Privacy Policy

Regway is software for preparing FDA medical device submissions. It researches FDA's public records, and helps you draft, review and export submission documents. Regway is operated by [Legal entity name, registered address] ("Regway", "we", "us").

This policy covers regway.ai, the Regway web application, client review links and the Regway API (together, the "Service"). It explains what personal data we handle, why, and the choices you have.

For any privacy question or request, email hello@regway.ai.

Account data

Your name, email address and password. We store passwords only as a one-way bcrypt hash.

Organization data

Your organization's name, account type (for example manufacturer or consultancy), team memberships and roles, client names you file projects under, and branding you upload (firm name, colour and logo).

Content you provide

Everything you put into a project: device descriptions, uploaded documents such as test reports, labelling and design files, chat messages, notes, drafts, and anything Regway generates for you. If you are a consultancy, this can include your clients' information. We call all of this Customer Content.

Client reviewer data

When someone comments through a client review link, we store the name and (optional) email address they enter, and their comments or approvals.

Usage and technical data

For each sign-in session we store the IP address and browser user agent. Our servers keep standard request logs. We record how many AI runs your organization uses so we can apply trial limits, and when each API key was last used.

Cookies and browser storage

A small set of strictly necessary cookies and browser storage entries, listed in section 8.

• To provide the Service: run research, drafting and review on your projects, store your files, export documents, and serve review links and API requests you set up.
• To secure it: authenticate users, detect abuse, apply rate limits, and investigate incidents.
• To support you: answer questions and fix problems you report. Where support needs access to a project, we only look at what is needed to resolve the issue.
• To run the business: apply plan limits, and send service and account messages.
• To meet legal obligations and to enforce our Terms of Service.

We don't use Customer Content for marketing, and we don't use it to train AI models (see section 5).

If the GDPR or UK GDPR applies to you, we rely on these legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to keep the Service secure, prevent abuse, and improve reliability. We balance these against your rights.
• Legal obligation: where the law requires us to keep or disclose information.
• Consent: only where we ask for it, and you can withdraw it at any time.

For Customer Content that a consultancy uploads about its clients, the consultancy decides the legal basis. We process it on their instructions (see section 13).

Regway uses large language models to analyze your device, search FDA records and draft submission sections. To do that, relevant parts of your Customer Content (for example a device description, extracted document text, or your chat message) are sent to our AI providers through their business APIs:

• Anthropic (Claude models) reads the context of a request and writes the response, drafts and analysis.
• OpenAI (embedding models) turns short search text, such as a device description or query, into vectors so we can find similar FDA records.

AI output can be wrong or incomplete. Every draft is a starting point for a qualified person to review; see the Terms of Service.

Regway can also remember short project facts (for example "we sterilize with EtO") so later steps stay consistent. These memories belong to your organization, are scoped to a project by default, and you can view and delete them in the app.

We use a small number of service providers to run Regway. Each one processes data only to provide its service to us.

Cloudflare hosts our DNS records. Site traffic and Customer Content don't pass through Cloudflare.

We will update this list before we add a subprocessor that handles personal data, for example a payment processor when paid plans launch. Customers with a DPA can ask to be notified of changes.

We share personal data only in these cases:

• With the subprocessors above, to run the Service.
• When you share it. Client review links and shared document links show the content you choose to anyone who has the link. The API returns your organization's project data to whoever holds a valid API key.
• Within your organization. Other members of your organization can see organization-level information, such as clients, branding and settings, according to their role.
• For legal reasons: to comply with a valid legal request, or to protect the rights, safety and security of our users and the Service. Where allowed, we'll tell you first.
• In a business transfer such as a merger or acquisition, in which case this policy continues to apply to your data.

We only use what the Service needs to work. There are no analytics, advertising or third-party cookies, so there is no cookie banner.

Fonts are served from our own domain, so loading a page doesn't contact Google or other font services.

• Account and organization data is kept while your account is active.
• Deleted projects. When you delete a project, it leaves your lists right away and you can restore it with Undo. We keep its data until you ask us to delete it permanently, or until your organization is deleted.
• Review links expire after 30 days by default (90 days at most), and you can revoke them at any time.
• API keys stop working as soon as you revoke them.
• Deleting your organization. Email hello@regway.ai from an owner's address. We delete the organization with its projects, documents, uploaded files, clients, review links, API keys and memories within 30 days, and confirm by email. Export anything you need first.
• Backups. Deleted data can remain in database backups for [backup retention period] before it is overwritten.
• AI providers keep request data only for the limited period their API terms allow.

We may keep limited records longer where the law requires it, for example invoices once billing starts.

We protect your data with these measures, which are in place today:

• Encryption in transit. All traffic to regway.ai and api.regway.ai uses TLS, and the API enforces HTTPS with HSTS.
• Tenant isolation. Every request is scoped to your organization in the application, so one organization can't read another's projects, files or API data.
• Credentials stored safely. Passwords are hashed with bcrypt. Refresh tokens and API keys are stored only as SHA-256 digests, so we can't read them back. Application secrets are kept in encrypted credentials, not in source code.
• Scoped, revocable API keys. API keys are read-only, belong to one organization, are shown only once, and can be revoked instantly.
• Rate limiting on sign-in, sign-up, password reset, AI requests, the API and public links, to slow down abuse and brute-force attempts.
• Unguessable public links. Review links use 32-byte random tokens, expire, and can be revoked.
• Storage. Uploaded files are stored in Amazon S3, which encrypts stored objects at rest.
• Restricted access. Production access is limited to the people who operate Regway, and the internal admin panel only admits an allowlist of named accounts.

No system is perfectly secure. If we learn of a breach that affects your personal data, we will notify you and any regulators as the law requires. To report a vulnerability, email hello@regway.ai.

Regway and its subprocessors store and process data in the United States. If you are outside the US, your data will be transferred there.

For transfers from the EU, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or another valid mechanism, which we include in our DPA.

Depending on where you live, you can ask us to:

• Access the personal data we hold about you.
• Export it. You can export submission documents from the app at any time (PDF, Word or Markdown), and we'll provide your other data in a portable format on request.
• Correct inaccurate data. You can edit most of it in the app.
• Delete your data (see section 9).
• Object to or restrict some processing, and withdraw consent where we rely on it.

Email hello@regway.ai. We respond within 30 days and may need to verify your identity first. You can also complain to your local data protection authority.

If your data was uploaded by a consultancy or another organization, we'll pass your request to them, because they control that data.

California residents (CCPA)

You have the right to know, delete and correct personal information, and not to be discriminated against for exercising these rights. We don't sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics about you.

Many Regway customers are regulatory consultancies that work on behalf of medical device companies, and upload their clients' documents.

• Roles. For Customer Content, the customer organization is the controller (or acts for its client), and Regway is a processor. We process that content only to provide the Service, on your instructions.
• Your responsibilities. You confirm you have the right to upload client data and to share it through review links.
• Separation. Each project can be filed under a client. Client data stays inside your organization and is never shared with other Regway customers.
• DPA. A Data Processing Agreement is available on request. Email hello@regway.ai.

For account data such as your users' names and emails, Regway is the controller.

Regway is a professional tool and isn't meant for anyone under 18. We don't knowingly collect data from children. If you think a child has given us data, contact us and we'll delete it.

We'll update this policy as the Service changes, and change the date at the top. If a change is significant, we'll tell account owners by email or in the app before it takes effect.

Email hello@regway.ai for privacy questions, data requests or a DPA.

Postal address: [Legal entity name and registered address]

EU / UK representative: [to be confirmed, if required]