Data Security & Privacy
Who runs unhide®?
unhide® runs its platform using the software “MyDataHelps”, developed by thecompany CareEvolution. MyDataHelps supports over 100 ongoing research studies, including unhide® alongside the NIH’s All of Us Study, MELO by the Metrodora Institute/ChronicleBio, and many more.
How is the data stored?
It stores data in a secure, HIPAA compliant system, and Meaningful Use Certified EDC HIEBusTM platform. The developer of the platform, CareEvolution, complies with the security and privacy controls defined by NIST 800-53 Rev. 4 at the FISMA Moderate baseline. They regularly undergo external formal assessments by a FedRAMP-accredited Third-Party Assessment Organization (3PAO). The platform has been granted an Authorization to Operate (ATO) by the National Institutes of Health (NIH) and is FDA Part 11 Compliant. All data are encrypted at rest and during transfer.
How does the Brain Inflammation Collaborative manage access to internal data?
In addition to the safeguards that MyDataHelps provides, the Brain Inflammation Collaborative strictly oversees internal access to data. Access is granted on an as-needed basis only. All those with platform access are up-to-date on HIPAA compliance training that includes digital health modules. We additionally use two-factor authentication to guard against laptop/device loss or theft. Data storage is primarily through the MyDataHelps secure platform; for data cleaning and de-identification of exported data, files are stored in a HIPAA compliant cloud server that includes 256-bit AES encryption for data at rest, SSL/TLS encryption in transit, robust access controls (granular permissions, passwords, links), and features like two-factor authentication (2FA) and remote device wipe for workstation protection.
What legal protections exist for my data?
To further protect your privacy, this research is covered by a Certificate of Confidentiality (CoC) from the National Institutes of Health (NIH).
- Strong Legal Protections: Under federal law, this certificate generally allows our research team to refuse to disclose your name or any identifiable information in legal proceedings—such as a court subpoena—at the federal, state, or local level.
- The Intent: The goal of this federal protection is to support your privacy and encourage open participation in research.
- Important Limits: While the CoC is a powerful tool, it does not prevent all disclosures. We still may be required to share information if:
- You give us written permission to do so.
- State or local laws require reporting of specific items, such as child abuse, elder neglect, or a direct threat of harm to yourself or others.
- The information is needed by the NIH or the FDA for project auditing.
Will you sell my data?
Data will never be sold, used for advertising purposes, and only fully de-identified data from unhide® is passed on to collaborators. If a participant separately opts to participate in a sub-study, an additional consent form would be signed allowing a specific collaborator to have access to identifying information, such as names or email addresses.
