Privacy

Privacy policy

Last updated 7 October 2026

MDtalent is a product of PharmaTalent, an executive-search firm for pharma and biotech. This page explains, in plain words, what we collect about you, why, who helps us, how long we keep it, and how you stay in control.

In short

Two separate choices, both optional: whether you join PharmaTalent's talent pool, and whether PharmaTalent presents you to its clients. You can stop either at any time, and you keep your tools.
We never sell your data, and our clients never get it without your consent.
You can download everything we hold about you, or delete your account, from your account page.

Who is responsible

PharmaTalent is the data controller: PHARMATALENT EUROPE INC. S.R.L., Romanian company, tax ID (CUI) 44256478, Bucharest, Romania. MDtalent is PharmaTalent's product; when this page says "we", it means PharmaTalent.

For anything about your data, write to dpo@pharmatalent.com. It reaches our Data Protection Officer.

What we collect

Your sign-in: Your e-mail address, when you signed up and last signed in. There is no password.
Your CV and what it says: The file you upload (PDF or Word), and what our tools read from it: your positions, education, publications, trials.
Public professional information: Your publications on PubMed, your trials on ClinicalTrials.gov, your public LinkedIn profile, and public web pages about your career (news, appointments). We look for them to build your profile.
What you add to your profile: The address of your LinkedIn profile and the PubMed papers you tick as yours. To show you your papers, we search PubMed (the US National Library of Medicine's public database) with your name or the words you type; PubMed receives the search (your name, and the words you type), not your account or your e-mail.
Your client profile: The profile we write so PharmaTalent can present you to its clients, and every change you make to its words.
Your answers: What you tell us when you strengthen your CV (for example the role you want next).
Your tailored CVs: The job descriptions you paste, the CVs we tailor to them, and the changes you make to each one.
Your applications: The jobs you tell us you applied to: the role, the company, the date, the CV you sent, where it stands, your notes, and the interview briefs our AI coach prepares for you from them. When you give us a LinkedIn job's address, we read that public job posting to fill in its details.
Your choices: Whether you joined the talent pool ("Contact me") and whether you want to be presented to clients ("Present me"), each with the exact wording you agreed to and when.
Your plan and billing: Free or Pro. If you subscribe, Stripe, our payment processor, handles the payment: your card details go straight to Stripe and we never see them. We keep only your Stripe customer number and the state of your subscription (monthly or yearly, active, renewal or end date). Your invoices are issued and kept by Stripe.
Security logs: Which feature you used and when, so we can protect your account and the service.

We do not ask for, and never use, your age, photo, nationality, gender or health.

Why we use it, and on what legal basis

To give you the tools (contract): Your account, My CV, tailored CVs, your applications, your client profile, Publication Push and the jobs board. We need your data to provide what you signed up for.
To keep you in PharmaTalent's talent pool (your consent): Only if you tick "Contact me": PharmaTalent's consultants may then find your profile in their searches and contact you about opportunities that fit. It is optional: you can upload your CV and use every tool without it. Your profile stays in the pool for 24 months without activity on your account. You can leave at any time from your client profile or your account; leaving also stops any presentation to clients.
To present you to PharmaTalent's clients (your consent): Only if you tick "Present me", a separate choice from "Contact me" and only possible with it: PharmaTalent may then present your profile to its clients when a role fits. It is optional too. You can withdraw at any time from your client profile or your account; it stops future presentations and does not affect those made before.
To keep the service safe and improve it (legitimate interest): Security logs, fraud prevention, fixing errors, and understanding which features help members. We keep this to the minimum.
To bill Pro (contract): Your subscription, its renewals and cancellation, through Stripe.
To meet the law (legal obligation): Invoices and accounting records if you pay for Pro, and answering lawful requests from authorities.

PharmaTalent's consultants also research the market for their searches, sometimes before you join, from public professional sources. That research is PharmaTalent's legitimate interest as an executive-search firm, and you can object to it at any time (see your rights, and "If PharmaTalent found you through its research" below).

AI and automated processing

Our tools use AI to read your CV, draft your client profile, tailor your CV to a job and prepare you for an interview. These are drafts: you check them and change their words before you use them.

No decision with a legal or similarly significant effect on you is made automatically. A PharmaTalent consultant, a person, decides who is presented to a client, and always with your consent.

We never judge or present anyone on age, appearance, nationality, gender or health.

Data outside the European Union

Your account, your CV and your profile are stored in the EU (Frankfurt, Germany). Some of the companies above are in the United States. When your data goes to them, it is protected by the European Commission's Standard Contractual Clauses and, where the company is certified, the EU-US Data Privacy Framework.

Vercel: Standard Contractual Clauses and the EU-US Data Privacy Framework.
Anthropic: Standard Contractual Clauses (Anthropic's Data Processing Addendum); not used to train models under our commercial terms.
Stripe: Standard Contractual Clauses and the EU-US Data Privacy Framework.
Resend: Standard Contractual Clauses.
Firecrawl: Standard Contractual Clauses.
RapidAPI (LinkedIn data provider): Standard Contractual Clauses.

Ask us at dpo@pharmatalent.com for a copy of these safeguards.

How long we keep it

Your account and everything in it: while your account is open, then deleted after 24 months without a sign-in.
Security logs: 12 months.
A sign-up whose code was never used: deleted after 7 days.
Invoices and payment records: 10 years, as accounting law requires. Your Stripe customer number and subscription state are kept with your account and deleted with it; Stripe keeps the invoices.
Once you delete your account, it is deleted at once, except the few things listed under "Delete your account" below.
If you joined the talent pool ("Contact me"), your profile stays in it for 24 months without activity on your account, or until you leave it.

Your rights

You can, at any time and for free:

See your data (access): Download everything we hold about you from your account page: "Download my data".
Take it with you (portability): The download is a standard file (JSON) you can give to another service.
Correct it (rectification): Change your profile and your client profile's words yourself, or write to us.
Delete it (erasure): Delete your account from your account page, or write to us.
Limit it (restriction): Ask us to stop using your data while a question is settled.
Object: Ask PharmaTalent to stop contacting you or presenting you, including from its own research. We then stop.
Withdraw your consent: Leave the talent pool ("Contact me") or stop being presented to clients ("Present me"), each on its own, from your client profile or your account. It takes effect within minutes, and you keep your tools.
Complain: To a data protection authority, for example the ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), Romania (https://www.dataprotection.ro), or the authority where you live or work.

For anything you cannot do yourself, write to dpo@pharmatalent.com. We answer within one month (two more months for complex requests, and we tell you if so), and may ask you to confirm it is you.

Delete your account

If you have a Pro subscription, deleting your account cancels it, so you are not charged again.

"Delete my account" on your account page deletes, at once: your sign-in, your CV files, what you declared and answered, your client profile and its words, your tailored CVs and the job descriptions you pasted, your applications, your publication list, and the profile card made from your CV.

We keep only what we must:

A record that you asked for deletion and withdrew your consent, so we keep honouring it.
What PharmaTalent's consultants found about you independently (for example your public LinkedIn profile), hidden from our searches and never presented. Write to us and we erase it too, unless the law requires us to keep it.
Security logs without their content, for 12 months.
Invoices, if you paid, as the law requires; your billing records stay with Stripe.

Cookies and storage on your device

We use only what the site needs to work. No advertising, no analytics, no tracking across sites, so we do not ask for cookie consent.

sb-…-auth-token (cookie): Keeps you signed in. Set when you sign in, removed when you sign out.
pt-last-email (this browser): Fills in your e-mail the next time you sign in on this device. Removed when you sign out.
pt-start, pt-claim, pt-apply:… (this tab only): Remember where you are in the sign-in, and that you clicked Apply on a role; cleared when the tab closes or you sign out.
mdt-cv:… (this browser): Your choices for My CV: its layout, the lines you hid, and the words you rewrote. Kept on this device only, and removed when you sign out.
mdt-cookie-notice (this browser): Remembers that you closed the cookie notice.

Our fonts are served from our own site, so loading a page does not contact a third party.

If PharmaTalent found you through its research (not through MDtalent)

This part is for professionals PharmaTalent found itself, for example in a search for a client, whether or not you ever used MDtalent. If you received a message from one of our consultants, this is where it came from.

Why: PharmaTalent is an executive-search firm for pharma and biotech. When a company asks us to find a leader for a role, we map the professionals whose experience fits it, compare their careers with the role, and contact the people who fit best to ask whether they would like to hear more. Searches are confidential.
What we use: Professional information only: your name, your current and past roles and employers, your education and your location as published on your LinkedIn profile, your publications on PubMed, your trials on ClinicalTrials.gov, public web pages about your career, and our consultants' notes on how your experience fits a search. We do not use, and never judge anyone on, age, appearance, nationality, gender or health.
Where it comes from: LinkedIn, through our consultants' LinkedIn Recruiter accounts; PubMed and ClinicalTrials.gov; and public web pages. We did not get it from you, which is why we tell you here.
Legal basis: PharmaTalent's legitimate interest in running executive searches and offering career opportunities to the professionals concerned. We keep to professional information, and you can object at any time: we then stop.
Who sees it: PharmaTalent's consultants, and the client of a search you fit: in confidence, the client receives the search's long list (your name, current role, employer, location and LinkedIn address, with our consultants' assessment of the fit). Nobody else. We never sell your data.
How long we keep it: 24 months after the last search in which a consultant considered you, then deleted

These companies process this data for us, under contract and only on our instructions:

Supabase: Database where the research is stored. EU (Frankfurt, Germany).
Render: Our servers that run the research tool. EU (Frankfurt, Germany).
Anthropic: AI reading of professional profiles against a search's requirements, and drafts of first messages that a consultant reviews. United States (Standard Contractual Clauses).
Unipile: The connection to our consultants' LinkedIn Recruiter accounts, used to run searches and send messages. [Unipile's country and transfer safeguard, TO CONFIRM].
Firecrawl: Public web search about professional careers. United States (Standard Contractual Clauses).
RapidAPI (LinkedIn data provider): Reading public LinkedIn profiles. United States (Standard Contractual Clauses).

To object, or to see, correct or delete what we hold about you, write to dpo@pharmatalent.com. If you object, we stop contacting you and stop using your data in our searches; we keep only your LinkedIn address and a note of your objection, so that we keep honouring it if your profile comes up again. Your other rights are the same as for members (see "Your rights" above), including complaining to the ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), Romania.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects what you agreed to, we ask you again.

Contact

PharmaTalent, Bucharest, Romania. E-mail: dpo@pharmatalent.com.