefit of matching you to trials you qualify for.

Your personal data may also be processed in one or more of the following ways:

  • sending out clinical trials questionnaire, or information on a clinical trial;
  • exporting Investigators’ data: Clients can export said data from Inato’s database provided they use it in accordance with all applicable laws;
  • maintaining the administration of our database;
  • compliance with all applicable laws and regulations.

Legal basis for processing your personal data:

Inato’s primary role is to facilitate communication between pharmaceutical companies and Investigators.

Therefore, Inato believes it is in its legitimate interest to process data about you, for the following reasons:

  • facilitating communication between pharmaceutical companies and Investigators is a real and licit interest;
  • it is clearly and precisely exposed in this Privacy Policy for any data subject to read;
  • it benefits the Investigators by giving them opportunities to work with pharmaceutical companies in their area of expertise.

Inato considers and balances any potential negative impact on you and your rights before processing your personal data for its legitimate interests.

Inato does not use your personal data for activities where it believes that its interests are overridden by any unwarranted adverse impact on you.

If at any time you want us to remove you from our Database please email us at and we shall do so as soon as possible.

Inato also uses your contact details for marketing purposes, solely based on your consent. If you initially accepted commercial communication from Inato, and wish to withdraw your consent, please contact us at

The questionnaire

The questionnaire we propose to our Clients to identify the best Investigators is an adaptive questionnaire. It means that initially Investigators will only see one question, then additional questions will appear progressively based on their answers.

The purpose of this processing is to support the identification of relevant Sites for clinical trials and to assess the reliability of contacted physicians.

The legal basis for this specific processing is consent.

Indeed, we use cookies (as described in our Cookie Policy) that are integrated in the questionnaire completion, based on which the reliability of your replies will be assessed.


Inato’s database is not intended for children. Inato does not knowingly collect personal data relating to children. If you are under the age of 18, you are not allowed to use this service or to have your data collected by us, please do contact us right away in such case so we can ensure its deletion.

How is your personal data used for profiling

Inato may use your personal data for automated profiling purposes. The profiling we carry out and how it is used is quite limited. No automated decisions are based on this profiling.

We use profiling to evaluate your experience, therapeutic area of expertise, department and make this information available to our Clients in response to particular enquiries that they may make via Inato’s Marketplace.

Inato may, for example, use profiling to help a Client understand which clinical trial you might be interested in.

You have the right to object profiling with your personal data. If you would like us to stop profiling with your personal data, then please contact us at and we shall remove you from the Inato database.


When Inato’s Clients send you communications via our Marketplaces, those communications may contain software that lets the sender know if you have opened the communication, and if so, which links you have clicked on. This helps understand what content you are or are not interested in, and tailor future communications accordingly.

How we share your personal data and with whom

Inato may share your personal data with its Clients, and other parties detailed below. We may also transfer your personal data outside of the European Economic Area (EEA), but only when specific safeguards have been put in place in order to protect your personal data, meaning that an adequate level of protection is ensured.

Inato may share your personal data with one or all of the following parties, acting as Data Processors:

  • Service providers who work on our behalf for the performance of any contract we enter into with them,
  • Professional advisors including lawyers, accountants and insurers, in order to comply with our legal obligations or for other business reasons,
  • Regulators, copyright bodies and other authorities who require reporting of processing activities in certain circumstances.

We may also share your personal data gathered from public sources with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets.

Personal data provided to us might be shared with third parties, as you gave consent to such usage of your data.

Inato may seek to acquire other businesses or merge with them. If a change happens to our respective business, then the new owners may use your personal data in the same way as set out in this Privacy Policy.

All third parties are compelled to respect the security of your personal data and to treat it in accordance with the law.

Inato does not allow its third-party service providers to use your personal data for their own purposes and only permits them to process your personal data for specified purposes and in accordance with binding contractual obligations which satisfy the requirements of the data protection legislation.

Third parties receiving personal information include:

  • Google Cloud Platform
  • Hubspot
  • Mixpanel
  • Fullstory

International transfers

Some of the third parties to whom we transfer your personal data are also based outside the EU, so their processing of your personal data will involve a transfer outside the EU.

Any personal data transferred outside the EU is processed according to the Standard Contractual Clauses approved by the European Commission, in order to ensure that there is an adequate level of protection for your personal data.

Our security measures

Inato is committed to protecting your personal data. We implemented safeguards including robust and appropriate technologies, processes, and contractual arrangements, so that the data we have about you is protected from unauthorized access and improper use or deletion. Your personal data won’t be kept for longer than is necessary.

The following safeguards are in place to protect your personal data:

  • only authorized staff members can access personal data,
  • a strong password policy is implemented to access any electronic environment where personal data are stored,
  • the deletion of personal data is carried out in such a manner that they are not retrievable, both in online and physical environments,
  • the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident,
  • all staff members are provided training and updated regularly on data security and how to protect personal data.
How long will we use your personal data?

Inato will store your personal data only as long as necessary for the purposes set out in this Privacy Policy, or to fulfill its legal obligations.

Any personal data shared directly with Inato in the questionnaire might be used in any subsequent trial but will be deleted 3 years after you last contacted us.

Your rights

Under the GDPR, you have a number of rights in relation to your personal data.

Inato respects these rights and will help you to exercise them insofar as we are able. These rights are not absolute – in some cases they will not apply to you, or to the particular use that we are making of your data, and there are exceptions (for example if we have to process the data to comply with our own legal obligations) but if that is the case we will let you know.

Your rights include:

  • Right of access: access personal information we hold on you,
  • Right to rectification: require us to correct any mistakes in the information we hold on you,
  • Right to erasure: erase personal information concerning you in certain situations,
  • Right to data portability: receive the personal information you have provided us, in a structured commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations,
  • Right to object: (i) to processing of your personal information for direct marketing purposes, (ii) to decisions taken by automated means (including profiling) which produce legal effects concerning you, or similarly affect you significantly, (iii) object in certain situations to our continued processing of your information,
  • Right to restriction of processing: otherwise restrict our processing of your personal information in certain circumstances.

For further information on each of these rights, including the circumstances in which they apply, you may consult the relevant Data Protection Authority’s website of your country.

You also have the right to file a complaint at any time to the relevant data protection authority of your country, (e.g. for France, the CNIL is the French supervisory authority for data protection issues).

We hope that we would be able to resolve any concerns that you may have before you approach the CNIL so please do contact us in the first instance.

Should you have any questions about this Privacy Policy, the way we use your personal data, or wish to exercise your rights please contact our Data Protection Officer by email at