GBHI Privacy Notice - Learning Experience

Introduction

This is a statement of the practices of the Global Brain Health Institute (“GBHI”) based at the University of California, San Francisco (“UCSF”) and Trinity College Dublin, the University of Dublin (“Trinity”) (“the Service”) in connection with the processing of personal data for the purposes of the Service and the steps taken by GBHI as a data controller to safeguard individuals’ rights under data protection legislation, specifically the EU General Data Protection Regulation (“GDPR”) and Data Protection Acts 1988-2018.

GBHI fully respects your right to privacy and actively seeks to preserve the privacy rights of data subjects who share personal data with the University. Any personal information which you volunteer to the Service will be treated with the highest standards of security and confidentiality, in accordance with data protection legislation.

This Privacy Statement explains the following:

• How the Service collects your personal data;
• The purpose and legal basis for processing your personal data;
• How we securely store your personal data;
• Details of third parties with whom we share personal data; and
• Your rights under data protection legislation.

How we collect your personal data

We collect personal data to provide our services to you. This data may be collected directly from you, by our staff or from other systems, such as Canvas or Zoom, that are under the control of GBHI.

What data we collect and why

Information collection

• Personally identifiable information, such as email address, name, phone number, etc., may be gathered to create profiles for the various platforms. Your name and GBHI email address will be used where necessary to create profiles, but all other information is only collected when it is volunteered by you – for example when you complete a form to sign up for a newsletter.
• Non-personally identifying information that your browser makes available automatically whenever you visit a website will be collected. This information includes the internet address of your computer or network, the date, time, and page you visited, your browser and operating system, and the referring page (the last webpage you visited before clicking on a link to the site).

Information you provide

• You may directly provide information to GBHI in the following ways: 
  • As a potential applicant
  • As a fellow
  • As a member of the public who asked to be added to our mailing list or attends one of our events. 
• In all cases, separate privacy notices will be provided to you at the point where your data is requested, giving you the specific details in regard to how your information will be collected and used. 
• We do not give, share, sell, rent, or transfer personal information to a third party.

Site analytics

• We use a tool called “Google Analytics” to help understand how visitors interact with our website so that the site can be improved.
• You can read Google Analytics Terms of Use and the Google Privacy Policy for Google Analytics.
• You can choose not to have your data collected by Google Analytics by downloading their opt-out browser add-on. For EU users, visit Your Online Choices to learn how to opt out of having your data used for online behavioral advertising by European Interactive Digital Advertising Alliance (EDAA) member companies.

Links

• The sites used for the Learning Experience, including Canvas and Padlet, may contain links to external websites over which GBHI exercises no control.
• The privacy policies and procedures described here do not necessarily apply to those sites and we suggest contacting these sites directly for information on their data collection and distribution policies.

Site Security

• We monitor activity on the various platforms used to identify unauthorized attempts to upload or change information or to otherwise cause damage to the site. Anyone using this website expressly consents to such monitoring.
• We take appropriate security measures to protect against unauthorized access, alteration, or destruction of data.

Data collected as part of the fellowship program

As part of the operation of GBHI, we also collect and manage the following types of  information:

Applicant details

In order to perform the application process, details of applicants for the fellowship are collected and retained (separate notices on the details of how this information is managed are included as part of the online application form).

During and after the fellowship

• To support the administration of the site-specific HR and Finance aspects of the fellowship, fellows are asked to share information with the host institutions (see www.tcd.ie and www.ucsf.edu).  This information is managed by the institutions securely in accordance with local legislation.

• In addition, information related directly to the fellows’ engagement with the programmatic activities of the learning experience (i.e., completion of activities, attendance etc.) is collected for academic or operational purposes. This includes information collected as part of the pilot project application process.
• Information provided as part of the Learning Experience, including recordings of sessions and coursework, is used to help improve the GBHI Learning Experience and will be shared with GBHI employees and contractors who are directly involved in the creation and delivery of that specific learning module.
• Other information volunteered by you, such as through optional feedback forms is also used to help us enhance the Learning Experience and may be shared with GBHI employees and contractors for that purpose.
• We do not give, share, sell, rent, or transfer any personal information to a third party.
• Fellow and senior fellow information on activities and achievements collected by GBHI is retained indefinitely to support the life-long nature of the fellowship relationship.
• In addition, information related directly to the fellows engagement with the programmatic activities of the learning experience (i.e., completion of activities, attendance etc.) are collected for academic purposes.  
• During the program Monitoring and Evaluation, data is also collected to support quality assurance and improvement of the program.
• Information on all fellow activities and achievements is collected by GBHI and retained indefinitely to support the life-long nature of the fellowship relationship and to provide metrics of fellow activity and program impact.

Purpose and legal basis for processing personal data

The personal data we collect from you will only be processed by the Service for the specific and lawful purposes as outlined in this Privacy Statement. GBHI will ensure that your data is processed fairly and lawfully in keeping with the principles of data protection as set out under Article 5 GDPR.

Specifically, your personal data may be processed for any or all of the following purposes:

If you require further detail, please contact support@gbhi.org.

How we securely store your personal data

Personal data will be stored confidentially and securely as required by the Trinity College Information Systems Security Policy and Data Protection Policy. GBHI is committed to ensuring that the processing of your data is safeguarded by appropriate technical and organizational security measures relevant to the processing in accordance with Article 32 GDPR requirements.

When we store your personal data on our systems, the data will be stored either on GBHI premises or on secure IT platforms within the European External Area (“EEA”) or external of the EEA which are subject to Chapter V GDPR requirements.

Details of third parties with whom we share personal data

The Service will only share your data with third parties where necessary for the purposes of processing outlined in this Privacy Statement. In accordance with Article 28 GDPR, when we share your data with third parties the Service will ensure that the data is processed according to specific instructions and that the same standards of confidentiality and security are maintained.

The following table details the third parties with whom your personal data is shared together with the purposes for the sharing:

How long we retain your data

In keeping with the data protection principle of storage limitation, we will only retain your data for as long as is necessary.

Data related directly to learning activity within the fellowship year will be stored for no more than 2 years post fellowship (i.e., assessments, submissions etc).

Other data will be stored indefinitely to support longer-term contact and program metrics.

See  Records Management Policy.

Your rights under data protection law

You have the following rights over the way we process your personal data. For further information please see the GBHI Data Subject Rights Requests Procedure.

Right of Access

You have the right to request a copy of the personal data which is processed by the Service and to exercise that right easily and at reasonable intervals.

Consent

You may withdraw your consent to the Service processing your personal data at any time when consent is the legal basis for the processing. To withdraw your consent, we require you to advise the Service in writing.

Rectification

You have the right to have inaccuracies in personal data that we hold about you rectified.

Erasure

You have the right to have your personal data deleted where we no longer have any justification for retaining it, subject to exemptions such as the use of pseudonymized or anonymized data for scientific research purposes.

Object

You have the right to object to processing your personal data if:

• We have processed your data based on a legitimate interest or for the exercise of the public tasks of the University if you believe the processing to be disproportionate or unfair to you.
• The personal data was processed for the purposes of direct marketing or profiling related to direct marketing.
• We have processed the personal data for scientific or historical research purposes or statistical purposes unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Restriction

You have the right to restrict the processing of your personal data if:

• You are contesting the accuracy of the personal data.
• The personal data was processed unlawfully.
• You need to prevent the erasure of the personal data in order to comply with legal obligations.
• You have objected to the processing of the personal data and wish to restrict the processing until a legal basis for continued processing has been verified.

Portability

Where it is technically feasible you have the right to have a readily accessible machine readable copy of your data transferred or moved to another data controller where we are processing your data based on your consent and if that processing is carried out by automated means.

Cookies

We use information gathered from cookies to help improve your experience of our website. Some cookies are essential so you can move around the website and use its features. Our website also contains third party cookies which are listed in our Cookie Register. You can refuse or consent to third party cookies when you first visit our website or by following the guidelines in our Cookie Policy.

Further information

If you have any queries relating to the processing of your personal data for the purposes outlined above or you wish to make a request in relation to your rights, you can contact any member of the Service staff at: eoin.cotter@gbhi.org.

If you wish to make a complaint or escalate an issue relating to your rights you can contact the Trinity College Data Protection Officer:

Email: dataprotection@tcd.ie

Post:

Data Protection Officer
Secretary’s Office,
Trinity College Dublin,
Dublin 2,
Ireland.
Oifigeach Cosanta Sonraí
Oifig an Rúnaí,
Coláiste na Tríonóide, Baile Átha Cliath,
Baile Átha Cliath 2,
Éire.

If you are not satisfied with the information we have provided to you in relation to the processing of your personal data or you are dissatisfied with how GBHI is processing your data you can make a complaint to the Data Protection Commissioner at: https://forms.dataprotection.ie/contact.

Definitions

Personal data

Any information relating to an identified or identifiable natural person (‘data subject’).

Special Categories of Personal Data (Sensitive personal data)

• Data concerning health
• Personal data revealing racial origin, ethnic origin, political opinions, religious beliefs, philosophical beliefs, trade-union membership
• The processing of genetic data for the purpose of uniquely identifying a natural person
• The processing of biometric data for the purpose of uniquely identifying a natural person
• Data concerning a natural person's sex life or sexual orientation

Processing

Any operation or set of operations performed on personal data. Processing includes storing, collecting, retrieving, using, combining, erasing and destroying personal data, and can involve automated or manual operations.

Data subject

Someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data controller

An organisation, such as GBHI, which determines the purposes and means of the processing of personal data.

Data processor

A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, traditionally under contract. This does not include Service staff who are processing personal data on behalf of the University as part of their employment duties.