Per Article 30 of the European Union General Data Protection Act, this report documents Open Humans personal data processing activities in writing. Because our platform enables users to create new personal data inputs and outputs, we maintain a semi-automated report based on the current active "activities" (or projects) within Open Humans.
Data controller is the Open Humans Foundation, which manages the Open Humans platform:
Data protection officer is designated to be:
European Union representative is designated to be:
Members can explicitly opt-in to share selected personal data with arbitrary third party activities that operate on the site. These activities include the following potential uses members may wish to have:
Emails are collected from users to enable contact regarding events specific to their account, messages sent to them by other members or activities, and substantive changes to the site, as well as newsletters for users that opt-in to receiving these.
Users are invited to create and share the following public data to personalize their accounts within the community: username, name, profile picture, and "about me" text. Naming guidelines do not require individuals to divulge their real name.
The Open Humans site collects logs of web usage, which may contain personal data (e.g. IP address).
Our primary data subjects consist of 103993 member accounts created on the site. Users are required to be 16 years of age or older. Account data may come from children only through an account managed by that child's legal guardian.
Individuals that visit the site and are not logged in may have personal data (IP address) collected within our logging.
Primarily this is email address, which is private personal data. Users may also publicly share a name, username, profile picture, and "about me" information. These may be identifying but are not required to be.
Primarily this contains IP addresses. This is collected by servers to enable us to audit usage and debug site issues.
Activities deposit data at the explicit opt-in behest of a member to their account. This data is typically personal data of diverse categories, and is known to include genetic data, location data, and other identifiable data.
The following activity data sources are documented for Open Humans:
Activities operated in the site are potential recipients of personal data. Data is only accessible by an activity if a member explicitly opts in, joining the activity and authorizing Open Humans share one or more categories of personal data in their account.
Activities are required to follow the site terms of use, which include activity guidelines that mandate secure practices and transparent communication with members, including the presence of identifiable data and potential risks. Activities undergo a community review process prior to being made broadly available to members.
The following activity data recipients are documented for Open Humans:
Account data and activity data should be permanently deleted after 60 days, and are immediately removed from processing activities when requested by a member. Logging data should be permanently deleted after 120 days.
Activity data shared with data recipient activities is done via randomly assigned activity-specific identifiers. Data itself may or may not contain non-anonymous content. Activities are required by activity guidelines to make members aware of identifiable features in data they offer to add to a member's account.
All interactions with the website and API are enforced to use SSL encryption. Data in the database and file storage is encrypted at rest.
The site and other infrastructure are operated with major cloud services providers that provide up-to-date secure platforms for operating technical infrastructure. These service providers are: Heroku, Amazon Web Services, Google Cloud Services, and Digital Ocean.
The site software uses the Python/Django framework and is regularly updated to new releases, and is openly available for third party inspection as an open source project.
Backups are automatically performed for account data on a daily basis, and are retained for a minimum of one month. Backups of activity data occurs automatically on a continuous basis and are retained for 60 days.
Activities are made broadly available on the site only after they pass a community review process. This provides an open forum for regular review of security measures in the platform and activity operations. Open Humans also maintains a public community chatroom and open source repositories, encouraging discussion and feedback on potential improvements.
|
|
Contact Us |
Community Guidelines |
Terms of Use |
Data Use Policy
Continue with Facebook
Continue with Email