Privacy Policy

1. Who we are

Prophy is Prophy Inc. and its subsidiaries Prophy B.V. and Prophy Sàrl:

• Prophy Inc., 7011 W. Greenleaf St, Niles, IL 60714, USA
• Prophy B.V., Karperdaal 90, 2553 PK The Hague, the Netherlands
• Prophy Sàrl, Chemin du Bochet 8B, 1025 St-Sulpice, Switzerland

In this policy, “Prophy”, “we” and “us” mean these companies.

Prophy is a service for organizations: publishers, research funders and research organizations (“customers”). A customer buys a subscription under a written agreement (the “Customer Agreement”), which includes a data processing agreement. The customer gives accounts to its staff and to other people who work for it, such as editors and panel members (“Users”).

The table shows which company is responsible for each kind of data (the “controller”).

This privacy policy does not apply to products and services of other companies, including AI assistants that you connect to Prophy.

2. How to contact us

For any question about your data, or to use your rights, write to our Data Protection Officer at compliance@prophy.ai.

3. Researchers in our database

3.1 What we do

We build profiles of researchers from public academic information. Our customers use these profiles to find researchers and invite them to review manuscripts and grant proposals, to join review panels and expert groups, or to contribute to a journal issue or a conference. They also use the profiles to check conflicts of interest and to build balanced panels. The database has profiles of about 100 million researchers.

3.2 What data a profile contains

• name and ORCID iD
• current and past affiliations, and country
• publications, co-authors and grants
• research topics and expertise, derived from your publications
• professional email address, if it is published in a publication
• bibliometric indicators, such as h-index, citations and academic age
• a flag if you are an author of a retracted article
• gender, predicted automatically from your first name (see 3.4)

We do not collect private contact details, photos, home addresses or social media profiles. We do not collect special categories of data, such as health, religion or ethnic origin.

3.3 Where the data comes from

We collect the data only from public sources:

• publication databases, such as Crossref
• researcher and institution registries: ORCID and the Research Organization Registry (ROR)
• university and institutional repositories, and preprint servers
• grant databases of research funders
• publisher and journal websites

3.4 Predicted gender

Our software predicts gender from the first name, and the profile marks it as predicted automatically. If the prediction is not reliable, the software shows the gender as “uncertain”. Customers can use predicted gender only as an optional filter, to help them build balanced panels. We do not use gender to calculate relevance or to rank researchers. If the predicted gender is wrong, write to compliance@prophy.ai and we will correct it.

3.5 Who can see profiles

Only signed-in Users of our customers can see profiles, and they may use them only for the purposes in section 3.1. Profiles are not public, and search engines do not index them. When a User connects an AI assistant (see section 5), Prophy sends the researcher data that the User asks for to the company that provides the assistant, under the customer’s agreement with that company.

A customer that keeps researcher data in its own systems, for example after an export, is an independent controller of that copy. Under our agreement, the customer may use the data only for the purposes in section 3.1, and must delete it if you object.

3.6 No automated decisions

Prophy suggests and ranks candidates. People at our customers decide whom to contact or select. We make no decision about you that has legal or similarly significant effects by automated means.

3.7 Why we may use this data (legal basis)

We rely on our legitimate interests (Article 6(1)(f) GDPR):

• to help publishers, funders and research organizations find the right researchers for the purposes in section 3.1 faster and more accurately. This benefits researchers and the whole research community.
• to attribute publications to the correct researcher and to keep our data accurate

We have done a Legitimate Interests Assessment. We concluded that these interests are not overridden by your interests or rights, because the data is professional, already public and used only for the purposes in section 3.1, and because you can object at any time.

3.8 Why we do not contact each researcher

Contacting about 100 million researchers one by one would take disproportionate effort, and would require us to use their contact details more. Instead, we publish this information here (Article 14(5)(b) GDPR). We do not use the researcher database for our own marketing.

3.9 If you object or ask us to delete your profile

Write to compliance@prophy.ai. We will then hide your profile from all customers. We will no longer show or suggest it, also after we update the data from the sources. Please include your full name and, where possible, a link to your profile or a list of your publications so that we can identify you. We will respond within one month of receiving your request, as required by GDPR.

We cannot fully delete a profile. If we delete it, our system builds it again automatically from your public publications, and your publications can be attributed to another person. For this reason we keep your profile in our database, hidden, and we record your request so that the profile stays hidden.

3.10 How long we keep profiles

We keep a profile as long as we need it to attribute publications correctly. By default, we do not suggest researchers who have not published for 2 years.

4. Users of the Prophy platform

4.1 Customer content

Customers and their Users put content into the platform: the manuscripts, grant proposals and expert lists that they upload, and the folders, saved documents, monitorings, bookmarks, selections and search queries that they add (“Customer Data”). Uploaded documents can contain names, email addresses, ORCID iDs and affiliations of authors and experts. For Customer Data, the customer is the controller and we are a processor. We process it only to provide the Services to the customer, as the Customer Agreement and the data processing agreement describe. If your data is in such a document, contact the customer that uploaded it.

Customer Data is available only to the customer’s Users and to Prophy staff who provide and support the Services. We do not use it to train our models. We send it to an external AI service only when a User connects an AI assistant and asks Prophy tools for this data (see sections 5 and 8).

4.2 User accounts

When a customer gives you access to the platform, we process:

• your name, email address, organization, position and role
• sign-in data: your email address and a hash of your password, or your sign-in through your organization’s single sign-on
• your settings, such as the frequency, type and format of the alerts you sign up to receive
• messages that you send to our support team

We use this data to sign you in, manage access, provide the features you use, send the alerts you ask for, answer support requests and contact you about the Services. For this data, the customer is the controller and we are a processor.

4.3 Usage and technical data

When you use the Services, our systems record:

• device and connection data, such as IP address, browser type and version, operating system, error reports and performance data
• usage data, such as the features you use, the settings you select, the pages you open, and the date and time
• security logs, such as sign-ins and changes to account settings

We use this data to run and improve the Services, to find and fix errors, and to protect the Services against misuse. Our legal basis is our legitimate interest in a secure and working service (Article 6(1)(f) GDPR).

5. Prophy connector for AI assistants (MCP)

Users can connect an AI assistant, such as Claude or ChatGPT, to their Prophy account through our Model Context Protocol (MCP) server. The User signs in to Prophy, selects one organization and approves the connection. The assistant can then call Prophy tools, such as searching articles, authors and grants, finding referees, and adding a proposal to a folder. Prophy tools return only the data that the User can open in that organization in the Prophy platform. This can include researcher profiles and Customer Data, such as proposals and expert lists.

What we receive. We receive only the tool calls that the assistant sends: the name of the tool and its arguments, such as a search query, an author or article ID, or the text of a proposal that the User asks to add to Prophy. We do not receive your conversation with the assistant, the assistant’s memory, chat history or files, except the parts that the assistant puts into a tool call.

What we keep. For each tool call we keep a log record: the User, the organization, the connection, the tool, its arguments, the error (if there is one), the size of the result, the duration and the time. For a proposal that the User adds, the log keeps only the folder; the proposal itself becomes Customer Data in the customer’s folder. The assistant can also send us feedback about the tools: ratings, short notes about missing or confusing tools, and the name and version of the assistant app. We ask the assistant not to put the User’s request, manuscript text or other personal data into feedback.

When the assistant finds referees or adds a proposal, we also send a usage event to Mixpanel: the internal user number, the names of the organization and team, and the plan. The event does not contain search queries or proposal text.

Why. We use these records to apply rate limits, to protect the Services from misuse, to answer support requests and to improve the tools. Our legal basis is our legitimate interests (Article 6(1)(f) GDPR). We do not sell these records and we do not use them to train AI models.

How long. We delete tool call logs and feedback 12 months after we receive them.

Your control. A connection ends after 90 days. You can see and delete your connections on your account page, or disconnect Prophy in the AI assistant. After you delete a connection, the assistant cannot call Prophy tools for you. To delete your tool call logs earlier, write to compliance@prophy.ai.

The company that provides the AI assistant (for example, Anthropic or OpenAI) processes your conversation and the results of Prophy tools under its own terms and privacy policy, and under your organization’s agreement with it. It is not our service provider.

6. Customers, prospects and other contacts

6.1 Business contacts

We process the names, job titles, work email addresses, phone numbers and messages of people at our customers and prospective customers. We find business contact details of people at publishers, funders and research organizations on professional networks and from B2B contact data providers.

We use this data to offer our Services to organizations, and to manage contracts, invoices, support and our business relationship. Our legal basis is our legitimate interest in developing and maintaining business relationships with organizations (Article 6(1)(f) GDPR). We keep invoices and accounting records because the law requires it (Article 6(1)(c) GDPR).

Every message we send has a link to unsubscribe. We send newsletters and product news only if you agree (Article 6(1)(a) GDPR). If you unsubscribe or object, we keep your email address and the date on a suppression list, so that we do not contact you again.

6.2 Recorded calls

We may record and transcribe calls with customers and prospects using Fireflies.ai, an AI note-taking service, so that we have accurate notes. One hour before the meeting, Fireflies.ai sends each participant an email that says the meeting will be recorded, with a link to decline. If a participant clicks the link, Fireflies.ai does not join or record the meeting. During the call, Fireflies.ai is visible in the list of participants. We keep recordings for 12 months.

6.3 Payments

We bill our customers by invoice. We do not receive or store payment card details. If you pay by card, our payment provider processes them.

6.4 Job candidates

If you apply for a job at Prophy, the Prophy company that offers the job uses your CV, your messages and our interview notes only to decide about your application (Article 6(1)(b) GDPR). If we do not hire you, we delete this data 4 weeks after the vacancy closes. With your consent, we keep it for up to 1 year for other vacancies (Article 6(1)(a) GDPR).

7. Cookies and analytics

We use a cookie to keep you signed in, and cookies that are necessary for the Services to work. If you block them in your browser, you cannot sign in.

On our website and in the Prophy platform, we use Google Analytics and Mixpanel to learn how people use the Services and to improve them. We set their cookies only with your consent, which you can give or withdraw in our cookie banner (Article 6(1)(a) GDPR).

Our servers also send Mixpanel events about some actions in the platform, such as finding referees, on the basis of our legitimate interests (Article 6(1)(f) GDPR). We send Mixpanel only an internal user number and the names of your organization and team, not your name or email address.

For more information about how Google uses this data, see https://policies.google.com/technologies/partner-sites.

8. Artificial intelligence and model training

• We do not use Customer Data (see section 4.1) to train, fine-tune or improve our models.
• We do not send Customer Data to external AI providers, except when a User connects an AI assistant and asks Prophy tools for this data (see section 5). Optional features that use a large language model run on models that we host ourselves in the European Union.
• We do not use logs of the AI assistant connector to train AI models.
• We train our matching models on public scientific publications. To attribute publications correctly, our models use names and affiliations from public sources.

9. Who receives your data

• Our customers. Signed-in Users of publishers, funders and research organizations see researcher profiles (section 3.5).
• Prophy companies. Prophy Inc., Prophy B.V. and Prophy Sàrl share data to provide the Services, each only for its tasks. For the researcher database, Prophy Inc. and Prophy Sàrl act only on the instructions of Prophy B.V.
• Service providers that process data for us, only on our instructions. The main service providers are in the table below. The full list is in our list of sub-processors.

• AI assistant providers, when a User connects an AI assistant and asks Prophy tools for data (section 5). They are not our service providers.
• Authorities, only when the law requires it. We check each request and disclose only the minimum data that the law requires.

We do not sell personal data.

10. Transfers outside the European Economic Area

We store the database and files of the Prophy platform only in the European Union (Germany, Finland and the Netherlands). Our engineers and support team in Ukraine and Prophy Inc. in the USA access this data remotely to develop and support the Services. They do not keep copies on their computers. Some service providers in the USA (see section 9) and customers outside the European Economic Area (EEA), for example in the USA, also receive data. Customers outside the EEA receive researcher data only for the purposes in section 3.1.

When we send data, or give access to it, to a country without an EU adequacy decision, we use the Standard Contractual Clauses approved by the European Commission, or the recipient’s certification under the EU–US Data Privacy Framework. Write to compliance@prophy.ai to get a copy of these safeguards.

11. How long we keep data

12. Security

Prophy is certified to ISO/IEC 27001:2022, and our SOC 2 audit is in progress. We protect personal data with technical and organizational measures, including:

• encryption in transit (TLS 1.2 or higher) and at rest
• access by role and need, with multi-factor authentication
• separation of each customer’s data in the platform
• logs of access to Customer Data
• regular security tests, and backups that we can restore

You can read about our security controls and request our reports at trust.prophy.ai.

13. Your rights

You can ask us to:

• tell you what data we have about you and give you a copy (access)
• correct wrong data (rectification)
• delete your data (erasure); for researcher profiles, see 3.9
• limit how we use your data (restriction)
• give you your data in a common format (portability)

You can object at any time to processing based on our legitimate interests, including your researcher profile (Article 21 GDPR). If you gave consent, you can withdraw it at any time. This does not change the lawfulness of processing before you withdrew it.

Write to compliance@prophy.ai. We answer within one month. We may ask you to confirm your identity. If your request is about Customer Data, we send it to the customer, because the customer is the controller of that data.

14. Complaints

You can complain to a data protection authority. Our lead authority is the Autoriteit Persoonsgegevens (Netherlands), autoriteitpersoonsgegevens.nl. You can also complain to the authority in the country where you live or work, or where you think the infringement took place.

15. Children

The Services are for professionals. You must be at least 18 years old to use them. We do not knowingly collect data of children.

16. Changes to this policy

We update this policy when our processing changes. We show the date of the last change at the top. If we make important changes, we inform our customers.