Contents
§ 01
Who We Are
LabelMonitor is a software platform for pharmaceutical regulatory affairs teams. The data controller for personal data collected via this website and the LabelMonitor platform is:
LabelMonitor
Email: privacy@labelmonitor.com
References to "we," "us," or "our" in this policy refer to LabelMonitor.
§ 02
Data We Collect
Early Access Requests
When you submit an early access request on our website, we collect:
| Field | Why We Collect It |
|---|---|
| First and last name | To address you personally and attribute your request |
| Work email address | To confirm your request and communicate with you |
| Company name | To understand your organisation's context |
| Job title | To understand your role and tailor onboarding |
| Portfolio size (optional) | To prioritise and plan capacity for early access |
| IP address | Spam and abuse prevention only; not used for profiling |
| Submission timestamp | Record-keeping and confirmation timing |
| Consent record | Evidence of your explicit consent as required by GDPR |
Platform Users
For users of the LabelMonitor platform (once in production), we additionally collect account credentials (email and hashed password), session tokens, and activity logs necessary to operate a 21 CFR Part 11-aligned audit trail. A separate platform privacy notice will be provided at onboarding.
Technical Data
Our web server and Cloudflare (our CDN and security provider) automatically log IP addresses, browser type, and request timestamps as part of normal server operation. This data is used solely for security monitoring and is not linked to your identity for marketing purposes.
§ 03
Lawful Basis (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following lawful bases:
- Consent (Article 6(1)(a)): For early access requests, you provide explicit consent via the checkbox on the submission form. You may withdraw consent at any time by contacting privacy@labelmonitor.com.
- Legitimate interests (Article 6(1)(f)): For security logging and abuse prevention, where our legitimate interest in protecting the service does not override your fundamental rights.
- Contract (Article 6(1)(b)): For platform users, processing necessary to deliver the service under your subscription agreement.
§ 04
How We Use Your Data
We use the information collected for the following purposes only:
- To confirm your early access request via email verification
- To contact you about your early access status and onboarding timeline
- To provide and improve the LabelMonitor platform
- To prevent fraud, spam, and abuse
- To comply with legal obligations
§ 05
Data Sharing
We share personal data only with the following categories of third-party service providers, and only to the extent necessary to operate the service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Resend | Transactional email delivery (confirmation emails) | Name, email address |
| Cloudflare | CDN, DDoS protection, DNS | IP address, request metadata |
| Hetzner Cloud / AWS | Infrastructure hosting | All data (encrypted at rest) |
All third-party processors are bound by data processing agreements. We do not authorise them to use your data for their own purposes.
We may disclose personal data if required to do so by law, court order, or to protect the rights, property, or safety of LabelMonitor, our users, or the public.
§ 06
Data Retention
We retain personal data only as long as necessary for the purpose it was collected:
- Early access requests: Retained for 2 years from submission, or until you request deletion, whichever is sooner.
- Unconfirmed requests (token expired): Deleted after 90 days.
- Platform audit logs: Retained for a minimum of 7 years in accordance with 21 CFR Part 11 and EU GMP Annex 11 requirements. These records are immutable by design.
- Server access logs: Retained for 30 days for security purposes.
When retention periods expire, data is permanently deleted or anonymised.
§ 07
Security
We implement technical and organisational measures appropriate to the risk of processing personal data, including:
- AES-256-GCM encryption of personal data at rest
- TLS 1.3 encryption for all data in transit
- Role-based access controls limiting staff access to personal data
- Immutable, chain-hashed audit logs of all data access and modification events
- Regular security review of infrastructure and application code
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, and affected individuals without undue delay where required by Article 34.
§ 08
Your Rights
GDPR Rights (EEA & UK)
If you are located in the EEA or UK, you have the following rights under GDPR:
- Right of access (Article 15): Request a copy of the personal data we hold about you.
- Right to rectification (Article 16): Request correction of inaccurate data.
- Right to erasure (Article 17): Request deletion of your personal data, subject to legal retention obligations.
- Right to restrict processing (Article 18): Request that we limit how we use your data.
- Right to data portability (Article 20): Receive your data in a structured, machine-readable format.
- Right to object (Article 21): Object to processing based on legitimate interests.
- Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
You also have the right to lodge a complaint with your local data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). In the EU, contact your national DPA.
CCPA Rights (California)
If you are a California resident, you have the right to know what personal information we collect, request deletion of your personal information, and opt out of the sale of personal information. We do not sell personal information.
How to Exercise Your Rights
To exercise any of the above rights, contact us at privacy@labelmonitor.com. We will respond within 30 days. We may need to verify your identity before processing your request.
§ 09
Cookies
Our marketing website (labelmonitor.com) does not currently use tracking cookies, analytics cookies, or advertising cookies. We do not use Google Analytics or any third-party tracking scripts.
Cloudflare may set a security cookie (__cf_bm) for bot detection purposes as part of its DDoS protection service. This is a strictly necessary cookie and does not require consent.
The LabelMonitor platform uses session cookies strictly necessary to maintain your authenticated session. These are not used for tracking.
§ 10
International Transfers
Personal data collected via this website and the LabelMonitor platform may be stored and processed in the United States or the European Union, depending on infrastructure configuration at the time of processing. Current infrastructure providers include Hetzner Cloud (EU) and Amazon Web Services (US).
If you are located in the EEA or UK, transfers of personal data to the United States are made under Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms. You may request details of the specific transfer mechanism applicable to your data by contacting privacy@labelmonitor.com.
§ 11
Children
LabelMonitor is a business-to-business platform intended solely for use by professionals in regulated industries. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately at privacy@labelmonitor.com.
§ 12
Policy Changes
We may update this Privacy Policy from time to time. Material changes will be communicated to affected individuals by email and/or a prominent notice on this page. The "Effective date" at the top of this page will be updated with each revision.
Continued use of our website or platform after changes take effect constitutes acceptance of the updated policy.
Questions or Requests?
For any privacy-related questions, data subject requests, or to exercise your rights under GDPR or CCPA, contact us at: