Privacy Policy
Who we are
AE Connect is a product of QORO Intelligence Inc., a Delaware corporation operating from the San Francisco Bay Area. This draft covers the public site at aeconnect.io and the self-serve workspace at aeconnect.io/app/. The sign-in application at app.aeconnect.io is a separate service; this draft does not describe it. A street address is not published here and still needs to be confirmed.
Privacy questions: info@qfsnow.com.
What the product does with case text
The workspace is for pharmacovigilance case processing. Narratives you paste or extract from a file may include patient health information, reporter details, product details, and other information about an adverse event. Treat that text as sensitive even when it is not labeled as such.
Files are parsed in your browser. The file itself is not uploaded. The extracted text is sent to our API when you create a case or run an assessment. When an Anthropic API key is configured, that text is sent to Anthropic to produce a draft assessment. If the key is not set, the server returns a deterministic mock and does not call the model.
Information we collect
- Account data: name, email address, and a password hash (bcrypt). We do not store the password itself.
- Case data: title, source type, extracted source text, assessments, field decisions, sign-off metadata, and an audit log tied to the account.
- Billing data: plan, usage counts, and Stripe customer and subscription identifiers. Card numbers are entered on Stripe Checkout, not on our servers.
- A session token stored in the browser's local storage.
- Technical logs that our host (Netlify) and database host may collect, such as IP address and request metadata.
- Messages you send through the contact, newsletter, or checklist forms.
How we use it
We use this information to run the workspace, produce draft assessments, run the sandbox trial and annual subscriptions, keep an audit trail, secure the service, and answer requests you send us. We do not sell personal information. We do not use case narratives to train a public model of our own. Whether Anthropic retains prompts under its API terms has to be confirmed against the contract QORO actually signs.
Who else processes it
This list is based on how the site is built and needs confirmation:
- Netlify — hosting, serverless functions, and form submissions.
- Neon — hosted Postgres for accounts and cases, when production is configured that way.
- Anthropic — source text for the draft assessment, when the API key is set.
- Stripe — subscription checkout and payment status.
- Google Fonts — the browser requests font files; Google may see the requesting IP. Case text is not sent to Google.
- jsDelivr — if you run OCR, the browser downloads a pinned Tesseract language file and recognition engine. The document stays on your machine. The download itself is a request to that network.
Health-privacy laws
This draft does not say that AE Connect is a HIPAA-covered service, and it does not offer a business associate agreement. If you would put protected health information into the workspace, talk to us before you do. Customers who are controllers of pharmacovigilance data remain responsible for their own notices, lawful basis, and vendor reviews.
Retention
A retention schedule is not finalized. Case records may need to be kept for a long time under pharmacovigilance rules that apply to you, not automatically to us. Until counsel sets a schedule, assume we keep account and case data for the life of the account and for a limited period after a deletion request, except where we have to keep a record for security, billing, or legal reasons. There is no self-serve delete button yet. Email us to ask for access, correction, or deletion.
Security
The site is served over HTTPS. Passwords are hashed. Cases are scoped to the signed-in account. These are ordinary controls, not a certification. We do not claim SOC 2, ISO 27001, or Part 11 certification in this draft.
International transfers
We are a US company. Account data, case text, and model prompts may be processed in the United States by us and the providers above.
Children
The workspace is for professional drug-safety teams. It is not directed at children, and we do not knowingly create accounts for anyone under 18.
Your requests
Depending on where you live, you may have rights to access, correct, delete, or export personal information, or to appeal a refusal. Email info@qfsnow.com. We will need to know which account you mean. This paragraph is a placeholder for the rights counsel decides to honor and the timelines that apply. It is not a statement that a formal GDPR or CCPA program is in place.
Changes
When a reviewed policy replaces this draft, we will change the date and the draft banner. Continued use of the workspace after that date is a question for the final terms, not for this draft.