Per Article 30 of the European Union General Data Protection Act, this report
documents Open Humans personal data processing activities in writing. Because
our platform enables users to create new personal data inputs and outputs, we
maintain a semi-automated report based on the current active "activities" (or
projects) within Open Humans.
Name & contact details
Data controller is the Open Humans Foundation, which manages the Open
Humans platform:
Open Humans Foundation
500 Westover Dr #10553
Sanford, NC 27330
USA
email: support@openhumans.org
phone: +1-252-513-4188
Data protection officer is designated to be:
Mad Ball
Open Humans Foundation
500 Westover Dr #10553
Sanford, NC 27330
USA
email: support@openhumans.org
phone: +1-252-513-4188 Extension 1
European Union representative is designated to be:
Marja Pirttivaara, PhD, MBA
Sepontie, FI-02130 Espoo, Finland
email: marja.pirttivaara@gmail.com
phone: +358 40 766 2475
Purposes of personal data processing
Member-managed personal data sharing with third parties
Members can explicitly opt-in to share selected personal data with arbitrary
third party activities that operate on the site. These activities include the
following potential uses members may wish to have:
- data analysis and exploration tools
- data cleaning tools
- data donations to research and citizen science projects
Contact and notification
Emails are collected from users to enable contact regarding events
specific to their account, messages sent to them by other members or
activities, and substantive changes to the site, as well as newsletters
for users that opt-in to receiving these.
Personalization
Users are invited to create and share the following public data to
personalize their accounts within the community: username, name, profile
picture, and "about me" text.
Naming guidelines
do not require individuals to divulge their real name.
Logging
The Open Humans site collects logs of web usage, which may contain personal
data (e.g. IP address).
Categories of data subjects and personal data
Data subject categories
Members
Our primary data subjects consist of 10580 member accounts
created on the site. Users are required to be 16 years of age or older.
Account data may come from children only through an account managed by
that child's legal guardian.
Site visitors
Individuals that visit the site and are not logged in may have personal
data (IP address) collected within our logging.
Personal Data Categories
Account data
Primarily this is email address, which is private personal data. Users
may also publicly share a name, username, profile picture, and "about me"
information. These may be identifying but are not required to be.
Logging data
Primarily this contains IP addresses. This is collected by servers to
enable us to audit usage and debug site issues.
Activity data
Activities deposit data at the explicit opt-in behest of a member to
their account. This data is typically personal data of diverse categories,
and is known to include genetic data, location data, and other identifiable
data.
The following activity data sources are documented for Open Humans:
- 23andMe Upload: Raw 23andMe genotyping data
- American Gut Project: A table describing the organism / sample counts and taxonomy.
- AncestryDNA Upload: Raw AncestryDNA genotyping data
- AndroidAPS Uploader: Glucose Values, Boluses, Carbs, TBRs, Settings, Device Information, App Version...
- AutSPACEs: Sensory processing experiences & recommendations
- Covid Open Survey: Individual survey responses & anonymized aggregate data
- Data Selfies: All the data
- Data sharing and ethical oversight: Members can opt in to receive their own answers and/or all answers as an aggregate from the project once the study is over.
- FamilyTreeDNA integration: FamilyTreeDNA raw genotyping data
- File Uploader: Data files uploaded by a member
- Fitbit Connection: Data from Fitbit devices, including steps, heart rate, and heart rate, if available.
- Fitbit Intraday: Intraday Fitbit Records (Heart Rate & Activities)
- Gencove: Sequencing bam files
- Genetics of Personality Type: This project will return a person's personality type (i.e., INTJ, ESFJ) as determined using three personality questionnaires.
- Genome/Exome Upload: VCF files
- Google Fit: Steps, distance, calories, activity minutes from Google Fit
- Google Location History Upload: Google Location History archives
- Google search history analyzer: Google take-out archive of search data
- GoViral: survey data and possibly kit results
- GoViral (2014-2016): Sickness reports contain survey data from GoViral. Viral profiling data contains raw viral test results.
- Harvard Personal Genome Project: Full genome sequencing data and survey data, if your participant account has these data.
- Imputer: Imputer will return a file with imputed genotypes from a user's existing genotype file.
- Jawbone Connection: Steps, sleep, and heartrate data, if available.
- lineage: Remapped SNPs, merged and discrepant SNPs (if applicable)
- Mobility data of researchers: Example of the dataset collected: travel cityA → cityB of a scientist (metadata: ORCID of a scientist who travels).
- Moves connection: Moves GPS tracking
- mPower study: Survey data and task data (tapping, voice, memory)
- Nightscout Data Commons: Data from any associated project research survey such as demographics.
- Nightscout Data Transfer: Data from Nightscout: profile.json, entries.json, treatments.json, and devicestatus.json
- nobism: csv file with all timepoints and relations general information from the Profile page
- nobism Ubiqum Cluster headache Project: We want to create regular reports based on your own data and that of all that shared. These will be stored back into your OpenHumans account
- Nokia Health (Withings) Connection: Personal and environmental tracking data: body weight, temp, fat/water/muscle %; blood pressure; heart rate; air temp/quality; sleep; steps
- OH Data Port for Apple Health: Heart rate data from Apple HealthKit
- OpenAPS Data Commons: Data from any associated project research surveys (such as an engagement score or other QOL data gathered)
- Open Humans Healthkit Integration: HealthKit data from your iPhone or iPad (visible in the Health app)
- openSNP: Will upload a link to the openSNP user page for two-way connection
- Oura Connect: Oura sleep and activity data
- Overland connection: Overland GPS records
- Personal Data Notebooks: Personal Data Notebooks
- QCycle: Body Temperature, Oura Ring Data
- Quantified Flu: Self-reported incidents of illness, wearable data from Fitbit/Oura
- RescueTime connection: RescueTime productivity data (computer usage including window titles & web site visits)
- Runkeeper connection: Activity data from your Runkeeper account
- Spotify integration: Spotify recent played songs
- Transbiome: Description of added data here
- Twitter Archive Analyzer: Zipped Twitter archives
- uBiome Upload: Raw uBiome sequencing data
- Wild Life of Our Homes: Bacterial and fungal data from surfaces in participant homes
Categories of data recipients
Activities
Activities operated in the site are potential recipients of personal data.
Data is only accessible by an activity if a member explicitly opts in,
joining the activity and authorizing Open Humans share one or more
categories of personal data in their account.
Activities are required to follow the site terms of use, which include
activity guidelines
that mandate secure practices and transparent communication
with members, including the presence of identifiable data and potential
risks. Activities undergo a
community review
process prior to being made broadly available to members.
The following activity data recipients are documented for Open Humans:
Time limits for erasure
Account data and activity data should be permanently deleted after 60 days,
and are immediately removed from processing activities when requested
by a member. Logging data should be permanently deleted after 120 days.
Security measures
Pseudonymization and encryption
Activity data shared with data recipient activities is done via randomly
assigned activity-specific identifiers. Data itself may or may not
contain non-anonymous content. Activities are required by
activity guidelines
to make members aware of identifiable features in data they offer to add
to a member's account.
All interactions with the website and API are enforced to use SSL
encryption. Data in the database and file storage is encrypted at rest.
Ensuring ongoing integrity and security of processing systems and operations
The site and other infrastructure are operated with major cloud services
providers that provide up-to-date secure platforms for operating technical
infrastructure. These service providers are: Heroku, Amazon Web Services,
Google Cloud Services, and Digital Ocean.
The site software uses the Python/Django framework and is regularly updated
to new releases, and is openly available for third party inspection as an
open source project.
Data preservation
Backups are automatically performed for account data on a daily basis, and
are retained for a minimum of one month. Backups of activity data occurs
automatically on a continuous basis and are retained for 60 days.
Security review
Activities are made broadly available on the site only after they pass a
community review
process. This provides an open forum for regular review
of security measures in the platform and activity operations. Open Humans
also maintains a public community
chatroom and open source
repositories, encouraging discussion and feedback on potential improvements.