Privacy Policy

What we collect

• Account details: your name and email address, and your password, which we store only as a one-way hash.
• Readings: health and activity data from the phone you pair, the export files you upload (such as Apple Health or Garmin), and the accounts you connect (such as Google Health, Fitbit, Garmin, Oura, Polar or WHOOP). Depending on your devices, this includes steps, distance, calories, workouts, heart rate, heart rate variability, blood oxygen, breathing rate, sleep and weight.
• Study information: the studies you are invited to or take part in, and your answers to their consent forms.

Data from Google Health

When you connect a Google account, SeaCollect asks Google for read-only access to:

• Activity and fitness: steps, distance, calories and workouts.
• Health measurements: heart rate, heart rate variability, resting heart rate, blood oxygen, breathing rate, weight, body fat, body temperature and blood glucose.
• Sleep: sleep sessions and their stages.
• Your Google Health user ID and email address, used to link the Google account to your SeaCollect account.

We use this data only to show it to you in SeaCollect and, if you take part in a study, to share it with that study as described below. SeaCollect never changes or adds to your Google data. We do not sell it, use it for advertising, or use it to decide credit or lending, and people at SEA Lab do not read it unless you ask them to, you take part in a study that uses it, or it is needed for security or by law.

SeaCollect's use of information received from the Google Health API adheres to the Google Health API Developer and User Data Policy, including the Limited Use requirements. Data used for research also follows the Google Health API User Data and Health Research Policy.

You can stop SeaCollect's access at any time by removing Google Health on the Devices page, or in your Google Account.

How we use your data

• To show your readings to you as charts.
• To share them with the studies you choose to take part in.
• To conduct health and behavior research approved by an Institutional Review Board (IRB), with your informed consent.
• To keep SeaCollect working, secure and easy to use.

Research data is used in accordance with IRB-approved protocols, and identifiable information is de-identified or anonymized whenever possible.

Who can see your data

• You.
• The researchers of a study you take part in. Taking part shares your readings with the study's lab, as its invitation and consent form describe. Nothing reaches a study before you agree.
• SEA Lab staff who run SeaCollect, only when needed to keep it working or secure, or when you ask for help.
• Service providers that run parts of SeaCollect for us: Amazon Web Services hosts our servers, and Google (Gmail) delivers our emails. They process data only to provide those services.
• Others only when the law requires it.

We do not sell or share personally identifiable information with third parties for commercial purposes.

How we store and protect it

Your data is stored on servers SEA Lab runs on Amazon Web Services in the United States, in SeaCollect and in the open-source systems it is built on, Open Wearables and JupyterHealth Exchange. Data travels over encrypted connections (HTTPS), and access to the servers is limited to the SEA Lab staff who run SeaCollect.

Keeping and deleting your data

We keep your data until you delete it or your account.

• Removing your phone or a connected account on the Devices page disconnects it and deletes every reading it sent.
• Deleting your account on the Account page deletes your SeaCollect account and, unless you choose to keep them, your readings and your JupyterHealth Exchange account.
• Copies a study has already made for its research are handled as its consent form describes.

Your choices

Participation in our research is entirely voluntary. You may:

• Use SeaCollect without joining any study.
• Choose which devices and accounts to connect, and disconnect them at any time.
• Decline a study, or leave one at any time.
• Ask us for a copy of your data or to delete it, subject to applicable university and IRB policies.

If you take part in a study, see your consent form for study-specific privacy information.

Third-party services and links

Accounts you connect from other companies, such as Google or Garmin, are also covered by those companies' privacy policies. We are not responsible for the privacy practices of external websites.

Changes to this policy

We may update this policy from time to time. Updates are posted on this page with a new date. Continued use of SeaCollect means you accept the current policy.

Contact

For questions, requests about your data, or accessibility issues, email sea.lab.space@gmail.com. For comprehensive and legally binding privacy practices, see the CUIMC Privacy Policy or Columbia's Office of HIPAA Compliance. See also our Terms of Use.