Terms of Service

These Terms of Service ("Terms") govern your access to and use of Nexrial CTMS ("the Service"), operated by Purple Directive ("we," "us," or "Nexrial"). By creating an account or using the Service, you agree to these Terms on behalf of yourself and the organization you represent ("you" or "Client").

If you do not agree to these Terms, do not use the Service.

1 Service Description

Nexrial is a multi-tenant, cloud-based Clinical Trial Management System (CTMS) designed for clinical research sites. The Service provides tools for managing study documentation, delegation logs, protocol deviations, subject tracking, investigational product accountability, monitoring visits, audit trails, and related regulatory compliance workflows.

The Service is built and operated by Purple Directive (purpledirective.com). Each subscribing organization ("tenant") receives a dedicated subdomain (e.g., yoursite.nexrial.com) with logically isolated data.

The Service is intended for use by licensed clinical research professionals operating under applicable regulations including 21 CFR Part 11, ICH E6(R3) Good Clinical Practice guidelines, and applicable sponsor or IRB requirements. It is not a substitute for professional judgment, regulatory expertise, or legal counsel.

2 Account Responsibilities

As the Client, you are responsible for:

• Providing accurate registration information and keeping it current.
• Maintaining the security of all user credentials within your organization. Shared credentials are not permitted.
• All activity that occurs under your account, whether authorized or not.
• Ensuring that everyone you authorize to use the Service has read and agrees to these Terms.
• Promptly notifying us at [email protected] if you become aware of any unauthorized access to your account.

We are not liable for losses caused by unauthorized use of your account where you failed to take reasonable steps to protect your credentials.

3 Acceptable Use

You may use the Service only for lawful clinical research management purposes. You agree not to:

• Use the Service to store or process data you are not legally authorized to handle.
• Attempt to access another tenant's data or circumvent any access controls.
• Upload malicious code, conduct denial-of-service attacks, or otherwise interfere with the Service.
• Reverse-engineer, decompile, or create derivative works from any part of the Service.
• Resell, sublicense, or provide access to the Service to unauthorized third parties.
• Use the Service in any manner that violates applicable laws, regulations, or sponsor/IRB requirements.
• Remove or alter any proprietary notices, branding, or attribution within the Service.

We reserve the right to suspend accounts that violate this policy, pending investigation, without prior notice where necessary to protect the integrity of the Service or other users' data.

4 Data Ownership

You own your data. All study data, subject records, documents, audit logs, and other content you upload or create within the Service ("Client Data") remains your sole property. We claim no ownership rights over Client Data.

By using the Service, you grant us a limited, non-exclusive, non-transferable license to store, process, and display Client Data solely as necessary to provide, maintain, and improve the Service for your organization. This license ends when your subscription ends, subject to the retention obligations described in Section 10.

We will not use Client Data for any purpose other than operating the Service on your behalf. We will never sell, rent, or commercially exploit Client Data.

5 PHI and HIPAA Compliance

Nexrial is designed to support HIPAA-covered activities. If your use of the Service will involve Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"), the following conditions apply:

• BAA required. You must execute a Business Associate Agreement (BAA) with Purple Directive before uploading, entering, or otherwise processing any PHI in the Service. Do not enter PHI until a BAA is in place.
• Security safeguards. PHI stored in Nexrial is encrypted at rest using AES-256-GCM and in transit using TLS 1.2 or higher. Access is role-based and audit-logged.
• No offshore processing. Client Data, including PHI, is stored and processed exclusively on our dedicated infrastructure. We do not use shared public cloud services to process PHI without appropriate contractual protections.
• Your obligations. You remain the HIPAA Covered Entity (or Business Associate, as applicable). You are responsible for ensuring that your use of the Service complies with HIPAA, your IRB requirements, applicable sponsor agreements, and any other regulatory obligations.

To request a BAA, contact [email protected].

6 Service Availability

We make reasonable efforts to keep the Service available and perform scheduled maintenance during off-peak hours. We do not guarantee any specific uptime percentage except under a separately executed Enterprise Service Level Agreement.

We are not responsible for downtime caused by circumstances outside our reasonable control, including internet outages, third-party service failures, acts of God, or government actions.

We will make reasonable efforts to provide advance notice of planned maintenance windows via the email address on file for your account. Emergency maintenance may occur without advance notice where required to protect service security or integrity.

7 Limitation of Liability

To the maximum extent permitted by applicable law:

• The Service is provided "as is" and "as available." We make no warranties, express or implied, as to fitness for a particular purpose, merchantability, or uninterrupted access.
• In no event will Purple Directive be liable for indirect, incidental, special, consequential, or punitive damages, including loss of revenue, loss of data, or business interruption, even if advised of the possibility of such damages.
• Our total aggregate liability to you for any claim arising under or related to these Terms or the Service will not exceed the total fees paid by you to us in the twelve (12) months preceding the claim.

Some jurisdictions do not allow exclusion of certain warranties or limitation of certain damages. In those jurisdictions, the above limitations apply to the fullest extent permitted by law.

8 Indemnification

You agree to indemnify, defend, and hold harmless Purple Directive and its officers, employees, and agents from any claims, damages, liabilities, costs, and expenses (including reasonable legal fees) arising from:

• Your use of the Service in violation of these Terms.
• Your violation of any applicable law or regulation, including HIPAA.
• Any data you upload or process through the Service, including any claim that such data infringes third-party rights.
• Any breach of your representations or obligations under these Terms.

We reserve the right to assume exclusive defense and control of any matter subject to indemnification by you, at your expense. You agree to cooperate with our defense of such claims.

9 Termination

Either party may terminate the subscription agreement with 30 days' written notice to the other party. Notice to us must be sent to [email protected]. Notice to you will be sent to the email address on file for your account.

We may suspend or terminate your access immediately, without notice, if:

• You materially breach these Terms and fail to cure the breach within 10 days of written notice.
• You engage in conduct that threatens the security, integrity, or legal standing of the Service or other tenants.
• We are required to do so by applicable law or court order.

Upon termination, your access to the Service will be disabled. Fees paid are non-refundable except where termination is due to our material breach.

10 Data Export on Termination

You have the right to your data. Prior to or upon termination of your subscription, we will provide you with a complete export of your Client Data in a machine-readable format (CSV, JSON, or PDF, depending on record type) upon request.

You may request an export at any time during your active subscription. To initiate a data export, contact [email protected].

Following the termination of your subscription, we will retain your data for 90 days to allow you to request an export. After this period, data will be securely deleted from active systems. Encrypted backups may be retained for a longer period as required by applicable law or our standard backup rotation schedule, but will not be accessed or restored for any purpose other than legal obligation.

11 Governing Law

These Terms are governed by and construed in accordance with the laws of the State of New York, United States, without regard to conflict of law principles.

Any dispute arising from or relating to these Terms or the Service that cannot be resolved informally will be subject to the exclusive jurisdiction of the state and federal courts located in New York. Both parties consent to personal jurisdiction in those courts.

Before initiating any formal legal proceeding, both parties agree to make a good-faith effort to resolve disputes through direct negotiation for at least 30 days.

12 Changes to These Terms

We may update these Terms from time to time. When we make material changes, we will notify you by email to the address on file and by posting the updated Terms at nexrial.com/terms at least 30 days before the changes take effect.

Your continued use of the Service after the effective date of the revised Terms constitutes your acceptance of the changes. If you do not agree to the updated Terms, you may terminate your subscription under Section 9 before the effective date.

Minor changes that do not materially affect your rights (such as corrections, clarifications, or formatting updates) may take effect immediately.

13 Contact

If you have questions about these Terms, please contact us: