RRegscribe
Open the tool

Privacy Notice

Last updated: 2026-11-06

Regscribe ("Regscribe", "we", "us") helps pharma and biotech companies check documents for regulatory and audit readiness using AI. This notice explains what personal data we collect when you use Regscribe, why, and what your rights are under UK GDPR.

About this notice: Regscribe is currently operated as a working name, ahead of formal company incorporation (see "Who we are" below) — this notice is written to be accurate and publishable now, on that basis, rather than waiting for the incorporation decision.

Who we are

For the purposes of UK GDPR, the controller of the personal data described in this notice is Regscribe, currently operated as a trading/working name by its founder ahead of formal incorporation. Once Regscribe is formally incorporated, this section will be updated to name the incorporated entity, its registered address, and jurisdiction.

Contact: info@regscribe.ai

What data we collect, and why

Regscribe collects six distinct kinds of personal data, described separately below because they're handled very differently.

1. Your sign-in details

When you sign in to use Regscribe's document-checking tool, we receive your name and email address from Microsoft Entra ID (your organisation's Microsoft sign-in), so we can identify you and grant you access to the tool.

Regscribe currently operates as an invite-only allowlist: your email address is stored in our database as part of a list of accounts authorised to sign in at all — this is what lets us restrict a still-early-stage tool to a small number of known users, and it's how access is granted or removed (by an administrator, via an internal admin tool — not self-service yet).

  • Why: to authenticate you, control access to the service, and maintain the record of who is currently authorised to use it.
  • Lawful basis: legitimate interests — operating the service securely and restricting it to authorised users. If you use Regscribe under a paid or beta agreement with your employer, this may also be processed on the basis of that contract.
  • How long we keep it: your email address stays on the allowlist until an administrator removes it (e.g. when access is no longer needed). This is a genuine, persistent record — not session-only — reflecting Regscribe's current invite-only stage.

2. Documents you upload for analysis

When you upload a document (e.g. an SOP, CAPA, deviation report, or similar) to be checked, Regscribe:

  1. for larger files (roughly above 4MB), briefly relays the file through Vercel Blob storage — a direct browser-to-storage transfer needed to get around a hosting-platform request-size limit — before reading it; smaller files skip this step entirely;
  2. reads the document to extract its text and, where needed, images of its pages, deleting it from that temporary storage in the same step;
  3. sends that content to Anthropic's Claude API (a third-party AI processor — see "Who we share your data with" below) to generate the analysis you requested;
  4. returns the results to you; and
  5. discards the document content immediately afterward.

Check Documents specifically (added 2026-08-22): a large or complex document's analysis is split into several shorter processing steps rather than one, so it can complete reliably regardless of size. Between those steps, the document's extracted text and rendered page images are held in a temporary, access-controlled database record scoped to your account — not the original file itself, which is deleted as soon as it's read, per point 2 above — for the duration of processing, typically under a couple of minutes, then deleted once processing finishes or fails. This is a genuine, if brief, difference from the single-step "read then immediately discard" flow used elsewhere in Regscribe (e.g. SOP Overlap), disclosed here rather than glossed over.

The document itself, and its full analyzed content, are not stored on our servers after processing — closing the tab or refreshing the page loses the actual document and results unless you use the in-app "Print / Save as PDF"/"Download PDF"/"Download Word" features to keep your own copy. See "Your audit trail" below, however, for a smaller, separate record we do keep about the fact that an analysis happened.

A note on personal data inside your documents: the documents you upload may themselves contain personal data belonging to other people at your organisation — for example, the names of signatories, approvers, or QA reviewers in a signature block. If you upload such a document, that personal data is processed by Regscribe and Anthropic in exactly the same transient way described above (analyzed, then discarded), for the sole purpose of producing your requested analysis. You are responsible for having a lawful basis to upload documents containing your colleagues' personal data as part of your organisation's normal use of the service.

Patient health information is out of scope. Regscribe is built and intended for manufacturing-quality documents — SOPs, batch records, CAPAs, deviations, change controls, training records, and similar — which describe an organisation's own processes and personnel, not patients. Regscribe is not designed for, and does not knowingly accept, documents containing patient-identifiable health information (for example, an ICSR case narrative naming or otherwise identifying a specific patient — see the usage note in our GVP rubric documentation). If your document contains this kind of content, please redact patient identifiers before upload or contact us first at the address below.

  • Why: to generate the regulatory-readiness analysis you specifically requested.
  • Lawful basis: legitimate interests (providing the service you asked for) or contract, depending on your organisation's agreement with us.
  • How long we keep it: we don't keep the document or its content. Processing is transient, measured in seconds to a few minutes per document, and the content itself is not retained afterward.

3. Your audit trail

Every time you successfully run an analysis, and separately whenever you confirm you've reviewed an AI-generated report (the "I have reviewed this AI-generated output" checkbox on /check), Regscribe records a small, structured entry in our database: the date/time, your email address, the action taken, the document's file name, which regulation you checked it against, the resulting readiness verdict, and counts of blocking/warning issues found — cryptographically linked to the entry before it so the record is tamper-evident. This does not include the document's content or the detailed findings — only this summary-level metadata. You (and, separately, Regscribe's administrators) can view this record at any time at /audit.

  • Why: this is a real regulatory-readiness tool used in a GxP-adjacent context — an auditable record of who checked what, when, and with what result is itself a genuine compliance feature (the kind of record Annex 11/Part 11 expect a computerised system to keep), not incidental data collection.
  • Lawful basis: legitimate interests — maintaining an accurate, tamper-evident record of service usage for accountability and audit purposes.
  • How long we keep it: indefinitely, until Regscribe defines a retention/deletion policy (not yet done — an open item). An administrator can delete individual entries (e.g. to remove test/development runs), but this isn't currently available to end users acting on their own record.

4. Your AI Governance vendor assessments

If you use Regscribe's separate AI Governance tool (reachable from inside /check as the "AI Governance" tab, at /governance/vendor-assessments) to assess a third-party AI vendor or tool against a regulatory rubric, Regscribe stores the assessment record in our database: the tool/vendor name, functional area, deployment context and description you provide, your email address as the person who requested the assessment, and the resulting AI-generated risk tier, score, and findings.

  • Why: to keep a durable record of vendor assessments your organisation has run, so they can be reviewed and referred back to later rather than lost when the session ends.
  • Lawful basis: legitimate interests — providing and maintaining the record for this feature of the service you've chosen to use.
  • How long we keep it: indefinitely. Unlike the audit trail above, there is currently no way — for an administrator or an end user — to delete an individual vendor assessment record; this is an open item, not a deliberate policy.

5. Rubric-update proposals reviewed by administrators (admin-only)

Regscribe runs an internal, automated process that periodically checks whether the regulatory frameworks it tests documents against ("rubrics") need updating, and proposes changes for an administrator to review. When an administrator (currently only Khando or Iain) approves or rejects one of these proposals in the internal admin tool, Regscribe records which administrator made that decision and when alongside the proposal itself (the rubric affected, a source link, a summary, and the proposed change). This does not involve or identify any end user of the document-checking or AI Governance tools — it's purely an internal record of an administrator's own review decision.

  • Why: to keep an accurate record of who approved a change to the regulatory content the service relies on, and when.
  • Lawful basis: legitimate interests — internal accountability for changes to the service's regulatory content.
  • How long we keep it: indefinitely, until Regscribe defines a retention/deletion policy (not yet done — the same open item noted under "Your audit trail" above).

6. Your New System case documents

If you use Regscribe's New System tool (reachable from inside /check as the "New system" tab, at /systems) to draft a validation document set for a system you're standing up (DPIA, URS, Functional Spec, Risk Assessment, VMP, IQ/OQ/PQ, Traceability Matrix, VSR), Regscribe stores the case record — its name, description, your email address as the case creator, your triage answers, and every version of every draft document you save as you work through it. Versions are kept, not overwritten, so you can see a document's draft history; nothing is deleted when a step becomes no longer applicable after you change a triage answer, either. These documents are built entirely from your own typed answers — this tool does not call Anthropic's API, so nothing you enter here is sent to a third-party AI processor.

  • Why: to let you build and keep a working draft of your system's validation documentation over time, across multiple sessions, rather than losing it when you close the tab.
  • Lawful basis: legitimate interests — providing and maintaining this feature of the service you've chosen to use.
  • How long we keep it: indefinitely. There is currently no way — for an administrator or an end user — to delete a case or its document history; this is an open item, not a deliberate policy, the same gap already disclosed above for AI Governance vendor assessments.

Who we share your data with

  • Vercel hosts Regscribe, including Vercel Blob (a private, token-gated storage service used only as a brief relay for larger document uploads, never a place your document is kept) and Vercel Postgres (built on Neon, hosted in the UK — the database backing the allowlist, audit trail, AI Governance vendor assessments, New System case documents, and rubric-update review records described above). Vercel's infrastructure carries traffic to and from the service (see our Security Policy for what Vercel holds in terms of security certification) but does not otherwise process document content beyond the brief relay described above.
  • Microsoft (Entra ID / your organisation's own Microsoft tenant) handles your sign-in. Regscribe doesn't manage or store your password — authentication happens entirely within Microsoft's systems, and your organisation's own IT administrators control your account there, not us.
  • Anthropic, PBC processes the content of documents you upload, as described above, in order to run the AI analysis. Anthropic acts as our data processor for this purpose. Anthropic's processing may take place outside the UK and European Economic Area (including in the United States); where that happens, an appropriate legal safeguard (such as the UK International Data Transfer Addendum) applies to that transfer. [Regscribe is in the process of directly confirming Anthropic's exact current sub-processor list and transfer mechanism — this section will be updated with specifics once confirmed.]
  • We do not sell your data, use it for advertising, or share it with anyone else.

Cookies

Regscribe uses only the cookies strictly necessary to keep you signed in and to protect the sign-in process itself (session and CSRF-protection cookies, set by our authentication provider). We don't use analytics, tracking, or advertising cookies of any kind. Because these cookies are strictly necessary for a service you've actively chosen to use, we don't need to show you a cookie consent banner for them — but we're telling you about them here for transparency.

Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Correct it if it's inaccurate
  • Erase it (for document content, there's usually nothing left to erase by the time you ask — see above; for allowlist entries and audit-trail entries, an administrator can action this; for AI Governance vendor-assessment records and New System case documents, no deletion path exists yet — see above — so a request would need to be handled manually in the meantime)
  • Restrict or object to certain processing
  • Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you're unhappy with how we've handled your data

To exercise any of these rights, contact us at the address above.

Children

Regscribe is a professional tool for people working in the pharmaceutical/biotech industry. It isn't directed at, and we don't knowingly collect data from, children.

Changes to this notice

We'll update this notice if what we do with your data changes — most significantly, if Regscribe stores anything beyond the six kinds of data described above (for example, adding persistence for the analysis content/report history itself), since that would materially change several of the answers above.

This notice was drafted 2026-07-30, last cross-checked against the actual codebase 2026-08-18, and updated again 2026-11-06 to add the New System tool (shipped 2026-09-17, a real gap this notice hadn't caught until a parallel review session flagged it) — document content and full analysis results themselves are still never persisted. Published as final on the strength of that factual accuracy, the same standard most small SaaS companies publish a privacy notice against — not gated on a solicitor's individual review.