FluPulse™ Consumer Health Data Privacy Policy

What this covers

The optional health profile: your answers, the email address and location linked to them, and the risk-group and study-matching indicators we derive from them. It applies to every subscriber in the United States.

What we collect and how we use it

Age, home zip code, sex assigned at birth, diagnosed health conditions, immune-suppressing treatment, nursing home residence, pregnancy or recent pregnancy, and vaccination status. Each use below happens only if you chose it: (1) storing your profile and counting how many subscribers are in each age and risk group, to plan the service; (2) deidentified group counts for organizations planning respiratory-virus studies, never including pregnancy; (3) selecting general health guidance for you, including pregnancy-related guidance if you answered that question; (4) selecting study invitations for you, never using pregnancy. Everyone who saves a profile sees the same general statement about flu risk; it does not depend on your answers.

How it is processed

Answers are stored in our database, linked to your subscription. Our own software reads individual profiles to derive a risk group and to select guidance and invitations. External AI assistants do not receive individual profiles. We do not collect, use or sell personal data to train large language models.

Source

You provide the answers and the subscription details. FluPulse's software derives the risk-group and matching indicators from them. We do not buy individual health information or obtain it from any outside source.

Sharing

We do not share consumer health data with third parties or affiliates, and we do not sell it. Two kinds of service provider act only on our instructions, under contract: our hosting provider processes subscription details, profile answers, consent records and derived indicators; our email provider processes email addresses, message content and delivery status. Message content may reflect a feature you chose; we never send your questionnaire answers to the email provider. No third party collects consumer health data across websites through FluPulse. Profile, account and confirmation pages carry no analytics script; Cloudflare Web Analytics runs on the public information pages only, without cookies.

Deidentified statistics

Before releasing statistics we assess identification and inference risks, including the risk from combining reports. We suppress small and complementary cells and restrict overlapping queries. We commit to keep such data deidentified and never attempt to reidentify it, and recipients must make the same public commitment, apply reasonable safeguards and bind anyone they pass it to.

Emails

Tailored messages and study invitations may allow someone who sees your email to infer something about your health. We do not put your answers in emails, subject lines or links, and we do not track opens or clicks on them.

Your rights

You may confirm whether we hold health data about you; get a copy, in a portable electronic form, of your answers and of the indicators we derived from them; get the list of anyone they have been shared with, from our records; correct them; withdraw any consent; and delete them. Use the link in any FluPulse email or write to [email protected]; we confirm a request through a link sent to your subscribed address before acting on it. Free of charge. A withdrawn consent takes effect as soon as practicable and within 15 days at most. Deletion covers answers, derived indicators and any cached selections, and is completed within 30 days on live systems and at our service providers, and within 30 days on backups, which are access-restricted meanwhile and have deletions reapplied if restored. Other requests are answered within 45 days. If we refuse a request we say why, and you can appeal by reply; we answer an appeal within 45 days. If the appeal fails you may contact your state Attorney General (Washington: atg.wa.gov/file-complaint; Nevada: ag.nv.gov; Connecticut: portal.ct.gov/ag).

How long we keep it

Until you delete it or unsubscribe. A pregnancy answer is deleted 6 months after you give it unless you reconfirm it. Flu and COVID-19 vaccine answers are asked again each season. We keep the profile for as long as you stay on the list; you can change or delete it at any time from your page. After you unsubscribe we keep your email address on a suppression list so that we do not write to you again; it holds no health data.

Security and incidents

Encryption in transit and at rest; access limited to named people, with multi-factor authentication; tested deletion. Our incident procedure covers any unauthorized acquisition or disclosure of identifiable health information, including a mistaken disclosure by us or a service provider, not only hacking. We notify affected people and authorities when the law requires it.

Who may take part

Adults aged 18 or older living in the United States, answering about themselves. If we learn that a subscriber is under 18, we end the subscription and delete everything collected.

Changes

We email subscribers before a material change takes effect. A new kind of data or a new purpose does not begin until you consent. This questionnaire does not enroll you in research. Before any new research use, FluPulse will determine the legal and ethics-review requirements that apply and obtain any review and permission required; this consent does not authorize unspecified future research.