Greenlight

Key Changes and Risks

1. AI training and product development

• No express reference to artificial intelligence, machine learning, or training models appears in the diff.
• The policy newly states that personal data may be processed for “conducting statistics, analysis, as well as improving and developing our products and services,” relying on Greenlight Guru’s legitimate interest under GDPR Article 6(1)(f).
• This broader product-development language could potentially be interpreted to include developing or improving AI-enabled features, including model training, but it does not clearly say:
• whether customer or user data may be used to train AI models;
• whether clinical data may be used;
• whether data is used for general-purpose models or only customer-specific tools;
• whether data is anonymized, aggregated, or de-identified first;
• whether prompts, outputs, or uploaded content are retained; or
• whether data is shared with AI vendors.
• Risk: Customers may face uncertainty regarding secondary use of clinical or user data. The policy should expressly address AI training and distinguish personal data, clinical data, anonymized data, and customer-controlled content.

2. New and expanded processing purposes

• The policy reorganizes the information about user data and adds purposes including:
• account administration;
• product security;
• statistics and analysis;
• product and service development;
• customer service and support.
• Processing is now stated more definitively as based on applicable legal bases, particularly legitimate interests and contractual necessity, rather than merely stating that data “may” be processed.
• Risk: The legitimate-interest basis for broad analytics and product development may expand Greenlight Guru’s permitted uses beyond what customers previously expected.

3. Retention

• For accounts associated with a clinical trial or customer, Greenlight Guru will follow the customer’s processing instructions.
• However, anonymized personal data may be retained for a longer period.
• Risk: “Anonymized” is not defined, and the policy does not specify retention periods or explain how re-identification risk is controlled.

4. Vendors and corporate transactions

• The policy more clearly identifies service providers, such as IT and email providers, and states that they act under data-processing agreements and Greenlight Guru’s instructions.
• It newly permits disclosure in connection with a full or partial sale of Greenlight Guru or its assets, relying generally on legitimate interests.
• Risk: Data may be transferred to prospective buyers, affiliates, or a successor business without separate consent, subject to applicable law.

5. International transfers

• The policy now states that product-user data may be processed in the United States and transferred outside the EU/EEA.
• Transfers to inadequate jurisdictions may rely on EU Standard Contractual Clauses or Binding Corporate Rules.
• Risk: Customers should verify the applicable transfer mechanism, supplementary safeguards, and destination countries, particularly for clinical data.

6. Individual rights and policy changes

• Rights are expanded or clarified to include objection, rectification, deletion, portability, withdrawal of consent, and supervisory-authority complaints.
• Objection rights are expressly subject to the applicable Data Processing terms.
• The policy may be updated periodically, with the updated date posted online.

Key Changes and Risks

1. Updated legal entity and contact information

• The policy now identifies SMART-TRIAL ApS (d.b.a. Greenlight Guru) and adds its Danish CVR number.
• The policy continues to state that Greenlight Guru is headquartered in the United States.
• A specific Danish postal address and clinical.info@greenlight.guru email address have been added for privacy inquiries.

Risk/impact: The policy more clearly identifies the contracting or responsible entity, but the relationship between the Danish entity and the U.S. headquarters remains important for determining data-controller responsibility, jurisdiction, and international-transfer obligations.

2. Expanded categories of personal data

The revised text expressly lists a broader range of user data, including:

• Name and email address
• Phone number and physical address
• Country and occupation/employer
• Staff ID
• IP address and geolocation
• Internet-connection and device information
• Whether the user has accepted newsletter communications

Risk/impact: This is a material expansion or clarification of the information the company may collect. In particular, staff ID, geolocation, device data, and employment information may increase privacy, security, and monitoring concerns. Customers should verify whether these data categories are actually necessary for the service and whether they are collected from all users or only in certain circumstances.

3. Broader and reorganized processing purposes

The purposes now include:

• User-account administration
• Product-security measures
• Statistics and analysis
• Product and service development
• Customer service and support

The revised drafting appears to reorganize and clarify the relationship between data categories, purposes, and legal bases.

Risk/impact: “Statistics and analysis” and “product and service development” are broad purposes. They may permit secondary use of customer or user data beyond providing the clinical product unless limited elsewhere in the policy or contract.

4. Changes to legal-basis language

• The policy now states that personal data may be processed under one or more legal bases.
• It expressly relies on legitimate interests for statistics, analysis, and improving or developing products and services.
• The GDPR reference is now more specific, citing Article 6(1)(f), while the policy also references Article 6(1)(b) for contractual processing.

Risk/impact: Reliance on legitimate interests may allow processing without consent, subject to balancing and transparency requirements. The wording does not clearly identify which legal basis applies to each specific purpose.

5. AI-model training

• No express provision has been added authorizing or describing the use of customer data to train, fine-tune, evaluate, or improve AI models.
• The broad references to “statistics,” “analysis,” and “product and service development” could potentially be argued to cover AI-related development, but the policy does not say so clearly.
• The policy also does not expressly prohibit using clinical, patient, user, or customer data for AI training.

Risk/impact: Customers seeking assurance that their data will not be used for AI training should obtain a specific contractual commitment or written clarification.

6. Other changes

• Several edits are grammatical or formatting corrections.
• The policy’s version/search-results formatting has been revised, but no clear substantive retention-period change is shown in the diff.

Summary

The provided diff only states that approximately 52 words were removed from the document. It does not identify the deleted wording or show any replacement language.

Legal and Commercial Impact

Because the actual text is unavailable, it is not possible to determine:

• Whether the deleted language changed the parties’ rights or obligations.
• Whether liability, indemnification, confidentiality, intellectual property, privacy, security, termination, or governing-law provisions were affected.
• Whether any customer data may now be used more broadly or for different purposes.
• Whether restrictions on data retention, disclosure, sublicensing, or processing were removed.
• Whether customer audit, deletion, opt-out, or approval rights were changed.

AI Model Training

No conclusion can be reached regarding changes to the use of customer data for AI training. The diff does not show whether language was:

• Added or removed permitting the provider to train, fine-tune, or improve AI models using customer data.
• Changed to distinguish between customer content, prompts, inputs, outputs, telemetry, or de-identified data.
• Expanded to allow use of data for product development, analytics, benchmarking, or other secondary purposes.
• Modified to address human review, data retention, anonymization, aggregation, or disclosure to AI subcontractors.
• Changed to give the customer an opt-out or require consent before training.

Risk Assessment

The only identifiable fact is that wording was deleted. Deletions can create risk if they remove customer protections, but the direction and seriousness of the change cannot be assessed without the deleted text and surrounding provisions.

Information Needed

Please provide the actual 52-word deletion, together with any surrounding unchanged text and replacement language, if applicable. The AI-training and broader legal risks can then be analyzed reliably.

Summary of Important Changes

1. Expanded categories of personal data collected

The revised policy appears to add or clarify collection of the following information:

• Name and email address
• Phone number and physical address
• Country
• Newsletter-consent status
• Occupation and employer
• Staff ID
• IP address
• Geolocation
• Internet-connection information
• Equipment used to access the services

Risk: This materially broadens the described scope of personal-data collection, particularly through geolocation, device information, staff ID, employment details, and employer information. The policy should explain when each category is collected, whether it is required, and how long it is retained.

2. Broader and more clearly organized processing purposes

The policy now identifies purposes including:

• User-account administration
• Product-security measures
• Statistics and analysis
• Product and service development
• Customer service and support

Risk: “Statistics,” “analysis,” and “product and service development” are broad purposes. They may permit extensive secondary use of customer or user data unless limited by data-minimization language or more specific explanations.

3. Revised legal-basis language

The policy changes from stating that processing is primarily based on Greenlight Guru’s legitimate interests to stating that personal data may be processed under one or more legal bases. It specifically retains legitimate interests for statistics, analysis, and improving or developing products and services, citing Article 6(1)(f) of the GDPR. It also references Article 6(1)(b), presumably for contractual processing.

Risk: The new wording is more flexible for Greenlight Guru but less specific for individuals. The policy should identify the legal basis for each processing purpose rather than relying on a general statement.

4. Corporate identity and contact details

The policy adds:

• SMART-TRIAL ApS’s CVR number
• A Danish business address
• A dedicated clinical privacy email address

It also clarifies that Greenlight Guru is headquartered in the United States.

Risk: The policy should clearly identify the relevant controller, any applicable EU representative, and the relationship between SMART-TRIAL ApS and the U.S. entity. The U.S. headquarters may implicate international-transfer requirements.

5. International data transfers

The policy continues to refer to EU Commission standard contractual clauses or binding corporate rules where an adequate level of protection is unavailable.

Risk: The revised wording does not appear to add details about transfer destinations, safeguards, or supplementary measures. Those details may be important following modern GDPR transfer requirements.

6. AI-model training

No express change concerning AI training was identified. The diff does not add language authorizing Greenlight Guru to use customer data, clinical-trial data, prompts, outputs, or personal data to train, fine-tune, validate, or improve AI models.

However, the broad references to “statistics,” “analysis,” and “product and service development” could potentially be argued to cover model development unless otherwise restricted.

Recommended clarification: State expressly whether customer data may be used for AI training. If permitted, specify the data involved, purposes, de-identification or aggregation standards, opt-out rights, retention, third-party AI providers, and whether clinical or sensitive data is excluded.

Key Changes and Risks

1. Expanded purposes for using personal data

The policy now expressly permits processing for:

• User-account administration
• Product security
• Statistics and analysis
• Product and service development
• Customer service and support

The previous list primarily described categories of data collected. The new wording gives Greenlight Guru broader stated purposes for using that data.

Risk: “Analysis” and “product and service development” are broad terms. They could potentially support analytics, testing, profiling, or development of automated tools unless limited elsewhere by the customer agreement or data-processing terms.

2. No express AI-training authorization

The diff does not expressly mention artificial intelligence, machine learning, foundation models, model training, or use of customer data to train AI models.

However, the new legitimate-interest language covers “conducting statistics, analysis, as well as improving and developing our products and services.” This could be argued to permit some AI-related development, particularly using user data or usage data for analytics or product improvement.

Important limitation: The policy does not say:

• Whether customer-submitted clinical or trial data may be used for AI training;
• Whether data may be used to train general-purpose models or only customer-specific features;
• Whether data is de-identified before training;
• Whether prompts, outputs, metadata, or usage logs are retained;
• Whether customer data is shared with third-party AI providers; or
• Whether customers can opt out.

Customers should seek an express contractual restriction on AI training and secondary uses.

3. Legal bases are stated more specifically

Processing is now tied to:

• Legitimate interests under GDPR Article 6(1)(f), including statistics, analysis, and product development; and
• Contractual necessity under Article 6(1)(b), including delivering the user account.

This is more detailed but may also strengthen Greenlight Guru’s position that certain processing does not require consent.

4. Longer retention of anonymized data

The policy now states that anonymized personal data may be kept for a longer period. It does not define the retention period or explain the anonymization standard.

Risk: Data described as anonymized may remain linkable or re-identifiable if the process is only pseudonymization. The policy should clarify the standard and whether clinical or trial data is included.

5. Broader disclosures and corporate transactions

The policy now permits access by service providers, including IT and email providers, acting under processor agreements. It also expressly permits disclosure in connection with a full or partial sale of Greenlight Guru or its assets, relying generally on legitimate interests.

It additionally lists potential disclosures to police, lawyers, auditors, courts, public authorities, prospective buyers, and affiliated companies.

Risk: Customer data may be transferred to successor entities or buyers without separate consent.

6. International transfers

The policy clarifies that product-user data may be processed in the United States and transferred outside the EU/EEA using EU Standard Contractual Clauses or binding corporate rules.

Risk: Customers should confirm the specific hosting locations, subprocessors, transfer safeguards, and any supplementary measures required for regulated clinical data.

7. Expanded individual rights and policy updates

The policy adds or clarifies rights to object, rectification, deletion, data portability, withdrawal of consent, and complaints to supervisory authorities. It also reserves the right to update the policy, with the updated version posted online.

Overall assessment: The most significant substantive changes are broader product-development purposes, potentially longer retention of anonymized data, expanded disclosure and sale-related rights, and clearer international-transfer language. No explicit AI-training right was added, but the broader development language creates ambiguity that should be addressed contractually.

Summary of Important Changes

1. Data controller and company identification

• The policy now identifies the entity as SMART-TRIAL ApS (d.b.a. Greenlight Guru) and adds its Danish CVR number.
• It states that Greenlight Guru is headquartered in the United States.
• A Danish postal address and clinical privacy email address were added for contacting the company.

Risk/impact: The policy more clearly identifies the relevant legal entity, but the combination of a Danish legal entity and U.S. headquarters may create questions about which entity is the controller and where responsibility lies. Customers should verify the applicable contracting entity and data-transfer arrangements.

2. Significant expansion of listed personal data

The revised policy adds or expressly lists the following categories of user data:

• Name and email address
• Phone number and physical address
• Country
• Newsletter-consent status
• Occupation and employer
• Staff ID
• IP address and geolocation
• Internet-connection information
• Information about the equipment used to access the service

Risk/impact: This is a material expansion and clarification of the data scope. Some information—such as staff ID, employer, geolocation, device data, and IP address—may increase privacy, security, and employee-monitoring concerns. Customers should assess whether they are permitted to provide this information and whether appropriate notices or consents are required.

3. Broader and more clearly stated processing purposes

The policy now describes processing for:

• User-account administration
• Product-security measures
• Statistics and analysis
• Product and service development
• Customer service and support

The revised wording is more structured and expressly links the listed data to these purposes.

Risk/impact: “Statistics and analysis” and “product and service development” are broad purposes. They could permit substantial secondary use of customer or user data unless limited elsewhere by the contract, data-processing agreement, or technical controls.

4. Legal basis clarified

The policy now says processing may rely on one or more legal bases and specifically describes legitimate interests under GDPR Article 6(1)(f), including improving and developing products and services. It also retains a reference to Article 6(1)(b), contractual necessity.

Risk/impact: Reliance on legitimate interests may allow processing without consent, subject to a balancing test and applicable user rights. The policy does not appear to explain in detail which data and purposes rely on which legal basis.

5. AI-model training

• No express reference to artificial intelligence, machine learning, foundation models, model training, or use of customer data to train AI models was added.
• The broad purposes of “statistics and analysis” and “product and service development” could potentially be interpreted to include analytics or development activities, but the text does not expressly authorize AI training.
• Customers should seek express written confirmation that customer content, clinical-trial data, and personal data will not be used to train AI models, or should require clear opt-out, de-identification, retention, and deletion protections.

6. Other changes

• Several changes are grammatical, formatting, or punctuation corrections.
• The policy continues to address retention, international transfers, and data-subject rights, but the supplied diff does not show a substantive change to those provisions.

Key Changes and Risks

1. AI model training and product improvement

• The revised policy adds a legitimate-interest purpose covering “conducting statistics, analysis, as well as improving and developing our products and services.”
• This language is broader than the prior wording and could potentially encompass using customer or user data to improve automated tools, including AI systems.
• However, the policy does not expressly mention artificial intelligence, machine learning, model training, fine-tuning, evaluation, or use of data to create or improve models.
• It also does not clearly distinguish:
• customer-provided clinical data from account/user data;
• personal data from anonymized or aggregated data;
• temporary service operation from reuse for product development; or
• whether data used for development is retained in models or can be deleted.
• Risk: Customers may interpret the broad “product and service development” wording as permitting AI training, while the absence of explicit limits leaves uncertainty about the scope of permitted use, data de-identification standards, opt-out rights, and ownership of resulting models or outputs.
• Customers handling clinical-trial data should seek an express contractual statement addressing whether their data may be used for AI training and requiring prior consent or exclusion unless specifically authorized.

2. Expanded and reorganized processing purposes

The revised text expressly lists purposes including:

• account administration;
• product security;
• statistics and analysis;
• product and service development;
• customer service; and
• support.

This is a clearer purpose list, but the addition of statistics, analysis, and development creates a broader secondary-use basis than the previous account-focused wording.

3. New legal bases

The policy now identifies:

• Legitimate interests under GDPR Article 6(1)(f), particularly for analytics and product development; and
• Contractual necessity under Article 6(1)(b) for providing user accounts.

Using legitimate interests rather than consent may reduce users’ ability to prevent development-related processing, although an objection right is added, subject to applicable data-processing terms.

4. Retention

• Customer-linked accounts remain subject to the customer’s processing instructions.
• Anonymized personal data “may” be retained longer, without a defined period or clear anonymization standard.
• Risk: “Anonymized” data may be retained indefinitely and could potentially include data that is only pseudonymized, especially where clinical or operational datasets are involved.

5. Disclosure, corporate transactions, and processors

The policy now:

• clarifies use of processors such as IT and email providers;
• permits disclosures to police, courts, authorities, auditors, lawyers, prospective buyers, and affiliates;
• expressly permits transfers in connection with a full or partial sale or asset transfer;
• treats asset-transfer disclosures as generally based on legitimate interests; and
• permits transfers outside the EU/EEA using EU standard contractual clauses or binding corporate rules.

Risk: Customer data may be transferred to a purchaser or successor without separate permission, subject to applicable law and contractual arrangements.

6. Data location and international transfers

Clinical data is stated to be stored and processed in the EU, but product-user data may be processed in the United States and other non-adequate jurisdictions. This creates potential regulatory, security, and government-access concerns.

7. User rights and policy changes

The revised policy adds or clarifies objection, rectification, deletion, data portability, consent withdrawal, and supervisory-authority complaint rights. It also states that the policy may be updated, with the current version posted online.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 52 words to the document”

Because the added wording is not shown, it is not possible to determine what legal changes were made or whether they create new risks.

AI Training and Customer Data

• No language concerning the use of customer data to train, fine-tune, evaluate, or improve AI models is included in the diff.
• It is therefore unknown whether the amendment:
• Permits the provider to use customer data for AI training;
• Limits such use to aggregated, anonymized, or de-identified data;
• Requires customer consent or provides an opt-out;
• Allows use of prompts, inputs, outputs, metadata, or usage information;
• Permits sharing with affiliates, contractors, or third-party AI providers; or
• Imposes deletion, retention, confidentiality, or security obligations.

Other Legal Risks

The actual added words may affect important provisions such as:

• Data ownership and licensing rights;
• Confidentiality;
• Privacy and data-protection compliance;
• Intellectual-property rights in inputs and outputs;
• Liability and indemnification;
• Data retention and deletion;
• Subprocessors and third-party services;
• Audit rights; or
• Customer termination or opt-out rights.

Required Information

To perform a meaningful legal analysis, please provide the actual text of the additions and any deleted or replaced language using the stated notation:

• Additions: {new text}
• Deletions: [old text]
• Replacements: [old text]{new text}

Summary of Changes

Scope of the Diff

• The diff states that approximately 52 words were removed from the document.
• The actual deleted language is not provided.
• Because the text of the deleted provisions is unavailable, the legal and operational impact cannot be determined reliably.

Customer Data and AI Training

• No conclusions can be drawn about whether the changes:
• Permit or restrict using customer data to train, fine-tune, or improve AI models;
• Change whether customer data may be used for model training by the provider or its affiliates;
• Expand the definition of “customer data” or “usage data” that may be used for AI purposes;
• Change requirements for consent, anonymization, opt-out rights, or deletion; or
• Alter restrictions on using customer data to train models for other customers or for general commercial purposes.
• The removed language could have contained either protections or permissions concerning AI training. This cannot be assessed without the actual wording.

Potential Legal Risks

• Unknown reduction in protections: Deleted language may have limited data use, imposed confidentiality obligations, or prohibited secondary uses.
• Unknown change in permissions: Deletions may remove restrictions or conditions on AI model training.
• Compliance uncertainty: The change could affect obligations under privacy, confidentiality, data protection, sector-specific, or contractual requirements.
• Interpretation risk: If the remaining document is ambiguous, the provider and customer may disagree about whether customer data can be used for AI development or improvement.

Recommended Next Step

Obtain and review the exact 52-word deletion, preferably with the surrounding provisions and any tracked-change markup. Particular attention should be given to terms such as “train,” “fine-tune,” “improve,” “develop,” “ machine learning,” “artificial intelligence,” “de-identified,” “aggregated,” “usage data,” and “service improvement.”

Summary

The diff only states that approximately 52 words were added; it does not include the actual added language.

Legal and Commercial Impact

• The specific changes cannot be evaluated without the text of the 52 new words.
• It is not possible to determine whether the additions:
• Change the parties’ rights or obligations;
• Add warranties, disclaimers, limitations of liability, or indemnities;
• Modify confidentiality, privacy, security, or data-retention requirements;
• Affect termination, renewal, payment, or governing-law provisions; or
• Create new compliance obligations.

AI Training and Customer Data

• The provided diff does not reveal whether customer data may be used to train, fine-tune, test, improve, or validate AI models.
• It is therefore impossible to determine whether the new language:
• Grants the provider a license to use customer data for AI training;
• Permits use of aggregated, anonymized, or de-identified data;
• Allows human review or sharing with affiliates or third-party AI providers;
• Applies opt-out, consent, or data-deletion rights;
• Restricts use of confidential or personal information; or
• Allows retention of data after termination for model development.

Risk Assessment

No substantive legal risks can be identified from the information supplied. The actual 52-word addition is required for a meaningful contract analysis, particularly regarding customer-data use and AI-model training.

Summary of Available Change

The only information provided is:

> “Removed approximately 52 words from the document.”

The actual deleted language is not included. As a result, it is not possible to determine what legal obligations, rights, or risks changed.

AI Training and Customer Data

• No conclusion can be reached about whether the deletion:
• Authorizes or restricts using customer data to train AI models;
• Changes whether customer data may be used to improve products or services;
• Removes consent, opt-out, or confidentiality protections;
• Changes ownership or licensing rights in customer data, prompts, inputs, or outputs; or
• Affects the provider’s ability to retain, anonymize, aggregate, or share customer data for AI-related purposes.

The deleted wording should be reviewed specifically for terms such as “train,” “machine learning,” “artificial intelligence,” “improve,” “develop,” “inputs,” “outputs,” “content,” “customer data,” “de-identified,” “aggregated,” “service improvement,” “license,” “consent,” and “opt out.”

Potential Legal Significance

Deleting language can have materially different effects depending on what was removed. For example:

• Removing a prohibition on AI training could expand the provider’s ability to use customer data.
• Removing an authorization could restrict such use.
• Removing an opt-out right, confidentiality obligation, or data-deletion requirement could increase customer risk.
• Removing a limitation or disclaimer could increase the provider’s obligations or liability.
• Removing definitions could create ambiguity about whether prompts, outputs, personal information, or usage data are covered.

Conclusion

The diff is insufficient for substantive legal analysis. Please provide the actual 52 deleted words—or the relevant before-and-after contract language—to identify the precise changes and any new risks, particularly concerning AI model training and use of customer data.

Summary of Important Changes

1. Company Identification and Contact Details

• The policy now identifies the controller/entity as SMART-TRIAL ApS (d.b.a. Greenlight Guru) and adds its Danish CVR number.
• It states that Greenlight Guru is headquartered in the United States.
• A specific Danish postal address and clinical privacy email address have been added for privacy inquiries.

Risk/impact: The addition of both a Danish legal entity and a U.S. headquarters may create uncertainty about which entity is the data controller, particularly for European customers. The policy should clearly state the controller for each processing activity and the relevant representative, if applicable.

2. Expanded Categories of Personal Data

The revised text expressly lists a broader range of information, including:

• Name, email address, phone number, address, and country
• Newsletter-consent status
• Occupation, employer, and staff ID
• IP address and geolocation
• Internet connection details and information about the equipment used to access the services

Risk/impact: This is a material expansion and clarification of the data collected. The addition of geolocation, staff ID, employment information, and device/network data may increase privacy and security obligations. The policy does not appear to explain whether all categories are mandatory, how precise geolocation is, or how long each category is retained.

3. Broader and More Structured Processing Purposes

The purposes are reformulated to include:

• User-account administration
• Product-security measures
• Statistics and analysis
• Product and service development
• Customer service and support

The revised wording states that personal data “may be processed” for these purposes.

Risk/impact: “May be processed” provides flexibility but is less specific than purpose-limited language. “Statistics,” “analysis,” and “product and service development” are broad terms that could permit secondary use beyond operating the service unless further limited elsewhere.

4. Legal Bases

The policy changes from referring primarily to a legitimate-interest basis to stating that data may be processed under one or more legal bases. It retains legitimate interests—particularly improving and developing products and services—and also references Article 6(1)(b) of the GDPR concerning contractual necessity.

Risk/impact: The revised language is broader and less definitive about which legal basis applies to each purpose. A GDPR-compliant notice should map each purpose and data category to a specific legal basis and explain the legitimate-interest balancing assessment where relevant.

5. AI Model Training

• No express provision concerning artificial intelligence, machine learning, or training AI models appears in the supplied diff.
• The broad references to “statistics,” “analysis,” and “product and service development” could potentially encompass model development or training, but the text does not expressly authorize, prohibit, or explain such use.

Risk/impact: Customers cannot determine from this language whether their data, including clinical or user-generated data, may be used to train AI models. A separate, explicit provision should address training, anonymization or de-identification, opt-out rights, retention, human review, and whether data is shared with AI providers.

Summary

The diff only states that approximately 52 words were removed from the document; it does not identify which words, clauses, or sections were deleted.

Key Legal Implications

• AI training and data use: It is not possible to determine whether the deletion changes:
• The provider’s right to use customer data to train, fine-tune, or improve AI models;
• Whether customer content is used for general model training or only for providing the services;
• Whether data is anonymized, aggregated, or de-identified before use;
• Any opt-out, consent, or objection rights;
• Restrictions on using personal, confidential, or regulated data; or
• Ownership and intellectual-property rights in customer data or model outputs.

• Other contractual risks: The deleted language could also have affected confidentiality, security, retention, liability, warranties, audit rights, data processing, or permitted-use restrictions.

Assessment

No reliable legal comparison can be performed from the information provided. The fact that approximately 52 words were removed does not, by itself, show whether the change is minor or material. The deleted text and its surrounding provision are required to identify any new risk, including changes to AI-model training rights.

Information Needed

Please provide the actual deleted text, preferably with the surrounding paragraph or the complete before-and-after clause.

Summary of Available Changes

The supplied diff states only:

> “Added approximately 52 words to the document”

No actual added, deleted, or replacement language was provided. Accordingly, it is not possible to determine the legal or commercial effect of the changes.

Key Issues That Cannot Be Assessed

• Customer data use: The diff does not reveal whether customer data may be used to train, fine-tune, evaluate, or improve AI models.
• Data ownership and rights: It is unclear whether the customer grants the provider any license or other rights in customer data.
• Confidentiality: There is no available language showing whether customer data may be disclosed to model providers, subcontractors, or other third parties.
• Retention and deletion: The changes cannot be reviewed for new data-retention periods, deletion obligations, or use of data after termination.
• Security and privacy: It is not possible to assess whether the additions modify security commitments, privacy obligations, or regulatory compliance terms.
• Liability and indemnity: The diff does not show whether responsibility for unauthorized use, disclosure, or AI-generated outputs has changed.

Risk Assessment

The legal significance of the change is indeterminate because the approximately 52 added words are not included. In particular, no conclusion can be reached about whether the amendment:

• Permits the provider to use customer content to train general-purpose or customer-specific AI models;
• Limits training use to de-identified, aggregated, or opt-in data;
• Gives the customer an opt-out right;
• Allows continued model training after data deletion or contract termination; or
• Transfers data to third-party AI vendors.

Information Needed

To perform a meaningful review, provide the actual redline text showing the 52 added words, including any surrounding sentence or paragraph.

Summary

The diff only states that approximately 52 words were removed from the document. It does not identify the deleted language.

Key legal and commercial implications

• Unable to assess the substantive effect: Without the actual deleted text, it is not possible to determine whether the changes affect liability, confidentiality, data rights, termination, security, intellectual property, or other important provisions.
• AI training and data use: The diff does not reveal whether language was removed concerning:
• use of customer data to train, fine-tune, or improve AI models;
• whether customer data may be used for service improvement;
• whether prompts, inputs, outputs, or personal data are retained;
• whether data is anonymized, aggregated, or shared with affiliates or subprocessors; or
• whether the customer can opt out of AI training or secondary use.
• Potential risk: If the deleted 52 words limited the provider’s ability to use customer data—or required consent, anonymization, confidentiality, or an opt-out—the removal could materially expand the provider’s rights. Conversely, the deletion might remove a broad permission and improve customer protections. The direction of the risk cannot be determined from the information provided.

Recommended follow-up

Obtain a redline showing the specific deleted words and their surrounding clause. Particular attention should be given to any provisions addressing “customer data,” “inputs,” “outputs,” “service improvement,” “machine learning,” “artificial intelligence,” “model training,” “aggregated data,” or “de-identified data.”

Key Changes and Risks

1. Expanded personal-data categories

The policy now expressly lists a broader range of information that Greenlight Guru may collect, including:

• Name, email address, phone number, and physical address
• Country, occupation, employer, and staff ID
• Newsletter-consent status
• IP address and geolocation
• Internet-connection information and details about the equipment used to access the services

Risk: This is a material expansion and clarification of the categories of personal data covered. In particular, geolocation, staff ID, employment information, device data, and internet-connection information may be sensitive from a privacy and employment perspective. Customers should verify whether this information is actually collected and whether appropriate notices and controls apply.

2. Broader and more general processing purposes

The purposes are reorganized and stated more broadly. They now include:

• User-account administration
• Product-security measures
• Statistics and analysis
• Product and service development
• Customer service and support

The revised wording states that personal data “may be processed” for these purposes, rather than describing processing more narrowly.

Risk: “Statistics,” “analysis,” and “product and service development” are broad purposes that may permit additional internal analytics, service improvement, or secondary uses. The policy does not define the limits of these activities, whether data will be anonymized or aggregated, or how long analytical data will be retained.

3. Legal basis language expanded

The policy now says processing may rely on “one or more” legal bases and expressly identifies legitimate interests under Article 6(1)(f) GDPR, including improving and developing products and services.

Risk: Reliance on legitimate interests may allow processing without consent, subject to the required balancing test and individuals’ rights to object. The revised language is less specific about the legal basis for each individual purpose, which may reduce transparency.

4. AI-model training

No express change regarding AI training was identified. The diff does not add language authorizing the use of customer data, personal data, clinical-trial data, prompts, outputs, or other customer content to train, fine-tune, validate, or improve AI models.

However, the newly emphasized purposes of “statistics and analysis” and “product and service development” are broad enough that they could potentially support certain analytics or development activities. They do not, by themselves, clearly authorize AI training, particularly where identifiable personal or clinical data is involved. Customers should seek a specific contractual commitment stating whether customer data may be used for AI training and requiring de-identification, opt-out rights, or a prohibition.

5. Corporate and contact details

The policy adds SMART-TRIAL ApS’s CVR number and provides a specific Danish postal address and clinical.info@greenlight.guru email address for privacy complaints or inquiries.

Risk: These additions improve identification and contactability, but the document contains formatting and spacing errors that should be corrected for clarity.

6. Other drafting changes

Several changes standardize apostrophes and references to the company, and clarify the possibility of corporate restructuring. No material change to retention, international-transfer mechanisms, or data-subject rights is apparent from the diff.

Summary of Important Changes

AI model training

• No express reference to AI, machine learning, generative AI, or training models appears in the diff.
• The revised purposes now include “conducting statistics, analysis, as well as improving and developing our products and services.”
• This wording could potentially support analytics or product-development uses of user data, but it does not expressly authorize using customer or clinical data to train AI models.
• The policy should be reviewed alongside the applicable Data Processing terms, master Privacy Policy, and customer agreement, which may contain broader AI or service-improvement rights.
• For clinical-trial data, the policy states that Greenlight Guru follows processing instructions from the customer, but it also allows anonymized personal data to be retained longer. The definition and irreversibility of “anonymized” data should be confirmed, particularly if such data may be used for model training or product development.

Expanded processing purposes and legal bases

• The policy reorganizes the data description into separate purposes of processing, including:
• User-account administration
• Product security
• Statistics and analysis
• Product and service development
• Customer service and support
• Processing is more specifically tied to:
• Legitimate interests under GDPR Article 6(1)(f), including statistics, analysis, and product improvement; and
• Contract performance under Article 6(1)(b).
• This may broaden or clarify Greenlight Guru’s ability to use personal data for product improvement without consent. The legitimate-interest balancing assessment is not provided.

Retention

• Customer-specific retention instructions remain applicable where an account relates to a clinical trial or customer.
• However, anonymized personal data may be retained for a longer period, creating a potential long-term use risk if anonymization is incomplete or reversible.

Disclosures and transfers

• The policy replaces or clarifies references to “other data controllers” and emphasizes access by data processors, such as IT and email providers, under contractual instructions and data-processing agreements.
• It adds disclosures to police, lawyers, auditors, courts, public authorities, prospective buyers, and affiliated companies.
• A new business-transfer provision permits personal data to be transferred in connection with a full or partial sale or restructuring, generally relying on legitimate interests.
• International transfers may occur outside the EU/EEA using EU Standard Contractual Clauses or binding corporate rules. Processing in the United States is expressly contemplated through the master Privacy Policy.

Individual rights and drafting concerns

• Rights are expanded or clarified to include objection, rectification, deletion, data portability, and withdrawal of consent.
• Objection rights are expressly subject to the applicable Data Processing terms.
• The diff contains substantial apparent formatting, duplication, and sequencing errors. The final published policy should be checked carefully for accuracy, consistency, and a clear effective/version date.

Executive Summary

The revised policy primarily (1) identifies the Danish legal entity and registration number, (2) expands and clarifies the categories of personal data collected, (3) reorganizes the processing purposes and legal-basis language, and (4) updates contact and formatting details. No express provision authorizing the use of customer data to train AI models appears in the diff.

Important Changes and Risks

1. Expanded categories of personal data

The revised text expressly lists additional information, including:

• Name, email address, phone number, and physical address
• Country
• Newsletter-consent status
• Occupation, employer, and staff ID
• IP address and geolocation
• Internet-connection information and information about the equipment used to access the services

Risk: This makes the scope of collection materially broader and more specific. Some information—particularly staff ID, geolocation, device information, and employment details—may increase privacy, security, and data-minimization obligations. Customers should confirm that the product actually collects each category and that appropriate notices and controls are in place.

2. Broader and clearer processing purposes

The policy now lists purposes including:

• User-account administration
• Product-security measures
• Statistics and analysis
• Product and service development
• Customer service and support

Risk: “Statistics and analysis” and “product and service development” are broad terms. They could permit extensive secondary use of user data beyond providing the core service, depending on how Greenlight Guru interprets them. The policy does not appear to limit these activities to aggregated, anonymized, or de-identified data.

3. Legal basis language revised

The policy now states that processing may rely on one or more legal bases and expressly identifies legitimate interests under GDPR Article 6(1)(f), including improving and developing products and services. The prior wording referred more generally to legitimate interests.

Risk: The revised language may strengthen Greenlight Guru’s stated basis for analytics and product-development processing without obtaining consent. Customers should assess whether the legitimate-interest balancing test, transparency, and opt-out rights are adequate for their intended use.

4. AI-model training

No new language expressly states that customer data, personal data, clinical data, prompts, outputs, or usage data may be used to train, fine-tune, or evaluate AI models.

However, the broad references to “statistics and analysis” and “product and service development” could potentially be argued to cover certain AI-related development activities. The policy does not clarify:

• Whether data is used for AI training;
• Whether data is de-identified before such use;
• Whether data is shared with AI providers;
• Whether customer content is excluded from model training; or
• Whether customers can opt out.

Recommendation: Obtain a written contractual commitment addressing AI training and requiring that customer and clinical-trial data not be used to train general-purpose or third-party AI models unless expressly authorized.

5. Entity and contact updates

The policy adds SMART-TRIAL ApS’s Danish CVR number and provides a Danish postal address and clinical.info@greenlight.guru contact address.

Risk: The policy should clearly identify the relevant controller, representative, and—if applicable—data-protection officer for each customer’s jurisdiction.

Structured Summary of Important Changes

1. Data collected and processing purposes

• The policy no longer presents a detailed list of user data categories in this section (such as name, email, phone number, country, newsletter status, occupation, employer, staff ID, IP address, geolocation, and device/internet information).
• It instead describes broad processing purposes, including:
• User-account administration
• Product security
• Statistics and analysis
• Product and service development
• Customer service and support
• This restructuring creates less transparency about exactly what data is collected and may make it harder for customers to assess whether particular data uses are permitted.

2. New or clarified legal bases

• Processing for product improvement and development is expressly based on Greenlight Guru’s “legitimate interests” under GDPR Article 6(1)(f).
• Account-related processing is expressly based on contractual necessity under Article 6(1)(b).
• The new legitimate-interest language is broader than the prior purpose list and could support additional analytics, service-development, and potentially technology-development activities.

3. AI model training

• The diff does not expressly mention artificial intelligence, machine learning, model training, generative AI, foundation models, or use of customer data to train AI systems.
• However, the newly stated purposes—“statistics, analysis” and “improving and developing our products and services”—are broad. Depending on the underlying processing, Greenlight Guru might argue that certain de-identified, aggregated, or potentially personal data uses for developing AI-enabled features fall within these purposes.
• The policy does not clarify:
• Whether customer data is used to train AI models;
• Whether clinical or user-submitted content is excluded from training;
• Whether data is anonymized or aggregated before such use;
• Whether data is shared with AI vendors;
• Whether customers can opt out; or
• Whether trained models retain or reproduce customer information.
• Customers should seek an explicit contractual commitment addressing AI training and model-development use.

4. Retention

• The prior wording specifically referred to retaining anonymized personal data for longer periods.
• The revised wording appears to allow personal data associated with a clinical-trial customer to be retained longer under the customer’s processing instructions, while also preserving broader retention for business or asset-transfer purposes. The duration remains unspecified.

5. Disclosures and business transfers

• Processing by service providers is described more clearly as processor activity governed by data-processing agreements and Greenlight Guru’s instructions.
• Disclosures are expanded or expressly listed to police, lawyers, auditors, courts, public authorities, prospective buyers, and affiliated companies.
• Greenlight Guru may transfer data as part of a full or partial sale or other commercial restructuring, relying generally on legitimate interests.

6. International transfers

• The policy now states that product-user data may be processed in the United States.
• Transfers outside the EU/EEA to countries lacking adequate protection may rely on EU Standard Contractual Clauses or binding corporate rules.
• This increases cross-border transfer exposure and may involve access by U.S. authorities or overseas vendors.

7. Data-subject rights

• Rights are stated more fully, including objection, rectification, deletion, portability, and withdrawal of consent.
• The right to object is expressly subject to the applicable Data Processing terms, potentially limiting practical exercise of that right.

Summary of Important Changes

1. Expanded personal-data categories

The policy now expressly states that Greenlight Guru may collect and process a substantially broader range of user information, including:

• Name and email address
• Phone number and physical address
• Country
• Newsletter-consent status
• Occupation, employer, and staff ID
• IP address and geolocation
• Information about the user’s internet connection and access equipment

Risk: This is a material expansion or clarification of the data covered by the policy. Some information—particularly geolocation, device/network data, staff ID, and employment details—may increase privacy, security, and employee-monitoring concerns. Customers should verify that they have appropriate notices, consents, and internal policies for providing this information.

2. Processing purposes reorganized and potentially broadened

The policy now identifies the following purposes:

• User-account administration
• Product-security measures
• Statistics and analysis
• Product and service development
• Customer service and support

The revisions make “statistics and analysis” and “product and service development” more prominent and connect them to the company’s legitimate interests.

Risk: The wording may support broader secondary use of user data for analytics and improving products and services. The policy does not clearly define whether data will be aggregated, de-identified, or used for commercial product development.

3. Legal basis clarified

The policy now states that processing may rely on one or more legal bases, including legitimate interests under Article 6(1)(f) GDPR. It also retains or references contractual necessity under Article 6(1)(b) GDPR.

Risk: Reliance on legitimate interests requires a documented balancing test and appropriate transparency. The revised language is general and does not identify which data or purposes rely on which legal basis. This may create uncertainty regarding objection rights and the limits of processing.

4. AI-model training

No express change concerning AI or training AI models is shown in this diff. The revised references to statistics, analysis, product development, and service improvement could potentially be broad enough to encompass machine-learning activities, but the policy does not expressly authorize, describe, or limit:

• Training or fine-tuning AI models
• Use of customer content or clinical data for training
• Whether data is anonymized or de-identified
• Sharing data with AI vendors
• Opt-out, objection, or deletion rights relating to training data

Customers should request written confirmation that their data—including clinical-trial data, metadata, prompts, outputs, and support content—is not used to train general-purpose or vendor AI models unless expressly agreed.

5. Corporate identity and contact details

The policy adds SMART-TRIAL ApS’s Danish CVR number and Danish contact details. It also states that Greenlight Guru is headquartered in the United States.

Risk: The relationship between the Danish legal entity and the U.S. business, including controller/processor roles and international-transfer responsibilities, should be clarified.

6. International transfers

References to EU Commission standard contractual clauses and binding corporate rules remain, with minor formatting corrections. No clear substantive improvement to transfer safeguards is shown.

Summary

The provided diff states only that approximately 52 words were removed from the document. It does not identify which words, clauses, or sections were deleted.

Key Legal Implications

• Substantive impact cannot be determined: Without the actual deleted text, it is not possible to assess whether the changes affect liability, confidentiality, termination, intellectual property, data security, or other obligations.
• Potential narrowing of protections: Deletions could remove customer rights, provider obligations, limitations on data use, warranties, indemnities, or compliance requirements.
• Potential expansion of discretion: If deleted language imposed restrictions or conditions on the provider, its removal may give the provider broader contractual rights.

AI Training and Customer Data

• The diff provides no identifiable information about whether customer data may be:
• Used to train, fine-tune, or improve AI models;
• Shared with model providers or other third parties;
• Used in aggregated, de-identified, or identifiable form;
• Retained after termination; or
• Excluded from training by default or only upon opt-out.
• Accordingly, no conclusion can be reached about whether the customer’s data-use protections have improved or weakened.

Recommended Next Step

Provide the actual deleted language, ideally with the surrounding clause or a full redline. The removed text should then be reviewed specifically for changes to:

1. Customer data ownership and permitted uses;

2. AI training, model improvement, and human review;

3. De-identification and aggregation standards;

4. Data retention and deletion;

5. Subprocessors and third-party model providers; and

6. Opt-out, consent, and contractual remedies.

Summary of Important Changes

1. Company identity and contact details

• The policy now identifies the entity as SMART-TRIAL ApS (d.b.a. Greenlight Guru) and adds its CVR number.
• It states that Greenlight Guru is headquartered in the United States.
• A new contact block provides the Aalborg, Denmark address and clinical.info@greenlight.guru email address.
• These changes improve identification and contactability, but the policy should clearly explain which entity is the data controller for different processing activities, particularly given the Danish legal entity and U.S. headquarters.

2. Expanded categories of personal data

The revised text expressly lists a broader range of information, including:

• Name, email address, phone number, and physical address
• Country, occupation, employer, and staff ID
• IP address and geolocation
• Information about the user’s internet connection and equipment
• Whether the user has accepted marketing/newsletter communications

This is a significant clarification and expansion of the disclosed data categories. Customers should assess whether the product actually collects all of these fields and whether any may constitute sensitive or indirectly identifiable information in a clinical-trial context.

3. Processing purposes reorganized and clarified

The policy now identifies purposes including:

• User-account administration
• Product security
• Statistics and analysis
• Product and service development
• Customer service and support

The substance is broadly similar to the previous wording, but the revised presentation makes the purposes more explicit. “Product and service development” remains broad and could potentially encompass analytics, testing, and improvement activities beyond strictly necessary account administration.

4. Legal basis changes

The previous language referred primarily to Greenlight Guru’s legitimate interest in statistics, analysis, and improving and developing products and services.

The revised wording states that personal data may be processed on “one or more” legal bases, and identifies legitimate interests under Article 6(1)(f) GDPR. The surrounding text also refers to Article 6(1)(b) GDPR, apparently for contractual processing.

This may broaden or clarify the claimed legal bases, but it does not specify which legal basis applies to each individual purpose. That lack of mapping may make it harder for customers to evaluate necessity, objection rights, and whether consent is required—for example, for newsletters or optional analytics.

5. AI-model training

No express change concerning AI or the training, fine-tuning, or evaluation of AI models appears in the supplied diff.

The references to “statistics,” “analysis,” and “product and service development” could theoretically cover machine-learning activities, but the text does not expressly authorize AI training or explain whether customer data is used for that purpose. The policy should not be read as providing clear, specific notice of AI-model training without additional language.

6. Other changes

• Minor punctuation, formatting, and grammatical changes were made.
• The international-transfer wording continues to reference EU Commission standard contractual clauses or binding corporate rules.
• The version/history section appears reformatted, with no clear substantive change.

Summary of Important Changes

1. AI model training

• No express reference to artificial intelligence, machine learning, generative AI, or training models appears in the diff.
• The policy now expressly permits processing for “statistics, analysis, as well as improving and developing our products and services” based on Greenlight Guru’s legitimate interest under GDPR Article 6(1)(f).
• This wording is broad and could potentially be interpreted to cover activities such as product analytics, algorithm development, or AI-model improvement, but it does not clearly authorize or explain training AI models using customer or clinical data.
• The policy should clarify:
• Whether customer content or clinical-trial data is used for AI training;
• Whether data is de-identified, anonymized, aggregated, or retained for that purpose;
• Whether training is performed by Greenlight Guru or third-party providers;
• Whether customers can opt out; and
• Whether trained models can retain or reproduce information from the data.

2. Purposes and legal bases

• The policy replaces a relatively detailed list of personal-data categories and processing purposes with a more structured statement of purposes, including:
• User-account administration;
• Product security;
• Statistics and analysis;
• Product and service development; and
• Customer service and support.
• Processing for product and service improvement is now expressly tied to legitimate interests, while account provision is tied to contractual necessity under Article 6(1)(b).
• The change may broaden Greenlight Guru’s claimed ability to use user data for internal analysis and development. The legitimate-interest assessment and the relationship between this policy and customer contractual restrictions should be reviewed.

3. Retention

• For accounts associated with a clinical trial or customer, Greenlight Guru will follow the customer’s processing instructions.
• Anonymized personal data may be retained longer, without a defined retention period. This creates a risk if data described as “anonymized” is only pseudonymized or could reasonably be re-identified.

4. Disclosure and corporate transactions

• The policy now distinguishes between data processors and data controllers and states that service providers will process data under Greenlight Guru’s instructions and data-processing agreements.
• Disclosure is expanded or clarified to include police, lawyers, auditors, courts, public authorities, prospective buyers, and affiliated companies.
• Greenlight Guru claims a legitimate interest in transferring personal data during a full or partial sale or other asset transaction. This may permit disclosure without individual permission.

5. International transfers

• Clinical data is stated to be stored and processed in the EU.
• Product-user data may nevertheless be processed in the United States under the master Privacy Policy.
• Transfers outside the EU/EEA may rely on EU Standard Contractual Clauses or binding corporate rules, creating additional cross-border access and compliance risks.

6. Individual rights and policy updates

• Rights are restated, including objection, rectification, deletion, portability, consent withdrawal, and complaints to a supervisory authority.
• The right to object is expressly made subject to the applicable Data Processing terms, potentially limiting practical exercise of that right.
• The policy may be updated from time to time, with the effective date posted online.

Summary

The supplied diff does not include the actual amended contractual language. It only states: “Added approximately 52 words to the document.”

Changes Identified

• No specific additions, deletions, or replacements are shown.
• No legal terms, obligations, rights, or limitations can be evaluated from the information provided.
• The affected section of the agreement is unknown.

AI Training and Customer Data

• The diff does not reveal whether customer data may be:
• Used to train, fine-tune, or improve AI models;
• Shared with model providers or other third parties;
• Used in aggregated, de-identified, or anonymized form;
• Retained for training or model-development purposes; or
• Excluded from training and limited to providing the contracted services.
• Accordingly, no conclusion can be reached about whether the amendment creates new risks concerning AI training, data ownership, confidentiality, privacy, or deletion obligations.

Information Needed

Please provide the actual text of the additions, deletions, and replacements using the stated notation. The relevant surrounding provisions would also be helpful, particularly any sections concerning:

• Customer data and content;
• Confidentiality and privacy;
• Service improvement or analytics;
• Artificial intelligence or machine learning;
• Data retention and deletion; and
• Subprocessors or third-party service providers.

Summary

The diff only states that approximately 52 words were removed from the document. It does not identify:

• Which provisions were deleted;
• Whether the deletions alter the parties’ rights or obligations;
• Whether any limitations, warranties, confidentiality terms, or liability provisions were affected; or
• Whether the customer’s data may be used to train AI models.

AI-Training and Data-Use Impact

No specific change concerning AI training or model development can be determined from the information provided. The deleted text could potentially have addressed matters such as:

• Permission to use customer data, prompts, outputs, or usage information to train or improve AI models;
• Whether data is used for general model training or only to provide the services;
• Opt-out or consent requirements;
• De-identification, aggregation, or anonymization standards;
• Retention and deletion of training data;
• Ownership or licensing of customer data and model outputs; or
• Restrictions on using confidential or personal information for training.

However, there is no basis to conclude that any of these terms were added, removed, or modified.

Key Risk

The principal risk is lack of visibility into the deleted language. A deletion of only 52 words could still materially change the agreement, particularly if it removed an exception, limitation, consent requirement, or restriction on data use. The change should not be approved without comparing the full prior and revised versions or obtaining the exact deleted text.

Recommended Follow-Up

Request:

1. The exact 52 words that were removed;

2. The surrounding provision and section heading;

3. Confirmation of whether the deletion affects customer-data use, AI training, confidentiality, privacy, security, or liability; and

4. Any updated data-processing or AI-use documentation incorporated by reference.

Summary of Important Changes

1. Company identification and contact details

• The policy now identifies the entity as SMART-TRIAL ApS (d.b.a. Greenlight Guru) and adds its CVR number (35 13 97 10).
• The policy continues to state that Greenlight Guru is headquartered in the United States.
• A Danish postal address and clinical privacy email address are added under the contact information:
• SMART-TRIAL ApS, K. Christensens Vej 2L, 9200 Aalborg SV, Denmark
• clinical.info@greenlight.guru

Risk/impact: The added corporate details may clarify which legal entity is responsible for processing, but the policy should be checked for consistency regarding the Danish entity’s role versus the U.S. headquarters and any controller/processor allocation.

2. Expanded categories of personal data

The revised text expressly lists substantially more information that may be collected, including:

• Name, email address, phone number, and physical address
• Country and geolocation
• Newsletter-consent status
• Occupation, employer, and staff ID
• IP address
• Internet-connection information
• Information about the equipment used to access the services

Risk/impact: This is a material expansion and clarification of the data scope. Geolocation, device, staff-ID, employment, and network information may create additional privacy, security, transparency, and data-minimization obligations. Customers should confirm whether these fields are actually collected, necessary, and appropriately disclosed to trial participants and users.

3. Processing purposes

The revised policy describes processing for:

• User-account administration
• Product-security measures
• Statistics and analysis
• Product and service development
• Customer service and support

The wording now more clearly ties the listed data to these purposes.

Risk/impact: “Statistics,” “analysis,” and “product and service development” are broad purposes. They could permit wider internal analytics or product-improvement use unless limited elsewhere by contract, data-processing terms, or technical controls.

4. Legal bases

The policy changes from referring primarily to a legitimate-interest basis to stating that processing may rely on one or more legal bases. It continues to identify legitimate interests under GDPR Article 6(1)(f), particularly for statistics, analysis, and improving or developing products and services.

Risk/impact: The broader wording may give Greenlight Guru flexibility to rely on additional legal bases, although the diff does not clearly identify all of them. Customers should request clarification about the legal basis for each processing activity, especially analytics and development.

5. AI-model training

No express change concerning AI or training AI models appears in the diff. The revised references to statistics, analysis, and product/service development do not expressly authorize using customer data to train, fine-tune, evaluate, or improve AI models.

Risk: Because “product and service development” is broad, it could potentially be interpreted to cover AI-related development unless restricted elsewhere. The policy should be reviewed together with the agreement, DPA, and any AI terms for an explicit prohibition or authorization concerning model training.

6. Other changes

• Minor punctuation and formatting changes were made.
• The policy retains language concerning international transfers and standard contractual clauses.
• The version/search-result formatting appears updated or cleaned up, but no clear substantive retention-period change is shown.

Summary

The diff only states that approximately 52 words were removed, but does not identify which words, clauses, or sections were deleted.

Legal and Commercial Impact

Because the deleted text is not provided, it is not possible to determine whether the changes affect:

• Customer data ownership or usage rights
• Confidentiality obligations
• Permission to use customer data to train, fine-tune, or improve AI models
• Data retention, deletion, or security requirements
• Service-provider access to customer content
• Compliance, audit, indemnity, or liability provisions
• Customer termination or data-export rights

AI Training Provisions

No conclusion can be reached about changes to AI-model training. The deletion could potentially:

• Remove an express prohibition on using customer data for AI training;
• Remove or narrow customer consent for such use;
• Eliminate restrictions on using data to improve products or services;
• Remove obligations to anonymize or de-identify data; or
• Delete language requiring the provider to disclose or obtain permission for AI training.

However, none of these effects can be confirmed from the information supplied.

Risk Assessment

The principal risk is lack of visibility into the deleted language. A deletion of only 52 words could materially change the agreement if it removed a short but important sentence, such as a data-use restriction, consent requirement, or confidentiality exception.

Information Needed

Please provide the actual deleted text, preferably with the surrounding unchanged language. Without it, a reliable legal comparison and assessment of AI-training or customer-data risks is not possible.

Summary of Important Changes

1. Controller identity and company details

• The policy now identifies SMART-TRIAL ApS (d.b.a. Greenlight Guru) and adds its CVR registration number.
• It continues to state that Greenlight Guru is headquartered in the United States.
• The punctuation and quotation style were standardized, but these changes are not legally significant.

Risk/impact: The addition of the Danish legal entity and registration number improves identification of the relevant data controller, but the policy should clearly explain the relationship between SMART-TRIAL ApS and any U.S. Greenlight Guru entity.

2. Expanded categories of personal data

The revised text expressly lists a broader range of data, including:

• Name, email address, phone number, address, and country
• Newsletter-consent status
• Occupation, employer, and staff ID
• IP address and geolocation
• Internet-connection and device information

Risk/impact: This is a material expansion in transparency about data collection. Customers should verify that the service actually collects all listed categories and that the relevant collection notices, consent mechanisms, and security controls are in place. Geolocation, device information, and employment identifiers may create additional privacy and regulatory obligations.

3. Broader and clearer processing purposes

The revised policy lists purposes including:

• User-account administration
• Product security
• Statistics and analysis
• Product and service development
• Customer service and support

The language now says data “may be processed” for these purposes, rather than describing processing more narrowly.

Risk/impact: The broader wording may give Greenlight Guru greater flexibility to reuse customer and user data for analytics, product improvement, and service development. Customers should assess whether their contractual terms limit such use, particularly for clinical-trial information.

4. Changes to legal bases

• The revised wording states that processing may rely on one or more legal bases.
• It expressly identifies legitimate interests under Article 6(1)(f) GDPR, including statistics, analysis, and improving and developing products and services.
• The surrounding text still references contractual necessity under Article 6(1)(b) GDPR.

Risk/impact: Reliance on legitimate interests may permit processing beyond what is strictly necessary to perform the contract. Greenlight Guru should be able to explain its balancing assessment and how individuals can object.

5. AI-model training

No express change or new provision concerning AI or training artificial-intelligence models appears in this diff.

The references to statistics, analysis, and improving or developing products and services could potentially encompass machine-learning activities, but the revised language does not expressly authorize AI training, identify training data, describe anonymization, or state whether customer content is used to train general-purpose or customer-specific models.

Risk/impact: The policy is ambiguous if Greenlight Guru intends to use data for AI training. Customers should seek express contractual confirmation that clinical, trial, or other customer data will not be used for AI-model training unless specifically authorized.

6. Contact and rights information

• A specific Danish postal address and email address were added for privacy inquiries.
• The rights section remains, including the ability to complain if the issue is not resolved.

Risk/impact: This improves practical access to the controller, although the formatting should be corrected for readability.

Summary of Important Changes

1. AI-model training

• No express authorization to train AI models was added or removed. The revised text does not specifically mention artificial intelligence, machine learning, model training, prompts, or using customer data to develop or train AI systems.
• However, the policy newly/clearly identifies “statistics, analysis, as well as improving and developing our products and services” as purposes for processing personal data, relying primarily on legitimate interests under GDPR Article 6(1)(f).
• This language is broad enough that it could potentially be interpreted to cover product analytics or development activities involving automated systems, including AI, depending on the company’s actual practices and other contractual terms. It does not, however, clearly state that identifiable customer or clinical data may be used for AI training.
• Customers should review the master privacy policy, Data Processing Agreement, and any AI-specific terms for express restrictions or permissions concerning model training and whether data is anonymized, aggregated, or used only to provide the service.

2. Processing purposes and legal bases

• The policy replaces a detailed list of collected data—including name, email, phone number, country, newsletter status, occupation, employer, staff ID, IP address, geolocation, internet connection, and device information—with a more structured list of processing purposes:
• User-account administration
• Product security
• Statistics and analysis
• Product and service development
• Customer service and support
• Processing is described as “will” be based on specified legal bases, rather than “may” be processed under those bases. The policy adds:
• Legitimate interests for statistics, analysis, and product/service development
• Contractual necessity for providing the user account

Risk: The revised policy is less specific about the categories of personal data collected and gives a broader, more business-oriented description of permitted uses.

3. Retention

• For accounts associated with a clinical trial or customer, Greenlight Guru will follow processing instructions from the customer.
• Anonymized personal data may be retained longer, without a defined period.

Risk: “Anonymized” is not defined, and retention may be extended indefinitely if data is considered sufficiently anonymized.

4. Disclosures and corporate transactions

• Service-provider disclosures are reframed as transfers to data processors, acting under Greenlight Guru’s instructions and data-processing agreements.
• The policy expressly permits disclosure in connection with a full or partial sale of Greenlight Guru or its assets, relying generally on legitimate interests.
• Disclosures may also be made to police, lawyers, auditors, courts, public authorities, prospective buyers, and affiliated companies.

5. International transfers

• Clinical data is stated to be stored and processed in the EU, but product-user data may be processed in the United States.
• Transfers outside the EU/EEA may rely on EU Standard Contractual Clauses or binding corporate rules.

6. Data-subject rights and updates

• Rights are expanded or clarified to include objection, correction, deletion, portability, and withdrawal of consent.
• The policy may be updated periodically, with the revised date posted on Greenlight Guru’s websites.

Structured Summary of Important Changes

1. Expanded personal-data categories

The policy now expressly lists a broader range of information collected from users, including:

• Name, email address, telephone number, and physical address
• Country, occupation, employer, and staff ID
• Newsletter-consent status
• IP address and geolocation
• Internet-connection information and details of the equipment used to access the services

Risk/impact: This is a material expansion and clarification of the data covered by the policy. Customers should assess whether these categories are actually collected and whether appropriate notices, consent mechanisms, security controls, and retention practices are in place. Geolocation, device, and employment-related information may be particularly sensitive in some jurisdictions.

2. Processing purposes clarified and potentially broadened

The revised text identifies the following purposes:

• User-account administration
• Product-security measures
• Statistics and analysis
• Product and service development
• Customer service and support

The policy now more clearly links the listed data to these purposes.

Risk/impact: “Statistics and analysis” and “product and service development” are broad terms. They could permit use of customer or user data for analytics, product improvement, or development activities beyond strictly providing the Clinical product unless limited elsewhere in the agreement.

3. Legal bases revised

The prior wording referred generally to processing based primarily on Greenlight Guru’s legitimate interests. The new wording states that processing may rely on one or more legal bases, including legitimate interests under Article 6(1)(f) GDPR, and references Article 6(1)(b) GDPR in connection with contractual processing.

Risk/impact: The change provides greater flexibility to rely on different legal bases. However, the policy does not clearly map each processing purpose and data category to a specific legal basis. Customers may wish to request that mapping, particularly for analytics, development, marketing-related consent status, geolocation, and employee information.

4. Corporate identity and contact details updated

The policy identifies SMART-TRIAL ApS (d.b.a. Greenlight Guru), provides its Danish CVR number and Aalborg address, and states that Greenlight Guru is headquartered in the United States. A specific clinical privacy contact email is also added.

Risk/impact: This improves transparency but highlights potential cross-border processing between Denmark, the United States, and other locations. The policy refers to EU Commission standard contractual clauses or binding corporate rules where required.

5. AI-model training

No express change concerning AI training was identified. The diff does not add language expressly authorizing Greenlight Guru to use customer data, clinical-trial data, prompts, outputs, or personal data to train, fine-tune, or improve artificial-intelligence or machine-learning models.

However, the broad purposes of “statistics and analysis” and “product and service development” could create ambiguity if AI-related development is later conducted under those purposes. Customers should seek an explicit contractual statement that customer data and clinical-trial data will not be used for AI-model training without prior written consent, subject to agreed de-identification and security requirements.