These "Privacy Highlights" provide an overview of some core components of our data handling practices. Please be sure to review the Full Privacy Statement below.

Information We Collect

We generally collect the following information:

• Information we receive when you use our Services. We collect Web-Behavior Information via cookies and other similar tracking technologies when you use and access our Services (our website, mobile apps, products, software and other services).
• Information you share directly with us. We collect and process your information when you enroll in one of our research studies, complete research surveys, and contact the Human Subjects Division, a study investigator, or other study staff. This information can generally be categorized as Registration Information and/or Self-Reported Information as defined in our full Privacy Statement.
• Pathogen Information from testing your sample(s). After you consent to participate, enroll in one of our studies, and have a sample collected, we will test your sample for the flu and other respiratory pathogens (germs). We may perform further testing to analyze the specific pathogen strain if it is found.

How We Use Information

We generally use Personal Information for the following reasons:

• To conduct our research and to provide our Services. We process Personal Information in order to conduct our research and to provide our Services, which may include mailing test kits to participants, creating participant accounts, analyzing respiratory samples, updating our live map of the flu in Seattle, and delivering research study results.
• To analyze and improve our Services. We are always working to improve and provide new reports, tools, and Services, and fix bugs and other issues as they occur. Additionally, we analyze website, app, and online survey usage to improve user experience and improve our public awareness and marketing campaigns.
• For additional Research, with your consent. If you consent to participate in one of our research studies, your Self-Reported Information and information about your sample will be included in a large data pool for research analyses. Information that identifies you will not be shared on the internet.

Control: Your Choices

Participating in our research studies and using the Services are voluntary. You can stop at any time. If you provide consent and participate in one of our studies, your respiratory sample and associated data, and de-identified information will be stored so that other researchers can use them in the future. Please ensure that you have read the consent form(s) carefully before you enroll into one of our studies.

Access to Your Information

Your Personal Information may be shared in the following ways:

• With our Service providers, including our testing laboratories, as necessary, for them to provide their Services to us.
• With research collaborators, government, university staff, and the Institutional Review Board. Sometimes, these groups review studies like these ensure that they are being conducted safely and legally. If this happens, your Personal Information may be examined. These reviewers will protect your privacy, and your Personal Information will never be used against you.
• With Local Health Jurisdictions and the Department of Health. Washington State law requires that we report certain conditions (measles, mumps, pertussis, novel strains of influenza) to these organizations. If your sample tests positive for one of these conditions, these organizations may contact you to ask you additional questions. They will keep your information private.
• With other researchers. The information and/or samples we obtain from you for these studies may be used for future studies if you consent to participate in the research. We may remove anything that may identify you from the information and samples.

How We Secure Information

We implement measures and systems to ensure confidentiality, integrity, and availability of research data. Please refer to Confidentiality of Research Information section of the studies’ consent forms.

FULL PRIVACY STATEMENT

This Privacy Statement applies to the www.seattleflu.org website owned and operated by the Brotman Baty Institute at the University of Washington (the “UW Institute”) and any other websites, pages, features, or content the UW Institute owns or operates, and any related services (collectively, the “Services”). In this Privacy Statement, terms such as “we,” “us,” and “our” refer to the UW Institute. Our Privacy Statement is designed to help you better understand how we collect, use, store, process, and transfer your information when using our Services.

Please carefully review this Privacy Statement. By using our Services, you acknowledge all of the policies and procedures described in the foregoing documents. If you do not agree with or are not comfortable with any aspect of this Privacy Statement, you should immediately discontinue use of our Services.

1. Key Definitions

• Aggregate Information: information that has been combined with that of other users and analyzed or evaluated as a whole, such that no specific individual may be reasonably identified.
• De-identified Information: information that has been stripped of your Registration Information (e.g., your name and contact information) and other identifying data such that you cannot reasonably be identified as an individual, also known as pseudonymized information.
• Personal Information: information that can be used to identify you, either alone or in combination with other information. We collect and store the following types of Personal Information:
  • Registration Information: information you provide about yourself when registering for our Services (e.g. name, email, address and telephone number).
  • Pathogen Information: information regarding whether a respiratory pathogen is present in your swab sample, generated through processing of your sample by us or our contractors, successors, or assignees; or otherwise processed by and/or contributed to us.
  • Self-Reported Information: information you provide directly to us, including your illness conditions, other health-related information, and other information that you enter into surveys, forms, or features while using our website or a mobile application.
  • Sensitive Information: information about your health, and certain Self-Reported Information such as racial and ethnic origin, sex, and pre-existing conditions.
  • Web-Behavior Information: information on how you use our Services collected through log files, cookies, web beacons, and similar technologies, (e.g., browser type, domains, IP addresses, page views).

2. Information we collect

Information you provide directly to us

• Registration Information. When you volunteer to participate in one of our research studies, we may collect Personal Information such as your name, shipping address, and contact information (e.g. email or phone number).
• Self-Reported Information. You will be asked to provide us with additional information about your health, who you are around, and your living situation.
• Participant Care. When you contact the Human Subjects Division or correspond with us about our Service, we collect information to: track and respond to your inquiry; investigate any breach of our Privacy Statement, study consent forms, or applicable laws or regulations; and analyze and improve our Services.

Information related to our sample testing services

• Respiratory sample and biobanking. To participate in one of our research studies, you need to have at least one nasal swab collected and sent to our laboratory (the quantity and timing of swab collection is dependent on the study in which you have consented to participate). Our laboratory will process your sample and analyze it for respiratory pathogens. Prior to swab collection, you will be required to carefully review the study consent form.

Web-Behavior Information collected through tracking technology (e.g. from cookies and similar technologies)

We and our third party service providers use cookies and similar technologies (such as web beacons, tags, tracking pixels, scripts and device identifiers) to:

• help us recognize you when you use our Services;
• customize and improve your experience;
• provide security;
• analyze usage of our Services (such as to analyze your interactions with the results, reports, and other features of the Service);
• gather demographic information about our user base;
• offer our Services to you; and
• monitor the success of awareness programs.

We may receive reports based on the use of these technologies from third party service providers as de-identified, Individual-level Information or as Aggregate Information.

Google Analytics.

Google Analytics is used to perform many of the tasks listed above. We use the User-ID feature of Google Analytics to combine behavioral information across devices and sessions (including authenticated and unauthenticated sessions). We have enabled the following Google Analytics Advertising features: Remarketing, Google Display Network Impression Reporting, Google Analytics Demographics and Interest Reporting, and DoubleClick Campaign Manager integration. We do not merge information collected through any Google advertising product with individual-level information collected elsewhere by our Service. Learn more about how Google collects and uses data here. To opt out of Google Analytics Advertising Features please use Google Ad Settings. To opt out of Google Analytics entirely please use this link.

Other Types of Information

We continuously work to enhance our Services with new products, applications and features that may result in the collection of new and different types of information. We will update our Privacy Statement and/or obtain your consent prior to new processing, as needed.

3. How we use your information

We will use and share your Personal Information with third parties only in the ways that are described in this Privacy Statement. Our legal basis for processing your Personal Information for the purposes described above is based on your consent into one of our research studies. You may withdraw your consent at any time by contacting us at hello@seattleflu.org however, the withdrawal of your consent will not affect the lawfulness of processing your Personal Information based on consent before its withdrawal.

• To conduct our research, to provide you with Services and to analyze and improve our Services We use the information described above to conduct our research and to operate, provide, analyze and improve our Services. These activities may include, among other things, using your information in a manner consistent with this Privacy Statement to:

  • Send you a study kit if you are eligible, process payments to you for your participation in one of our research studies, communicate with you, and implement your requests;
  • Enable and enhance your use of our website, including authenticating your visits and tracking your usage of our Services;
  • Contact you about your study account, if applicable, and any relevant information about our Services (e.g. policy changes, security updates or issues, etc.);
  • Monitor, detect, investigate and prevent prohibited or illegal behaviors on our Services, to combat security risks; and
  • Perform research & development activities, which may include, for example, conducting data analysis and research in order to develop new or improve existing products and services, performing quality control activities, and updating a neighborhood map of the flu in Seattle.

• To process and analyze your respiratory sample test results for our research purposes.

  • As described above, to participate in one of our research studies, you need to have at least one nasal swab collected and sent to our laboratory (the quantity and timing of swab collection is dependent on the study in which you have consented to participate). Our laboratory will process your sample and analyze it for respiratory pathogens. Prior to swab collection, you will be required to carefully review the study consent form.

• To allow us to share your Personal Information for our own and other research purposes. Once you have consented to participate in our research study, any information provided by you may be used in “The Seattle Flu Study” and related studies. De-identified information may be used in additional research aimed at publication in peer-reviewed journals conducted by us or third parties.

Our research may be sponsored by, conducted on behalf of, or in collaboration with third parties, such as non-profit foundations, academic institutions or pharmaceutical companies. Our research may study a specific group or population, identify potential areas or targets for diagnostics or therapeutics development, conduct or support the development of drugs, diagnostics or devices to diagnose, predict or treat medical or other health conditions, work with public, private and/or non-profit entities on respiratory pathogen research initiatives, or otherwise create, commercialize, and apply this new knowledge to improve health care. We use Aggregate and/or Individual-level Personal Information as specified in the appropriate Consent Document(s), as explained in greater detail below.

Your De-identified Information and Self-Reported Information may be used for our research only if you signed the consent form of the study in which you are enrolling. If you have signed the consent form:

• Your Personal Information will be used for research purposes, but it will be de-identified and will not be linked to your Registration Information.
• We may share summary statistics, which do not identify any particular individual or contain individual-level information, with our research collaborators.

Withdrawing your Consent.

You may withdraw your consent to participate in our research study at any time by contacting us at hello@seattleflu.org. If you experience difficulties changing your consent status, contact the Human Subjects Division at 206-543-0098 or call collect at (206) 221-5940. Any research involving your data that has already been performed or published prior to your withdrawal from our research study will not be reversed, undone, or withdrawn.

Discontinue Participation.

• You may also discontinue your participation in one of our research studies at any time.
• What happens if you do NOT consent to participate in our Research? If you choose not to consent to participate in one of our studies or any additional agreement with us, your sample will not be tested, you will not be compensated, and your Personal Information will not be used for our Research.

To recruit you for additional research

• Research is an important aspect of our Services, and we want to ensure interested participants are aware of additional opportunities to contribute to related studies. If you have chosen to participate in our Research and have opted to receive information about related studies, we may send you an email informing you of our additional research opportunities for which you may be eligible. However, we will not share Individual-level Self-Reported Information with any third party without your consent. If you do not wish to receive these notifications, you may contact us at hello@seattleflu.org.

To provide user support

When you contact us, we may use or request Personal Information, including Sensitive Information, as necessary to answer your questions, resolve disputes, and/or investigate and troubleshoot problems or complaints.

4. Information we share with third parties

• General service providers. We share the information described above in Section 2 with our third-party service providers, as necessary, for them to provide their services to us and help us perform our Research. Service providers are third parties (other companies or individuals) that help us to provide, analyze and improve our Services. While we directly conduct the majority of data processing activities required for our research studies, we do engage some third-party service providers to assist in supporting our Research, including in the following areas:
  • Our fulfillment and shipping. Our fulfillment processor processes certain Registration Information, such as your mailing address, as necessary, to enable us to send you a test kit with a nasal swab to your home if you are eligible. Our distribution center ships your kit to you, and in some cases helps return your kit safely to our laboratory so your sample can be processed.
  • Human Subjects support. Our Human Subjects Division team uses a number of tools to help organize and manage the requests we receive. These tools help to ensure we provide timely, high-quality support.
  • Cloud storage, IT, and Security. Our cloud storage providers provide secure storage for information in our databases, ensure that our infrastructure can support continued use of our data by researchers, and protect data in the event of a natural disaster or other disruption to the Service. Our IT and security providers assist with intrusion detection and prevention measures to stop any potential attacks against our networks. We have these third-party experts perform penetration tests and periodically audit our security controls.
  • Marketing and analytics. When you use our Services, including our website or mobile app(s), our third-party service providers may collect Web-Behavior Information about your visit, such as the links you clicked on, the duration of your visit, and the URLs you visited. NOTE: Our service providers act on our behalf. We implement procedures and maintain contractual terms with each service provider to protect the confidentiality and security of your information. However, we cannot guarantee the confidentiality and security of your information due to the inherent risks associated with storing and transmitting data electronically.

Aggregate information

We may share Aggregate Information, which is information that has been stripped of your name and contact information and combined with information of others so that you cannot reasonably be identified as an individual, with third parties. This Information is different from "Individual-level" information and is not Personal Information because it does not identify any particular individual or disclose any particular individual’s data. For example, Aggregate Information may include a statement that "30% of our research subjects correctly self-identified their flu symptoms," without providing any data or testing results specific to any individual user. In contrast, Individual-level Self-Reported Information consists of data about a single individual's health status or other traits/characteristics information.

As required by law

Under certain circumstances your Personal Information may be subject to processing pursuant to laws, regulations, judicial or other government subpoenas, warrants, or orders. For example, we may be required to disclose Personal Information in coordination with regulatory authorities in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We will preserve and disclose any and all information to law enforcement agencies or others if required to do so by law or in the good faith belief that such preservation or disclosure is reasonably necessary to: (a) comply with legal or regulatory process (such as a judicial proceeding, court order, or government inquiry) or obligations that we may owe pursuant to ethical and other professional rules, laws, and regulations; (b) enforce our rights under the EULA and other policies; (c) respond to claims that any content violates the rights of third parties; or (d) protect the rights, property, or personal safety of the UW Institute, their respective employees, users, clients, and the public.

5. Security measures

We take seriously the trust you place in us. We implement physical, technical, and administrative measures to prevent unauthorized access to or disclosure of your information, to maintain data accuracy, to ensure the appropriate use of information, and otherwise safeguard your Personal Information.

We produce secure applications by design.

We incorporate explicit security reviews in the software development lifecycle, quality assurance testing and operational deployment.

De-identification/Pseudonymization.

Registration Information is stripped from Sensitive Information and stored in a separate location, including Self-Reported Information. This data is then assigned a randomly generated ID so an individual cannot reasonably be identified. We use industry-standard security measures to encrypt Sensitive Information both at rest and in transit.

We use industry-standard security measures

to encrypt Sensitive Information both at rest and in transit.

Separation of Environments.

We ensure processing, production, and research environments are separated and access is restricted. Data, including Registration Information and Self-Reported Information are segmented across logical database systems to further prevent re-identifiability.

Limiting access to essential personnel.

We limit access to Personal Information to authorized personnel, based on job function and role. Our access controls include multi-factor authentication.

Managing third party service providers.

We require service providers to implement and maintain accepted industry standard administrative, physical and technical safeguards to protect Personal Information.

Your Responsibility.

Please recognize that protecting your Personal Information is also your responsibility. You should not share your enrollment survey links with others to whom you do not wish to give access to your Personal Information. We cannot secure Personal Information that you release on your own or that you request us to release. Your information collected through the Service may be stored and processed in the United States or any other country in which the UW Institute or its respective subsidiaries, affiliates, or service providers maintain facilities and, therefore, your information may be subject to the laws of those other jurisdictions which may be different from the laws of your country of residence.

6. Children's privacy

We are committed to protecting the privacy of children as well as adults. This site is not directed to children under 13 years of age. We do not knowingly collect Personal Information from anyone under 13 years of age. If we determine upon collection that a user is under this age, we will not use or maintain his or her Personal Information without the parent/guardian’s consent.

7. Linked websites

We provide links to third party websites operated by organizations not affiliated with us. We do not disclose your information to organizations operating such linked third-party websites. We do not review or endorse and are not responsible for the privacy practices of these organizations. We encourage you to read the privacy statements of each and every website that you visit. This Privacy Statement applies solely to information collected by us and our service providers on our behalf.

8. Information for Customers in Designated Countries

Section 8 only applies to individuals located in the European Economic Area (“EEA”), United Kingdom, or Switzerland (the “Designated Countries”). We aim to take reasonable steps to allow you to correct, amend, delete or limit the use of your personal data.

If you wish to be informed about what personal data we hold about you and if you want it to be removed from our systems, please contact us at hello@seattleflu.org.

In certain circumstances, you have the following data protection rights:

• The right to access, update or delete the information we have on you. This can be done by contacting us at hello@seattleflu.org.
• The right of rectification. You may have your information corrected if it is inaccurate or incomplete.
• The right to object. You have the right to ask us to discontinue our processing of your personal data.
• The right of restriction. You are entitled to request that we restrict the processing of your personal information.
• The right to withdraw consent. This involves withdrawing your consent at any time where we previously relied on it to process your personal information.
• Please note that we may ask you to verify your identity before responding to such requests.
• You have the right to complain to a Data Protection Authority about our collection and use of your personal data. For more information, please contact your local data protection authority in the European Economic Area (EEA).

The rights described above may be limited by local laws. Further, your right of access and deletion is not absolute and may not be available if fulfillment of such right would, among other things: cause interference with execution and enforcement of the law and legal private rights (such as in the case of the investigation or detection of legal claims or the right to a fair trial); breach or prejudice the rights of confidentiality and security of others; prejudice security or grievance investigations, corporate re-organizations, future and ongoing negotiations with third parties, the compliance with regulatory requirements relating to economic and financial management; or otherwise violate the interests of others or where the burden or cost of providing access would be disproportionate.

Complaints

If you believe that we have infringed your rights, we encourage you to contact us so that we can try to address your concerns or dispute informally.

9. Changes to this Privacy Statement

We may amend this Privacy Policy to reflect changes in the law, our organizations, our Services, our data collection use and practices, or advances in technology. Our use of the information we collect is subject to the Privacy Policy in effect at the time such information is used. Depending on the type of change, we may notify you of the change by posting on this page or by email. Please carefully review any changes made to this Privacy Policy.

10. Contact us

If you have questions about this Privacy Statement, or wish to submit a complaint, please email hello@seattleflu.org, or send a letter to: Seattle Flu Study / Brotman Baty Institute Box 357657 University of Washington, Seattle WA 98195 (206) 543-9660.

Effective date: November 1, 2019. The seattleflu.org website was designed and developed by Formative. Formative’s privacy policy can be found here.