Legal

Privacy Policy

How ORRA Synergy collects, uses, and protects your personal information.

← Back to Applicant Home

Last updated: June 22, 2026

ORRA Synergy ("we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

1. Information We Collect

Information You Provide

  • Account Information: Name, email address, phone number, password (hashed and stored securely).
  • Talent Profile Information: Professional background, therapeutic areas, trial phase experience, years of experience, certifications, CV/resume, certificates, training evidence, LinkedIn URL, availability, location, and related talent-pool assessment information.
  • Contact Form: Name, email, phone, organisation, and message content.
  • Payment Information: Payment details are processed by Stripe or another approved payment processor. We do not store credit card numbers or banking details.

Information Collected Automatically

  • Browser type and version
  • Pages visited and time spent
  • Referring website
  • Device information (operating system, screen size)

2. How We Use Your Information

  • To provide and maintain our platform and services
  • To process training programme registrations and payments
  • To review, assess, and administer clinical research talent-pool applications
  • To facilitate talent matching between clinical research professionals and CRO/client organisations, subject to ORRA review and visibility controls
  • To record PDPA consent, Talent Applicant Terms acceptance, and candidate data-sharing acknowledgements
  • To respond to your enquiries and support requests
  • To send administrative communications (registration confirmations, payment receipts)
  • To improve our website and services
  • To comply with legal obligations

3. Information Sharing

We do not sell your personal information. We may share information only in the following circumstances:

  • CRO/Client Organisations: Approved CRO-visible talent profile information and selected supporting evidence may be shared with relevant CRO/client organisations for legitimate clinical research talent evaluation. Applicant profiles and documents are not shared until reviewed and approved by ORRA Synergy, and internal-only/hidden documents remain restricted.
  • Payment Processors: Stripe or another approved payment processor receives necessary payment information to process transactions.
  • Legal Requirements: If required by law or to protect our rights.

4. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

  • Password hashing using bcrypt
  • JWT-based authentication with token expiry
  • HTTPS encryption
  • Access controls and role-based permissions
  • Private document storage for CVs/certificates with authenticated download controls
  • Internal-only/CRO-visible/hidden document visibility controls

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services, administer talent-pool review records, comply with legal obligations, resolve disputes, and maintain legitimate business records. Inactive, rejected, withdrawn, or archived talent applications may be retained for a reasonable period for audit, compliance, and future suitability review unless deletion is requested and no lawful retention basis applies. You may request correction, withdrawal, or deletion by contacting us.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Withdraw consent where processing is based on consent
  • Ask ORRA to withdraw your profile from active talent-pool consideration, subject to lawful retention requirements

7. Cookies

We use essential cookies for authentication (JWT tokens stored in localStorage). We do not use tracking cookies or third-party analytics. The __session data is strictly for maintaining your login state.

8. Third-Party Services

  • Stripe / Approved Payment Processor: Payment processing — see the applicable processor privacy policy during checkout.
  • Google Workspace: Email communication

9. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect information from minors.

10. Cross-Border and Client Sharing

Clinical research opportunities may involve CRO/client organisations, sponsors, or project teams located outside your country of residence. Where candidate information is shared for approved talent matching, ORRA Synergy will take reasonable steps to limit disclosure to relevant, CRO-visible information and to protect confidentiality.

11. Talent Applicant Consent

Before submitting a talent application, applicants must provide PDPA consent and acknowledge the Talent Applicant Terms, no-placement-guarantee notice, and controlled candidate data-sharing notice. Consent records may include timestamp and consent version for audit purposes.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

13. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at enquiry@orrasynergy.com.