Reskript® Privacy Policy
Effective date: 29.09.2026
This Privacy Policy explains how Medical Pharma Services, s.r.o., the owner and operator of the Reskript® platform, collects, uses, stores, discloses and protects personal data when you visit or use Reskript or purchase services through the platform.
Reskript® is a registered European Union trade mark owned by Medical Pharma Services, s.r.o.
Please read this Privacy Policy carefully to understand how your personal data is handled.
1. Who we are
The Reskript® platform ("Reskript", "Platform", "we", "us" or "our") is owned and operated by:
Medical Pharma Services, s.r.o.
Evropská 846/176a, Prague 160 00
Czech Republic
Company ID (IČO): 27084949
VAT ID: CZ27084949
Email: privacy@m-phar.com
For purposes of applicable data-protection legislation, including the EU General Data Protection Regulation (GDPR), Medical Pharma Services, s.r.o. is generally the data controller for personal data processed in connection with the operation of Reskript and the provision of services to individual customers.
For certain personal data processed on behalf of a business customer, Medical Pharma Services, s.r.o. may act as a data processor. In such circumstances, the processing will be governed by the applicable agreement with the business customer, including a Data Retention Policy where appropriate.
2. What personal data we collect
Depending on how you use Reskript, we may collect the following categories of information.
2.1 Account information
When you create an account, we may collect:
- name;
- email address;
- password or authentication information;
- company or organization name;
- country;
- account preferences; and
- other information you voluntarily provide.
2.2 Purchase and billing information
When you purchase a Reskript service, we may process:
- billing name;
- billing address;
- company details;
- VAT or tax identification number;
- country;
- transaction information;
- purchased services;
- order number;
- payment status;
- information necessary to process or document the transaction.
Payment card details are generally processed by our third-party payment provider and are not stored directly by Reskript unless expressly stated otherwise.
2.3 Customer Materials
To provide Reskript services, you may submit information and materials relating to your clinical-trial project, including:
- study information;
- protocol-related information;
- clinical-trial document content;
- study objectives and endpoints;
- inclusion and exclusion criteria;
- treatment information;
- study procedures;
- investigator or institution information;
- scientific or medical information;
- reference materials;
- existing documents;
- instructions and other content provided by you; and
- information contained in documents uploaded to the Platform.
These materials are referred to in this Privacy Policy as "Customer Materials."
Customer Materials may contain personal data or confidential information.
You should not upload identifiable patient information or other sensitive personal data unless you are legally authorized to do so and the applicable processing requirements and safeguards have been satisfied.
3. Personal data contained in Customer Materials
Reskript is designed primarily for professional medical writers and other professionals working on clinical-trial documentation.
Where Customer Materials contain personal data relating to clinical-trial participants, healthcare professionals, investigators, employees or other individuals, the customer is responsible for ensuring that the information may lawfully be provided to Reskript and processed for the relevant purpose.
Where a business customer determines the purposes and means of processing personal data contained in Customer Materials, Medical Pharma Services, s.r.o. may process such data as a data processor on behalf of that customer.
In such cases, the customer's instructions, applicable agreement and any Data Retention Policy may govern the processing of those data.
Where appropriate, Medical Pharma Services, s.r.o. will process such data only on documented instructions from the relevant controller.
4. Special categories of personal data
Clinical-trial materials may potentially contain information that constitutes special categories of personal data under Article 9 GDPR, including health-related information.
Reskript does not ask users to provide identifiable patient data unless there is a lawful and authorized reason.
Customers should therefore avoid uploading identifiable patient information unless such processing is specifically necessary, lawful and appropriately safeguarded.
Where special-category data are processed on behalf of a business customer, the relevant customer remains responsible for establishing an appropriate legal basis and applicable Article 9 condition under the GDPR or equivalent requirements.
Where Reskript acts as a processor, Medical Pharma Services, s.r.o. will process such information in accordance with the applicable controller's documented instructions and contractual requirements.
5. How we use personal data
We may use personal data for the following purposes:
Providing Reskript services
- creating and managing user accounts;
- processing Customer Materials;
- developing requested documents;
- providing document-development services;
- delivering documents and other outputs;
- providing customer support;
- communicating with customers regarding their orders;
- maintaining the functionality of the Platform.
Operating and securing the Platform
- authentication;
- security monitoring;
- fraud prevention;
- troubleshooting;
- system maintenance;
- performance monitoring;
- backup and recovery;
- preventing unauthorized access;
- protecting the integrity of the Platform.
Payments and administration
- processing payments;
- issuing invoices;
- maintaining accounting records;
- complying with tax obligations;
- managing contractual relationships.
Communications
We may use your contact information to send:
- service-related communications;
- account notifications;
- security notifications;
- transaction confirmations;
- important updates concerning Reskript;
- responses to support requests.
Where legally required, we will obtain appropriate consent before sending marketing communications.
Improving Reskript
We may use appropriately aggregated, anonymized or otherwise lawfully processed information to:
- understand how the Platform is used;
- identify technical problems;
- improve functionality;
- improve user experience;
- develop new services;
- evaluate overall service performance.
We will not use identifiable Customer Materials to publicly promote Reskript without appropriate authorization.
6. Legal bases for processing
Where the GDPR applies, we rely on one or more of the following legal bases:
Performance of a contract
We process information where necessary to:
- create and maintain your account;
- provide purchased services;
- process Customer Materials;
- deliver documents;
- process payments;
- communicate with you regarding your order.
Legal obligations
We may process personal data where necessary to comply with legal obligations, including:
- accounting;
- tax;
- financial reporting;
- regulatory requirements;
- responding to lawful requests from competent authorities.
Legitimate interests
We may process personal data where necessary for our legitimate interests, including:
- securing Reskript;
- preventing fraud and misuse;
- maintaining and improving the Platform;
- defending legal claims;
- managing our business relationships;
- communicating important service information.
Where we rely on legitimate interests, we consider the relevant interests and the rights and freedoms of affected individuals.
Consent
Where required by law, we will obtain your consent before processing personal data for particular purposes, such as certain marketing activities.
You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
7. How Customer Materials are processed
Customer Materials are processed to provide the services requested by the customer.
Depending on the particular Reskript service, Customer Materials may be processed by Reskript's technical infrastructure and by carefully selected service providers acting on our behalf.
Access to Customer Materials is limited to personnel and service providers who require access to perform their authorized functions.
We do not sell Customer Materials.
We do not use Customer Materials for unrelated advertising purposes.
We do not intentionally disclose Customer Materials to third parties for their own independent marketing purposes.
8. Document processing and automated technologies
Reskript uses technology to assist with the analysis, structuring and development of clinical-trial documents.
Certain processing operations may be performed using automated technologies and third-party technical service providers.
Where third-party technology providers are used, Medical Pharma Services, s.r.o. will seek to ensure that appropriate contractual, technical and organizational safeguards are in place.
Unless expressly stated otherwise, Reskript does not make decisions concerning individuals based solely on automated processing for purposes that produce legal effects or similarly significant effects on those individuals.
Reskript is a professional document-development service and does not make decisions about clinical-trial participants, patient eligibility, treatment, diagnosis or medical care.
9. Third-party service providers
We may use carefully selected third-party providers to operate Reskript and provide services, including providers of:
- cloud hosting;
- data storage;
- authentication;
- payment processing;
- email and communications;
- customer support;
- security;
- analytics;
- monitoring;
- backup and recovery;
- other technical infrastructure.
These providers may process personal data only to the extent necessary to provide their services to us and subject to appropriate contractual and confidentiality obligations.
Where required by applicable law, we enter into appropriate data-processing agreements with relevant service providers.
10. International transfers
Some service providers may process personal data outside the European Economic Area (EEA).
Where personal data protected by the GDPR are transferred outside the EEA, we will use appropriate safeguards required by applicable data-protection law.
Depending on the circumstances, these safeguards may include:
- an adequacy decision adopted by the European Commission;
- Standard Contractual Clauses approved by the European Commission;
- appropriate supplementary technical or organizational measures; or
- another lawful transfer mechanism recognized under applicable law.
Information concerning material international transfers and relevant safeguards may be obtained by contacting us using the details provided below.
11. Data retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by law.
Retention periods may depend on the type of information and the purpose for which it was collected.
For example:
- account information may be retained while your account remains active and for a reasonable period thereafter;
- transaction and accounting information may be retained for the period required by applicable tax and accounting laws;
- support communications may be retained for as long as reasonably necessary to manage the relevant relationship or dispute;
- Customer Materials and generated documents may be retained for the period specified in the applicable service terms or account settings; and
- security and technical logs may be retained for a limited period appropriate to the security purpose.
We may retain information for longer where necessary to establish, exercise or defend legal claims.Detailed Data Retention Policy is accessible on Reskript website.
12. Deletion of Customer Materials
You may request deletion of Customer Materials associated with your account, subject to:
- applicable legal retention requirements;
- ongoing contractual obligations;
- legitimate security requirements;
- information that must be retained to establish, exercise or defend legal claims.
Where Customer Materials are processed on behalf of a business customer, deletion will be handled in accordance with the applicable customer agreement and Data Processing Agreement.
Backups may retain deleted information for a limited period until they are securely overwritten in accordance with our backup procedures.
13. Cookies and similar technologies
Reskript may use cookies and similar technologies necessary to operate the Platform.
These may include cookies required for:
- authentication;
- account security;
- session management;
- preferences;
- functionality;
- technical performance.
Where required by applicable law, we will obtain consent before placing non-essential cookies or similar technologies on your device.
Additional information may be provided through our Cookie Policy or cookie-consent mechanism.
14. Analytics
We may use analytics tools to understand general usage of the Platform and improve its performance.
Where analytics involve personal data or non-essential cookies, we will use them in accordance with applicable law and, where required, obtain appropriate consent.
We may use aggregated or anonymized information for statistical and product-development purposes.
15. Marketing communications
We may send service-related communications that are necessary for operating your account or providing purchased services.
Marketing communications will be sent only where permitted by applicable law.
Where consent is required, you may withdraw your consent at any time by using the unsubscribe mechanism provided in the communication or by contacting us.
Withdrawing consent to marketing communications will not affect service-related communications that are necessary to operate your account or provide purchased services.
16. Data security
We implement reasonable technical and organizational measures designed to protect personal data against:
- unauthorized access;
- unauthorized disclosure;
- accidental loss;
- destruction;
- alteration;
- other unlawful or unauthorized processing.
Depending on the nature of the information and the service, these measures may include:
- access controls;
- authentication mechanisms;
- encryption in transit;
- encryption or other appropriate protection at rest;
- logging and monitoring;
- backup and recovery procedures;
- restricted administrative access;
- security testing;
- confidentiality obligations for personnel and service providers.
No internet-based service can guarantee absolute security. You should therefore also take appropriate measures to protect your account credentials and information submitted to the Platform.
17. Data breach and security incidents
Where required by applicable law, Medical Pharma Services, s.r.o. will notify the relevant supervisory authority and/or affected individuals of a personal-data breach.
Where we process personal data as a processor on behalf of a business customer, we will notify the relevant customer in accordance with the applicable contractual requirements and applicable law.
18. Your data-protection rights
Where the GDPR applies, you may have the following rights:
- Right of access – to obtain information about how your personal data are processed and request a copy of your personal data;
- Right to rectification – to request correction of inaccurate or incomplete personal data;
- Right to erasure – to request deletion of personal data in circumstances provided by law;
- Right to restriction – to request restriction of processing in circumstances provided by law;
- Right to data portability – to receive certain personal data in a structured, commonly used and machine-readable format;
- Right to object – to object to certain processing, including processing based on legitimate interests;
- Right to withdraw consent – where processing is based on consent; and
- Right to lodge a complaint with a competent data-protection supervisory authority.
These rights are subject to applicable legal limitations and exceptions.
18A. United States Privacy Rights
Reskript is operated by Medical Pharma Services, s.r.o., a company established in the Czech Republic. Depending on where you reside and the laws applicable to your personal information, you may have additional privacy rights under United States federal or state law.
Reskript does not sell Customer Materials or personal information for monetary consideration and does not use Customer Materials for cross-context behavioral advertising. Reskript also does not use Customer Materials submitted for document development to train general-purpose artificial intelligence models, unless expressly agreed otherwise with the customer.
California Residents
If you are a California resident and Reskript is subject to the California Consumer Privacy Act, as amended ("CCPA"), you may have the following rights, subject to applicable exceptions:
- Right to Know / Access: You may request information about the categories and specific pieces of personal information we collect, the sources of that information, the purposes for which it is used, and the categories of third parties to whom it is disclosed.
- Right to Delete: You may request deletion of personal information that we have collected from you, subject to statutory exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Opt Out of Sale or Sharing: You may request that we do not sell or share your personal information as those terms are defined under the CCPA. Reskript does not sell Customer Materials or personal information and does not share personal information for cross-context behavioral advertising.
- Right to Limit Use and Disclosure of Sensitive Personal Information: Where applicable, you may request limitation of the use and disclosure of sensitive personal information to purposes permitted by the CCPA.
- Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your privacy rights.
California law also provides rights concerning certain automated decision-making technologies where applicable. Reskript does not use personal information to make decisions that produce legal or similarly significant effects concerning users of the Reskript service.
The CCPA distinguishes between personal information collected directly by a business and information processed by a service provider or contractor on behalf of another business. Where Reskript processes personal information contained in Customer Materials solely on behalf of a pharmaceutical company, medical communications agency, medical writer, sponsor, or other business customer, the relevant business customer may determine the purposes and means of processing and may be responsible for responding to certain individual rights requests.
The CCPA currently provides California residents with rights including access, deletion, correction, opt-out of sale or sharing, limitation of certain sensitive personal information uses, and non-discrimination, subject to statutory exceptions.
Exercising US Privacy Rights
To submit a privacy request, please contact us using the contact details provided in Section 25 of this Privacy Policy.
Please include sufficient information for us to understand and verify your request. We may request additional information where reasonably necessary to verify your identity and protect personal information against unauthorized disclosure.
We will respond to valid privacy requests within the time periods required by applicable law.
Where applicable law provides additional rights, Reskript will honor those rights to the extent legally required.
18B. India — Digital Personal Data Protection Act
If you are located in India, or if Indian data protection law otherwise applies to the processing of your personal data, Reskript intends to process digital personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable rules and regulations.
The DPDP Act applies, among other circumstances, to processing of digital personal data in India and to certain processing outside India in connection with offering goods or services to individuals in India.
For purposes of the DPDP Act, depending on the circumstances of the processing, Medical Pharma Services, s.r.o. may act as a Data Fiduciary, while in other circumstances Reskript may process personal data on behalf of a customer who determines the purpose and means of processing.
Notice and Purpose of Processing
Where Reskript acts as a Data Fiduciary, we will provide information regarding:
- the personal data being processed;
- the specified purpose for processing;
- the services or functions enabled by the processing; and
- the means available to withdraw consent and exercise applicable rights.
The DPDP Rules 2025 require the relevant notice to be clear, understandable and sufficiently specific regarding the personal data and purposes of processing.
We will seek consent where consent is the applicable legal basis under the DPDP Act. Where applicable law permits processing without consent, we may process personal data on another lawful basis provided by the DPDP Act.
Withdrawal of Consent
Where processing is based on consent, you may withdraw your consent through the means made available by Reskript.
Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
Where withdrawal of consent makes it impossible for us to provide a particular service, we may no longer be able to provide that service.
Rights of Data Principals
Subject to the DPDP Act and applicable rules, an individual whose personal data is processed by Reskript may have rights including:
- obtaining information about personal data being processed and certain related information;
- requesting correction or updating of personal data;
- requesting erasure of personal data where applicable;
- withdrawing consent where processing is based on consent;
- obtaining information regarding available grievance-redressal mechanisms; and
- nominating another individual to exercise applicable rights in accordance with the DPDP Act.
Reskript will provide reasonable mechanisms through which applicable rights may be exercised.
Grievance Redressal
If you have a privacy or personal-data concern, you may first contact Reskript using the contact details provided in this Privacy Policy.
We will provide an appropriate grievance-redressal mechanism and handle complaints in accordance with applicable law.
Security and Personal Data Breaches
Reskript maintains reasonable technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, destruction or loss.
Where applicable, Reskript will take the notification and other measures required by the DPDP Act and the applicable DPDP Rules in the event of a personal data breach.
Retention and Erasure
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or as otherwise required or permitted by applicable law.
When personal data is no longer required, Reskript will delete or otherwise dispose of it in accordance with its retention practices and applicable legal requirements.
For Customer Materials processed on behalf of a business customer, retention and deletion may instead be governed by the applicable customer agreement, Data Retention Policy, or documented instructions of that customer.
International Processing
Reskript is operated from the European Union and may use service providers located in countries outside India.
Where Indian personal data is transferred or otherwise processed outside India, Reskript will comply with applicable requirements concerning such transfers, including any restrictions or conditions imposed by the Government of India under applicable law.
The DPDP Act provides for restrictions or conditions that may be prescribed by the Central Government concerning transfers of personal data outside India.
18C. Business Customers and Individual Rights
Reskript is primarily designed as a professional service for medical writers, pharmaceutical companies, medical communications agencies and other professional users.
Where a business customer uploads personal data relating to its employees, investigators, healthcare professionals, patients, research participants or other individuals, that customer remains responsible for ensuring that the processing and disclosure of such personal data to Reskript is lawful and appropriately authorized.
Where Reskript acts as a processor, service provider, contractor, or equivalent role on behalf of a business customer, Reskript will process such personal data only for the purposes authorized by that customer and in accordance with the applicable agreement and data protection requirements.
An individual seeking access to, correction, deletion or other rights concerning personal data contained in Customer Materials may therefore need to contact the relevant pharmaceutical company, sponsor, employer, agency or other business customer that controls the processing.
Where legally required, Reskript will reasonably assist the relevant business customer in responding to such requests.
18D. No Sale or Commercial Exploitation of Customer Materials
Reskript does not sell Customer Materials or personal information contained in Customer Materials to third parties.
Reskript does not use Customer Materials for targeted advertising or cross-context behavioral advertising.
Unless expressly agreed otherwise with the customer, Reskript does not permit third-party providers used in connection with the document-development service to use Customer Materials to train general-purpose artificial intelligence models.
Technical service providers may process personal data and Customer Materials solely as necessary to provide hosting, storage, security, payment, authentication, document-processing, communications and other services required to operate Reskript, subject to applicable contractual and data-protection obligations.
18E. Privacy Requests
Privacy requests may be submitted to:
Medical Pharma Services, s.r.o.
Evropská 846/176a, Prague 160 00
Czech Republic
Email: privacy@m-phar.com
When submitting a request, please identify:
1. your name and contact details;
2. the country or state in which you reside;
3. the nature of your request; and
4. sufficient information to allow us to verify your identity where verification is legally required.
We will not discriminate against you for exercising a privacy right available to you under applicable law.
If you are a California resident, you may exercise applicable CCPA rights without being required to create an account with us. California law also permits consumers to use an authorized agent in certain circumstances.
19. Automated decision-making
Reskript does not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
The automated and technology-assisted functions of Reskript are designed to assist with document development and workflow efficiency.
They are not intended to make decisions about an individual's eligibility for a clinical trial, medical treatment, diagnosis, employment, credit, insurance or other similarly significant matters.
20. Children's data
Reskript is intended for professional users and is not directed to children.
We do not knowingly collect personal data from children for the purpose of providing Reskript services.
If you believe that a child has provided personal data to us without appropriate authorization, please contact us.
21. Business customers and data processing
Where a company or organization uses Reskript to process personal data on its behalf, the roles of the parties will be determined based on the relevant processing activity.
Where Medical Pharma Services, s.r.o. acts as a processor, the business customer remains responsible for determining the purposes and legal basis of the processing and for providing appropriate instructions.
A separate Data Retention Policy may apply.
In the event of a conflict between this Privacy Policy and a Data Retention Policy concerning processor activities performed on behalf of a business customer, the Data Retention Policy will prevail to the extent of the conflict.
22. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in:
- Reskript functionality;
- our service providers;
- applicable legislation;
- data-processing practices;
- security and technical measures.
The updated version will be published on the Reskript website with a new effective date.
Where required by applicable law, we will provide additional notice of material changes.
23. Contact us
If you have questions about this Privacy Policy or how Reskript processes personal data, please contact:
Medical Pharma Services, s.r.o.
Evropská 846/176a, Prague 160 00
Czech Republic
Privacy contact: privacy@m-phar.com
For privacy-related requests, please include sufficient information for us to identify your account and understand your request.
24. Data Protection Authority
If you are located in the European Union or European Economic Area and believe that your data-protection rights have not been respected, you may lodge a complaint with the competent supervisory authority in your country.
For Medical Pharma Services, s.r.o., the relevant Czech supervisory authority is:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
Website: https://uoou.gov.cz/Email: posta@uoou.gov.cz
You may also have the right to contact the supervisory authority in the EU/EEA country where you live, work or believe an infringement occurred.
Reskript®
Owned and operated by Medical Pharma Services, s.r.o.
Evropská 846/176a, Prague 160 00Czech Republic
Company ID / IČO 27084949
VAT ID CZ27084949
privacy@m-phar.com
EU Trade Mark: Reskript® — EU Trade Mark No. 018762712
