Privacy policy
Effective from 10 November 2026
This policy explains how TrialDocs International Pty Ltd (ABN 61 645 101 417) (“TrialDocs”, “we”, “us”) collects, uses, stores and shares personal information in Showcase CTMS and on this website, showcasectms.com. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
Who this policy covers
- People who use Showcase CTMS: research site staff, and the monitors, sponsors and contract research organisations (CROs) a site invites.
- Visitors to showcasectms.com.
- People who contact us.
The documents and records a research site keeps in Showcase CTMS are that site’s. We store and process them on the site’s behalf, under our agreement with the site, and use them only to provide Showcase CTMS to it. Questions about the personal information in them are best directed to the site first.
What we collect
- Your account. Your name and email address, the portals and roles your site gives you, your training certification date, and your settings. If you sign in with a password, we keep a one-way hash of it and the key for your authenticator app, never the password itself.
- Sign-in and security records. For each sign-in: your IP address, browser, approximate location (city and country, from the IP address), how you signed in and whether multi-factor authentication was used.
- The audit trail. A record of what each person does in Showcase CTMS, with the time and IP address. An electronic signature also records the signer’s name, email address and time zone. The audit trail is part of a clinical trial’s regulated record, so it cannot be changed or deleted.
- Signature images. Images of your handwritten signature or initials, if you add them to sign documents.
- Content sites store. Documents, study records, Showcase Pay records and Showcase Metrics data. These may contain personal information about trial staff and participants, including health information. Showcase Pay records each trial participant by an identifier code, not by name or date of birth.
- Support. The messages, emails and attachments you send us, and our replies.
- Payments. When a portal pays a fee by card, Stripe collects the card details on its own payment page. We receive the payer’s email address and whether the payment succeeded, never the card number.
- This website. No forms, no cookies and no analytics. Our servers log each request (IP address, browser, the page and the page you came from) to keep the site secure.
Signing in with Google or Microsoft
If your organisation uses Google or Microsoft accounts, you can sign in to Showcase CTMS with yours. Showcase CTMS asks Google or Microsoft only to confirm who you are. From that sign-in it keeps:
- your account’s identifier at Google or Microsoft (for Microsoft, also your organisation’s identifier), and
- the email address of the account you signed in with.
It uses them only to sign you in to an account your site has already set up for you; signing in with Google or Microsoft never creates an account. Showcase CTMS does not keep your name or picture from Google or Microsoft, does not read your email, files, contacts or calendar, does not keep any token that would let it act for you, and does not share this information with anyone. Our use of information received from Google follows the Google API Services User Data Policy.
How we use personal information
- To provide Showcase CTMS: to sign you in, show you what your roles allow, and send the emails Showcase CTMS sends, such as notifications and sign-in links.
- To keep Showcase CTMS secure: to detect and stop unauthorised access, investigate faults and keep the audit trail.
- To support you: to answer your questions and help desk requests.
- To bill for Showcase CTMS: invoices and card payments.
- To tell you about Showcase CTMS: newsletters, which you can stop with the unsubscribe link in each one.
- To meet our legal obligations.
Showcase CTMS measures page load times and errors in your browser so we can find faults. These measurements are not linked to you.
We do not sell personal information, and we do not share it with anyone for their own marketing.
Who we share it with
- People in your portal. Other users in your site’s portal see your name, and your signature on what you sign. Your site’s administrators can see and manage your account and the records you create.
- Our service providers, who run parts of Showcase CTMS for us and may use the information only to do so:
| Provider | What it does for us | Where |
|---|---|---|
| Amazon Web Services | Hosting, storage, backups, sending email | Australia (Sydney; backups in Melbourne) |
| Our company email, and Google sign-in | Google’s data centres, which may be outside Australia | |
| Microsoft | Microsoft sign-in, if you use it | Microsoft’s data centres, which may be outside Australia |
| Stripe | Card payments | Stripe’s data centres, which may be outside Australia |
- When the law requires it. We may disclose personal information to comply with a law, regulation, court order or request from a government authority; to enforce our agreements; to protect the security of Showcase CTMS; or to protect people from harm.
- If our business changes hands. In a merger, sale or financing of all or part of our business, personal information may pass to the new owner under this policy.
Where it is stored
Showcase CTMS stores its data in Australia: in Amazon Web Services’ Sydney region, with backups in its Melbourne region. Your connection reaches Amazon’s network at the location nearest you, encrypted, before it reaches Sydney. The providers listed above as outside Australia may handle the information they receive, such as an email you send us, in other countries, including the United States.
How we protect it
- Every connection is encrypted (TLS 1.2 or later), and stored data is encrypted with keys we control.
- Password sign-in also needs an authenticator app. Google and Microsoft sign-in follow your organisation’s own multi-factor authentication.
- Passwords are stored only as one-way hashes. A new password is checked against passwords exposed in known breaches without the password leaving Showcase CTMS.
- Each organisation’s data is kept apart in the database.
- Uploaded files are scanned for viruses.
- Our staff’s access to the systems that run Showcase CTMS needs multi-factor authentication.
No system is completely secure. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.
How long we keep it
| Information | Kept for |
|---|---|
| Your account | While you have access. When a site removes you, Showcase CTMS keeps your name and email address so the trial’s records still show who did what |
| The audit trail | Permanently. It is never changed |
| Sign-in records | 90 days |
| Website and network logs | 1 year |
| Emails we receive | 30 days in their original form; help desk requests are kept |
| Content sites store | As the site’s agreement with us sets out |
| Backups | Up to 12 months |
Cookies
This website sets no cookies. Showcase CTMS sets only the cookies it needs to work: your sign-in session, the sign-in, password reset and account recovery steps, which region your account is in (kept 400 days), and whether the sidebar is open (kept 7 days). It has no advertising or tracking cookies.
Your choices and rights
- See and correct your information. You can see and change your profile in Showcase CTMS. To ask for a copy of other personal information we hold about you, or to have it corrected, contact us. For content a site stores, we will pass your request to that site.
- Records that cannot be erased. The audit trail and signed records are part of a clinical trial’s regulated record, so they cannot be erased, even at your request.
- Newsletters. Use the unsubscribe link in any newsletter.
- Complaints. If you think we have mishandled your personal information, contact us. We will respond within 30 days. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au.
Contact us
For anything about your personal information or this policy, email TrialDocs International Pty Ltd at support@trialdocs.com.au.
Changes to this policy
When we change this policy, we will publish the new version here with its effective date. If a change is significant, we will also tell Showcase CTMS users in the app or by email.