Privacy Policy

My BP Lab Privacy Policy 

Effective date: 2018-03-15

Researchers from the University of California San Francisco (UCSF) and Sage Bionetworks, a 501(c)(3) nonprofit biomedical research organization in the United States, have developed a mobile application (the “My BP Lab App”) to measure stress and blood pressure as part of the My BP Lab research study.  The goal of this study is to examine how stress and daily experiences affect physiology and health. This research is led by Dr. Wendy Berry Mendes from UCSF and sponsored by Samsung Electronics Ltd and the Sarlo-Ekman endowment.

If you volunteer in this study we will ask you to use the My BP Lab app. You can learn more about the study on the study website.  

UCSF and Sage Bionetworks are committed to protecting the privacy of the users of the My BP Lab app. This privacy policy tells what we will do with the information we collect from you through the App.

By joining the study, or using the My BP Lab app, you agree to this Privacy Policy. 

“Personal information” means any information about you that reasonably can be linked to you such as your name and contact information. 

Information We Collect

In general we collect all information that you give us directly. For example, you may contact us with questions or comments and give us your email address and other information.  We only use such information to answer your questions.  We also collect information passively when you use the My BP Lab app. 

●      Standard log and usage data. We collect information about how you use the My BP Lab app. For example, the pages you access or the date and time you sign in. 

Before you can participate, you must download the app on your smartphone and register to the study. We will collect information from you through the My BP Lab app as part of the registration and when you use the app for the study. Here is a list of what we will collect and when we will collect it.

As part of the registration you must complete the informed consent process and create an account.  

●      Informed consent: The informed consent process explains the research study. You must consent to join the study. We will collect your first and last name as your electronic signature as part of the informed consent process.

●      Account registration: You must create your personal study account. When you create an account, we collect your email address. We ask your age, gender and other information for your study profile. The study is designed for people age 18 or older. We do not knowingly allow people under the age of 18 to join the research study.  

Once you join the study, we will collect information about your activities such as sleep, exercise, and experiences such as your stress levels and emotions you report throughout the day. 

●      Health behaviors. As part of the research study, we collect information about you. We ask you about your health behaviors (like exercise and smoking) and stress levels. Most of these questions are optional. Few questions are required. For example, to be eligible for the study you must be 18 or older so your age is a required question.  

●      Information imports. As part of the research study we will import information into the My BP Lab app. For example, we will ask you to measure your blood pressure. We will import the measurement from the sensors in your smartphone into your research record.

●      Location data. We will ask whether you are at home or work, but we do not collect your actual location.

We will NOT access your personal contacts, photos, text, or email messages on your smartphone. We will only collect information that you give to the My BP Lab app.

How We Use Information

In addition to using the data for scientific research, we will use the information that we collect through the My BP Lab app to ensure that it is working properly and to make it easier to use. For example, remembering information you have entered so it does not need to be re-entered.

We may use personal information, like your name and email address, to contact you. Some examples of why we might contact you are for administrative purposes or to respond to questions and provide usage support.

We will NOT use your personal information for advertising. 

How We Process Information

We process the information we collect through the My BP Lab app. Here are the steps we will take to process your information:

1.    We will separate your account information like your name and email address from your study data like your answers to surveys and measurements. 

2.    We will assign you a random study number. We will add this number to your study data. The key that links the number to your name is kept in a separate, secure location. 

3.    We will aggregate the study data from all participants (without names) into a single dataset. This dataset is what we use for research purposes. 

Why We Disclose Information

We will disclose (give out) information that we collect through the My BP Lab app for five reasons. We tell you about these reasons below. Other than as described below, we will not sell, rent, lease, give away, disclose or share your personal information without your permission.

Five reasons we disclose information:

1.     We will store the research data we collect on Synapse. Synapse is a cloud-based research platform. Researchers from the sponsor, the study team and research partners will access and analyze the data. 

2.     If we work with a service provider, we will give them the information they need to do the job we have asked them to do. A service provider is someone who is helping us conduct the research study. The service provider will have to sign a contract promising to use the information only for the job they are doing for us. Also, they will promise to keep the information we share with them secure.

3.     We may give out information if we are required to do so by law. For example, to comply with state or federal laws, in response to a court order, subpoena or warrant, or to cooperate with law enforcement or other governmental agencies.

4.     We may give out information:

o      To protect ourselves against liability

o      To protect ourselves from fraud, abuse, or unlawful activity

o      To investigate and defend ourselves against claims or allegations

o      To protect the My BP Lab app and research study

o      To protect our rights

5.     The information we collect from you as part of the My BP Lab study may be considered a business asset. Business assets are the things that give a business value. If Sage Bionetworks goes bankrupt or merges, is transferred, or acquired by another institution, the information may be transferred as a business asset.

Once the initial study is complete, we may publish the findings in reports and/or peer reviewed scientific journals. Your name will not appear. Scientific findings are sometimes picked up by general media and can be disseminated broadly. The data that are used to write those reports will be made available publicly so other researchers can confirm the findings. These data cannot be traced back to an individual. The study data (responses to survey questions, activity measurements, etc) will be added to a shared dataset on the Sage Bionetworks Synapse (www.synapse.org) and possibly on other research data repositories. This shared dataset will be made available to qualified researchers. Qualified researchers are registered Synapse users who agree to use the data in an ethical manner, to do no harm and not attempt to re-identify or re-contact you unless you have chosen to allow them to do so. The sponsor and study team will have no oversight on the future research that qualified researchers may conduct with the coded study data. For more information about our data practices in the context of the Synapse research platform, see the Synapse Privacy Policy.  

Do Not Track

We do not track people who use the My BP Lab app or visit the study website. Because we do not track people, the My BP Lab app does not respond specifically to Do Not Track (“DNT”) signals.

Data Security

We take data security very seriously. We use systems and procedures to protect the information we collect from you. This is to safeguard the confidentiality, integrity, and security of your information. These systems and procedures help us prevent accidental or unlawful loss, theft, and misuse. They help us prevent unauthorized access, disclosure, alteration, destruction, or any other type of unlawful processing. For instance, we separate the information that identifies you, like your name, from your study data. We keep the information that identifies you in a separate, secure place. Still, experts in re-identification may be able to reverse our processes and figure out who you are. We cannot promise that the information we collect from you is completely secure or that you will remain anonymous.

Your Rights and Choices

You have rights and choices about the information we collect from you. For example, if there is an error in the information we collect from you, you have the right to make a request to have it fixed. 

To make a request about the information we collect from you, email us at 

BPLab@ucsf.edu. Please note that we may keep a copy of all the information we collect from you. This is because we have a responsibility to keep backups and archives. We keep backups and archives for reasons like the prevention of fraud and abuse, analytics, and for satisfaction of legal obligations.

You can withdraw from (quit) the study at any time. If you would like to withdraw, you can delete the app from your phone or simply stop using it. It does not cost anything to withdraw. 

If you have questions about your rights and choices or would like more information about your rights and choices, you can email us at BPLab@ucsf.edu

Cross-Border Transfer of Your Information

We may transfer the information you share with us to countries where you do not live. These countries may have different data protection laws than where you live. If we transfer your information, we will follow the laws about transferring data. 

If you access the My BP Lab app or participate in the study from anywhere outside of the United States, we may transfer your data. The information we collect may be transferred to, processed, and stored in the United States. 

By using the My BP Lab app or participating in the study, you consent to these types of cross border transfers of your information.

Updates to this Privacy Policy

We may update this Privacy Policy. We will post any updates here, on this page with a revision date. Also, if we make major changes that alter your rights or obligations, we will try to tell you directly. For example, we may send you an email or put a pop-up message in the app. If you participate in the study or use the My BP Lab app after we update the Privacy Policy it means you agree to the updated Privacy Policy. 

Contact

If you have any questions, comments or requests, please contact us.

UCSF Laurel Heights Campus
3333 California Street
San Francisco, CA 94118

Sage Bionetworks
1100 Fairview Avenue North
Seattle, WA. 98109
United States

Versions

Here is a list of the versions of this Privacy Policy:

Version 1 (2018-03-15)