When you join a study, you are trusting a research team with real health data. TrialPilot is built so that trust has limits you can see: study teams work with your study data, but not with who you are.
The word for this is de-identified: your study data is separated from the details that identify you, like your name and email, before a researcher ever sees it.
What researchers see — and don't#
Inside a study, you appear to the research team as a study-scoped code, like P-0001 — never as your name or email. That code has some deliberate properties:
- It stays the same within your study, so researchers can follow your progress over time as one consistent participant.
- It changes between studies. If you join two studies, you get a different code in each, so your participation cannot be linked across studies.
- It cannot be traced back to you. The code does not reveal your account or identity.
Researchers never see:
- Your name or display name.
- Your email address or password.
- Your exact birth date — studies see an age range instead.
- Details that could quietly narrow you down, like your exact time zone or exact device model. These are generalized before a researcher sees them.
In small studies, TrialPilot may go a step further: even coded individual views can be held back until enough people have joined. When very few people are enrolled, a coded record is easier to guess at — so the study team sees less until the group is big enough to protect everyone in it.
What you share is scoped to your study#
A study only receives the categories of data it asked for and you agreed to during consent. Joining a study does not open up everything on your phone.
You can check this yourself at any time: open More > Health data to review which data categories are shared with your study. The same screen lets you open your phone's own health app to adjust permissions, or stop syncing on your device.
If you join the research registry#
TrialPilot may offer a research registry — a way to hear about studies you might be a fit for. If you join one, the registry makes specific promises about how you can be found and contacted:
- Researchers see counts, not identities. A research team searching the registry sees how many people match — for example, “42 people match this study” — never a list of who those people are.
- TrialPilot sends the invitations. Researchers never get your contact details. If a study matches, TrialPilot delivers the invitation, and you decide whether to respond.
- You are contacted at most once every two weeks. Joining a registry never means a flood of messages.
Your controls in More#
The More tab holds the controls for your account and your data:
| Control | What it does |
|---|---|
| Download your data | Prepares your data as a JSON file (a plain, machine-readable text format) and opens it in your device's save/share dialog, so you can keep or move your own copy. |
| Delete your account | Permanently removes your TrialPilot account, profile, study data, and app data from the device. Deletion needs an internet connection. |
| Notifications | Manage notifications and reminder times, so the app only nudges you in ways you chose. |
| Email updates | Manage which emails you receive from TrialPilot. |
| Sign out | Signs you out of the app on this device. |
Deletion is permanent
The deeper explanation#
This page covers what privacy looks like from your side of the app. For a fuller explanation of how TrialPilot separates identity from study data — pseudonyms, de-identified views, and small-group protections — see Privacy and de-identification.