How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
Carebox
GDPR evidence
Patients, families, and their treating physicians find treatment options only available in clinical
No public evidenceCarebox and GDPR
CertReports found no public GDPR evidence for Carebox as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 31 Aug 2017
- Scope
- Carebox helps patients and their caregivers find treatment options in clinical trials. We do this through patient-facing websites and a contact center staffed by trained agents. Our services are free to patients and are paid for by clinical trial sponsors and other stakeholders in clinical research. Personal data we receive in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF falls into two groups: Patient and caregiver data. Most use of our websites is anonymous, and a visitor does not need to identify themselves in order to search for clinical trials. When a person chooses to use a feature that requires identification, we receive the information that person provides. Those features are registry sign-up, submitting a referral to a clinical research site, requesting contact from our contact center, and the resulting contact center activity. The data consists of contact details (name, email address, phone number, location) together with the health-related information the person chooses to share so that we can assess which trials they may be eligible for. We use it to match the person to potentially suitable clinical trials, to act on a request to be referred to a research site, and to follow up on that request. Research site staff data. We receive business contact details (names, phone numbers and email addresses) for staff at the clinical research sites that run the trials. We use this to direct each patient referral to the correct contact at the right site and to manage the referral workflow through to completion. As to onward disclosure, we disclose patient and caregiver information only to a clinical research site, and only where the individual has specifically asked us to refer them to that site. We do not disclose patient or caregiver information to trial sponsors. We also use service providers acting on our behalf under contract, including hosting, communications and customer relationship management providers, which process the data only as instructed by us.
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Carebox GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 18 Sep 2026First indexed by CertReports1 evidence row across 1 framework entered the index.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Healthcare category) whose GDPR row is verified or vendor-stated, ranked by similarity.
No Healthcare vendor has GDPR evidence in the index yet.
Understand GDPR evidence
All articlesExplainers
The EU-US Data Privacy Framework, explained for vendor reviews
Solomon Amos · 7 Sep 2026 · 10 min read