Privacy policy

K.A. Clinical Pharma Consulting Corp., trading as KA Clinical

Effective September 7, 2026 Last updated: September 7, 2026

1. Who we are

K.A. Clinical Pharma Consulting Corp., trading as KA Clinical ("KA Clinical", "we", "us"), is a company incorporated in Alberta, Canada, with its registered office in Edmonton, Alberta. We operate the website at kaclinical.com, where we sell downloadable clinical operations toolkits and templates, publish free resources, and sell branded merchandise.

We are the controller of the personal information described in this policy. That means we decide why and how it is used, and we are accountable for it.

Privacy Officer: Christine Dobek

Email: privacy@kaclinical.com

Post: 2715 117 Street NW, Edmonton, AB T6J 3P4, Canada

Our representatives in the European Union and the United Kingdom

We are not established in the EEA or the UK. We have appointed representatives you can contact instead of us on anything to do with your personal information. You are welcome to contact us directly as well.

European Union representative: Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Address any letter to “DataRep” — post addressed to KA Clinical at that address will not reach them. DataRep holds a contact address in every EU and EEA country; if you would rather write to one in your own country, ask us and we will give it to you.

United Kingdom representative: Data Protection Representative Limited (trading as DataRep), 107–111 Fleet Street, London, EC4A 2AB, United Kingdom. Address any letter to “DataRep”.

2. What this policy covers

This policy applies to personal information we collect when you:

(a) visit kaclinical.com or read our articles;

(b) download a free resource. These are supplied as $0 orders through checkout, so a free download creates an order record in the same way a paid one does;

(c) buy a toolkit or a licence;

(d) buy merchandise;

(e) register a business account so you can buy from the European Union or the United Kingdom;

(f) begin a checkout that we are not able to complete;

(g) subscribe to our email list;

(h) send us a message through a form on the site;

(i) apply to join our associate network; or

(j) engage us for consulting work.

It does not cover other companies' websites we link to, or personal information you may encounter inside a clinical trial you run using our templates. When you fill in one of our templates with your own study's data, that data stays with you. It never reaches us.

3. What we collect

3.1 Information you give us

When	What we collect
Free download or paid order	Name, email address, billing details, order contents, licence tier.
Merchandise order	Name, email address, shipping address, phone number, order contents. Our print partner requires a recipient phone number so the delivery carrier can contact you about your parcel.
Payment	Card or wallet details are entered directly into our payment provider's systems. We never see or store your full card number. We receive a confirmation, the last four digits, and the card type.
EU or UK business registration	Your name, work email address, company name, company address and VAT registration number, and a purchase order number if you use one. We check the VAT number against the EU VIES service or the UK government's VAT checker, and we compare the registered name and address those services return against what you told us.
A checkout we cannot complete	If you reach checkout but we are not able to sell to you, our store platform will already have recorded the email address and billing details you entered. See clause 8 for how long that is kept.
Email subscription	Email address, the source of the subscription, the date and time you consented, and any region or interest options you selected.
Contact form	First name, email address, the topic you selected, and whatever you write in the message field.
Associate enquiry	Name, email address, professional background and anything else you choose to send us.
Consulting engagement	Business contact details and the information needed to do the work.

 

3.2 Information we collect automatically

When you use the site, we and our service providers collect technical information including your IP address, device and browser type, referring page, pages viewed, and how you move through the site. This is used to keep the store working, protect it from fraud, and understand which content is useful.

We use our store platform's own built-in analytics.

Our print partner's app also runs a pixel on the store. Our store platform discloses that this app can access your name, email address, phone number and address, and also your approximate location, IP address, browser and operating system, your browsing behaviour on our site, and a client identifier cookie. In the regions where our cookie banner appears, that pixel runs only if you have given the consent it requires.

We do not run advertising or analytics trackers of our own. There is no Google Analytics on this site and no Meta pixel. If we add further analytics, advertising or embedded third-party technologies in future, including YouTube embeds or Google advertising tools, we will update this policy and our cookie settings before those trackers go live.

3.3 Sensitive information

We do not ask for, and do not want, special categories of data: health information, biometric data, government identifiers, or information about your race, religion, politics, sex life or trade union membership. Please do not put any of it in a contact form. If you do, we will delete it.

3.4 Do you have to give it to us?

Mostly it is your choice, but not always, and the consequence differs:

(a) Your name, email address and billing details are needed to enter into and perform our contract with you. Without them we cannot take an order or deliver a file, including a free one.

(b) A recipient phone number is required by our print partner for merchandise orders. Without it we cannot ship.

(c) A company name, address and VAT number are needed to approve an EU or UK business account, because we are required to hold evidence supporting the VAT treatment of the sale. Without them we cannot approve the account.

(d) We keep certain order and tax records because the law requires us to, whether or not you would prefer us to delete them. See clause 8.

(e) Everything else - a contact message, an associate enquiry, a marketing subscription - is entirely voluntary. If you do not give it to us, nothing happens except that we cannot reply or send you what you asked for.

4. Why we use it, and our legal basis

The right-hand column applies if you are in the European Economic Area or the United Kingdom, where the law requires us to identify a legal basis for each use. It is set out for everyone because it is a fair description of what we are doing and why.

Purpose	What it involves	Our legal basis
Fulfilling your order	Taking payment, delivering download links, granting re-access, shipping merchandise	Performance of our contract with you
Customer support	Answering your questions, replacing defective files	Performance of our contract with you
Licence administration	Recording which licence tier you hold, and enforcing its terms	Performance of our contract with you, and our legitimate interest in protecting the work we license
Approving an EU or UK business account	Checking your VAT number against the VIES or HMRC register before you can buy, and keeping a record that we did	Steps taken at your request before entering a contract, and compliance with our legal obligations on VAT
Marketing email	Sending you our newsletter, new resources and product announcements	Your consent, which you can withdraw at any time
Answering an enquiry	Responding to a form submission or an email	Our legitimate interest in replying to people who contact us, or steps taken before entering a contract
Site security and fraud prevention	Detecting fraudulent orders, blocking abuse	Our legitimate interest in protecting the store, our customers and ourselves from fraud and abuse
Improving the site and our products	Understanding which pages and resources are used	Your consent, where we set analytics cookies in a region that requires consent. Otherwise our legitimate interest in understanding what is useful and improving what we sell
Legal and tax records	Keeping the records the law requires us to keep	Compliance with a legal obligation

 

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and freedoms, and we have concluded it is not. You can object at any time and we will look at it again. See clause 9.

5. Marketing email, and how we treat consent

We send commercial email only to people who have asked for it.

(a) The marketing consent checkbox on our forms is unticked by default, everywhere in the world. Ticking it is an act you take. We do not treat a contact enquiry, a download, a business registration, or a purchase as consent to market to you.

(b) We record the date, time and source of each consent, because Canada's Anti-Spam Legislation puts the burden of proving consent on the sender, and because EU and UK law requires us to be able to demonstrate consent.

(c) Every commercial email contains a working unsubscribe link and our mailing address. We action unsubscribes promptly, and in any event within 10 business days.

(d) Unsubscribing from marketing does not stop transactional messages such as order confirmations, download links, business account approvals, and replies to something you asked us.

Some of our forms offer a separate "tell me when you ship to my region" option. Selecting that option is not marketing consent. It signs you up for one email, on the day that region opens, and nothing else.

6. Who we share it with

We do not sell your personal information for money. We share it with the service providers we need to run the business, each of whom is bound to use it only on our instructions.

Provider	What they do	Where they process
Shopify Inc.	Our store platform, checkout, hosting, customer and order records, store analytics, the forms on our site, and the storage and delivery of the digital files you buy or download	A Canadian company. Our store's data is hosted in the United States; Shopify also processes in Canada and other locations
Shopify Payments and payment processors	Take payment and screen for fraud	United States and other locations
Printful, Inc.	Prints and ships merchandise. Receives your name, shipping address and phone number for orders containing merchandise. Its app also runs a pixel on our store, which reaches visitors whether or not they order anything — see clause 3.2	United States, European Union and other locations depending on the fulfilment site
Microsoft Corporation	Our email and document systems, where enquiries and correspondence land	Canada and United States
European Commission VIES service and HM Revenue & Customs	Public VAT number registers. We submit a VAT number to confirm it is valid and to see the registered name and address. We do not send them your personal details	European Union, United Kingdom

 

We may also disclose personal information where we are legally required to, where it is necessary to protect our rights or someone's safety, or to a buyer in connection with a sale or reorganization of the business, in which case this policy continues to apply.

A note about submitting a form. Our forms tool creates a customer record in our store when you submit a form. That is how the platform works and we cannot switch it off. A customer record is not a marketing subscription. See clause 5.

A note about our store platform. Our store runs on Shopify, and a Shopify feature called Network Intelligence is switched on. That means Shopify uses information about how you interact with our store together with information from other merchants' stores to generate insights that power features across its network, including advertising and personalization for our store. It also means Shopify processes your information when you visit and buy from us, including on the basis of your interactions with other merchants. No other merchant can see your data.

For that processing Shopify acts on its own account and not only on our instructions, so Shopify's own privacy policy applies to it alongside ours. You can read it at Shopify's Consumer Privacy Policy. Shopify also runs a privacy portal at privacy.shopify.com, where you can opt out of browser tracking, limit the use of your information for advertising, and ask Shopify for a copy of, or the deletion of, what it holds about you. Those choices are Shopify's to honour, and they are separate from the choices you make with us.

We do not run advertising trackers of our own, and we do not sell your information to anyone for money.

What this means for you depends on where you are. If you are in the EEA, the UK or Switzerland, we ask for your consent before your information is used for advertising based on your activity across our store, other merchants and Shopify. The cookie banner is how we ask. You can withdraw that consent at any time from the Cookie settings link in our footer, or through Shopify's privacy portal above. If you are in the United States, some state privacy laws treat processing of this kind as a "sale" or a "share" for targeted advertising, whether or not money changes hands; you can opt out at any time using the data-sharing opt-out link in our footer.

7. Where your information goes

We are based in Canada, and our service providers operate in Canada, the United States, the European Union and elsewhere.

Our store's data is hosted in the United States. That includes your customer record and your order history. So although we are a Canadian company and our store platform is a Canadian company, the information itself sits on servers in the United States. While it is in another country it is subject to that country's laws, and may be accessible to that country's courts, law enforcement and national security authorities.

If you are in the EEA, the UK or Switzerland

When you give us your personal information yourself, by placing an order, downloading a resource, subscribing, or writing to us, you are giving it directly to us in Canada. Nobody exports it on your behalf, so this is not an international transfer in the sense the law uses that word. It is worth knowing all the same that the European Commission has decided Canada provides an adequate level of protection for personal information held by organisations subject to our federal privacy law, PIPEDA. We are such an organisation, and the United Kingdom recognises Canada on the same basis.

What the law does treat as a transfer is what happens next, when we pass your information to the service providers in clause 6. The safeguards are not the same for each of them, so here they are separately.

Provider	The safeguard it relies on
Shopify Inc.	Shopify Inc. is a Canadian company, but as above, our store's data is hosted in the United States. For personal information leaving the EEA or Switzerland, Shopify relies on its binding corporate rules; for the United Kingdom, on standard contractual clauses together with the UK International Data Transfer Addendum; and it also relies on the European Commission's adequacy decision for Canada.
Microsoft Corporation	Certification under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, together with standard contractual clauses and the UK International Data Transfer Addendum.
Printful, Inc.	Printful, Inc. is a company in the United States; its representative in the European Union is AS "Printful Latvia", in Riga. It relies on standard contractual clauses approved by the European Commission. We do not ship merchandise to the EEA or the UK, so no order of yours and no delivery address of yours reaches Printful. What does reach it is the pixel described in clause 3.2, and only where you have consented to it.

 

These are the mechanisms our providers publish in their own data processing agreements, and those agreements can change. You can ask us which one applies to a particular provider, and for a copy of the relevant clauses, at privacy@kaclinical.com.

If you are in Australia

We take reasonable steps to ensure overseas recipients handle your personal information consistently with the Australian Privacy Principles.

8. How long we keep it

Record	Kept for
Order and transaction records, including $0 orders	7 years from the end of the tax year, to meet Canadian record-keeping requirements.
Customer account and licence records	While your licence is live, then 7 years alongside the order record.
EU and UK business account records, including the VAT number and the date we checked it	7 years from the end of the tax year, because they are the evidence supporting how we treated VAT on your orders.
A checkout that was never completed	12 months, then deleted.
Marketing subscription and consent records	Until you unsubscribe, then 3 years. We need to be able to evidence the consent we relied on.
Contact and enquiry messages	2 years from our last exchange, unless it becomes part of a client file.
Associate applications	2 years, so we can come back to you if work fits.
Consulting client files	For the life of the engagement plus the period required by our professional and contractual obligations.
Website and security logs	Typically 12 months.

 

When a retention period ends we delete the information or irreversibly anonymize it. Where deletion is not technically possible straight away, for instance in a backup, we isolate it until deletion is possible.

9. Your rights

Whoever and wherever you are, you can ask us to see, correct, or delete what we hold about you, and you can withdraw consent to marketing at any time. Email privacy@kaclinical.com. We will respond within 30 days, or tell you why we need longer. We do not charge for this, and we will never treat you differently for asking.

We may need to confirm your identity before acting, usually by replying from the email address on the account.

If you are in the EEA or the UK

You have the following rights over your personal information. They are not absolute, and where we cannot act on one we will tell you why.

(a) Access - to be told whether we hold personal information about you, and to receive a copy of it.

(b) Rectification - to have inaccurate information corrected, and incomplete information completed.

(c) Erasure - to have your information deleted, where we no longer need it, where you withdraw the consent we relied on, or where you object and we have no overriding grounds. This does not extend to records we are legally required to keep.

(d) Restriction - to have us pause our use of your information while a dispute about its accuracy or our grounds for using it is resolved.

(e) Portability - to receive the information you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where that is technically feasible.

(f) Objection - to object to processing we base on our legitimate interests. If you object to direct marketing we will stop, without exception and without asking why.

(g) Withdrawal of consent - to withdraw consent at any time, where consent is what we relied on. Withdrawing it does not make our earlier use of the information unlawful.

(h) Complaint - to complain to a data protection authority. See clause 14.

We will respond to a request under this clause within one month. If your request is complex or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do.

You can exercise any of these rights through our representative for your region, listed in clause 1, instead of contacting us directly.

If you are in Canada

Under PIPEDA and the equivalent provincial laws in Alberta, British Columbia and Quebec, you have the right to access your personal information, to challenge its accuracy, to withdraw consent, and to complain to us and to a regulator. If you are in Quebec you also have rights of portability and de-indexing, and the right to be told the reasons behind a decision made about you using only automated processing.

If you are in the United States

Depending on your state, you may have the right to know what we collect, to access a copy, to correct it, to delete it, and to opt out of sales, sharing for targeted advertising, and profiling. We do not sell your personal information for money, but our store platform's use of your data, described in clause 6, may count as a "sale" or a "share" under your state's law. You can opt out at any time using the data-sharing opt-out link in our footer. You may designate an authorized agent to act for you, and you may appeal a refusal by replying to our decision.

If you are in Australia

You may request access to and correction of your personal information under Australian Privacy Principles 12 and 13. If we refuse, we will explain why in writing and tell you how to complain.

10. Cookies and similar technologies

Cookies are small files a website stores on your device. We use them in two ways.

Strictly necessary cookies run the store: keeping you logged in, remembering your cart, and protecting checkout from fraud. These cannot be switched off without breaking the site, and no law requires us to ask your permission for them.

Cookies that are not strictly necessary fall into two groups.

Analytics. Our store platform's own first-party cookies tell us which pages and resources people use.

Advertising and personalization. Our store platform also uses its own cookies to support advertising and personalization for our store, as described in clause 6. This is why the consent banner mentions advertising.

To be clear about what we do not do: we run no advertising or analytics trackers of our own. There is no Google Analytics on this site, no Meta pixel, and no third-party cross-site tracking that we have installed. If that changes we will update this policy and our cookie settings before those trackers go live.

Below is every cookie set when you visit this store, what each one does, who sets it and how long it lasts. Every cookie on this list is set by Shopify Inc., the platform our store runs on. KA Clinical sets no cookies of its own.

Strictly necessary

These make the store work. Without them you cannot hold a cart or complete a purchase, so they are set whether or not you accept anything else.

Cookie	What it does	Who sets it	How long it lasts
_shopify_essential	Holds the information the store needs to work: your session, your checkout, and anti-tampering data.	Shopify	1 year
_shopify_test	Checks whether your browser accepts cookies at all.	Shopify	1 minute
_tracking_consent	Remembers the choice you made in the cookie banner.	Shopify	1 year
cart	Holds what is in your cart.	Shopify	2 weeks
cart_currency	After a checkout, starts your next cart in the same currency.	Shopify	2 weeks
discount_code	Carries a discount code from a link through to checkout.	Shopify	Until you close the browser
localization	Sets your cart to the right country.	Shopify	1 year
login_with_shop_finalize	Completes a sign-in using Shop.	Shopify	5 minutes
shopify_pay	Signs you back into Shop Pay when you return to checkout.	Shopify	1 year
storefront_digest	Lets us preview the store while it is password-protected. Only set for people who have entered the store password.	Shopify	1 year

Reporting and analytics

These tell us how the store is used — which pages people arrive on, which sites they come from, whether a visit is a return visit.

Cookie	What it does	Who sets it	How long it lasts
_landing_page	Records which page you arrived on.	Shopify	2 weeks
_orig_referrer	Records which site you came from.	Shopify	2 weeks
_shopify_analytics	Holds analytics data for the storefront and checkout.	Shopify	1 year
_shopify_s	Identifies one browsing session on this store. The clock restarts each time you use the site.	Shopify	30 minutes
_shopify_y	Shopify’s analytics identifier for a returning browser.	Shopify	1 year
shop_analytics	Holds the buyer information Shop needs for analytics.	Shopify	1 year

Marketing

Set by Shopify to support advertising and personalisation across its own buyer surfaces.

Cookie	What it does	Who sets it	How long it lasts
_shopify_marketing	Holds marketing data for the storefront and checkout.	Shopify	1 year

Preferences

Cookie	What it does	Who sets it	How long it lasts
shopify_override_user_locale	Sets the language used in the Shopify admin. It applies to our own staff, not to visitors.	Shopify	1 year

Other storage on your device

Not everything a website keeps on your machine is a cookie. Some of it sits in your browser’s local storage, which behaves the same way from your side and which we treat the same way. These are what this store keeps there.

Stored item	What it does	Who sets it	How long it lasts
forms_visit_count, forms_previous_session_id, forms_fallback_session_id	Counts your visits and links a form you start to the one you finish, so a part-completed form is not lost.	Shopify Forms	Until you clear your browser storage
cartToken	Remembers which cart is yours.	Shopify	Until you clear your browser storage
viewedProducts	Remembers which products you have looked at, so the store can show them again.	Shopify	Until you clear your browser storage
trackedSourceId	Records where you arrived from.	Shopify	Until you clear your browser storage
__ui, signInWithShop:cartSyncNextRecognitionAt	Small interface preferences, and how often Shop checks whether to offer you sign-in.	Shopify	Until you clear your browser storage

We update this list whenever the cookies and storage on the store change.

Your choices

If you are in the European Economic Area, the United Kingdom, Switzerland, or one of the neighbouring territories that has its own data protection law, you will see a cookie banner the first time you visit. Nothing beyond the strictly necessary cookies is set unless you accept. The banner offers Accept and Decline as two buttons of equal size and prominence, so refusing is exactly as easy as accepting, and Manage preferences if you would rather choose category by category. You can change your mind at any time using the Cookie settings link in our footer. Declining does not limit anything you can do on the site.

Separately from our banner, Shopify offers its own controls over the processing described in clause 6, at privacy.shopify.com.

If you are in a US state with an opt-out right, you can also use the data-sharing opt-out link in our footer.

Wherever you are, you can block or delete cookies in your browser settings. If you do, parts of the store may stop working.

11. Automated decisions

We do not make decisions about you by automated means alone, and we do not profile you.

Two things on our site are automated, and neither is a decision made without a person:

(a) Our payment provider runs automated fraud screening on orders, which can cause an order to be declined. If that happens to you, email us and a person will look at it.

(b) If you are in the EU or the UK, our store checks whether your account has been approved for business purchasing before it will let you pay. That check is a lookup against a decision a person already made, not a decision the system makes about you. If it stops you and you think it should not have, email us and a person will sort it out.

12. Children

Our store is built for clinical operations professionals. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email privacy@kaclinical.com and we will delete it.

13. Security

We hold personal information on established platforms that encrypt data in transit and at rest, restrict access to the two founders and any staff who need it, and require multi-factor authentication. Payment card details never touch our systems.

No system is perfectly secure. If a breach happens that creates a real risk of significant harm to you, we will notify you and the relevant regulator without undue delay, as required by PIPEDA, the EU and UK GDPR, Australia's Notifiable Data Breaches scheme, and applicable US state law. We keep a record of every breach, whether or not it is reportable.

14. Complaints

Please come to us first at privacy@kaclinical.com, or write to us at 2715 117 Street NW, Edmonton, AB T6J 3P4, Canada. Most things are fixable in a day. If we cannot resolve it, you can complain to your regulator:

(a) Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca). In Alberta and British Columbia, the respective Office of the Information and Privacy Commissioner. In Quebec, the Commission d'accès à l'information.

(b) European Economic Area: the data protection authority for the country where you live or work, or where the problem arose. The list is published by the European Data Protection Board at edpb.europa.eu. You may also raise it with our EU representative, named in clause 1.

(c) United Kingdom: the Information Commissioner's Office (ico.org.uk). You may also raise it with our UK representative, named in clause 1.

(d) Australia: Office of the Australian Information Commissioner (oaic.gov.au).

(e) United States: your state Attorney General.

Complaining to a regulator does not stop you asking us to fix it as well, and it does not affect any other legal remedy you have.

15. Changes to this policy

If we change how we handle personal information we will update this page and change the last updated date. If the change is significant we will tell subscribers by email before it takes effect. Continuing to use the store after a change means you accept the updated policy, except where the law requires us to obtain your consent, in which case we will ask.

KA Clinical is a trading name of K.A. Clinical Pharma Consulting Corp., incorporated in Alberta, Canada.