Privacy Policy

Effective Date: 12-May-2023

The Institute for Neurodegenerative Disorders (IND) is committed to safeguarding your privacy and personal data. This notice is provided to describe what information we collect about you, what we do with it, what we do to keep it secure, as well as how it might be disclosed and your rights in relation to your personal information. This Privacy Policy applies to all information received by IND, both online and offline, any electronic, written communication you share with us, and any information you provide to service providers operating on behalf of IND for the purposes of providing the myPPMI platform. 

IND processes your personal information as part of the PPMI study on behalf of The Michael J. Fox Foundation (MJFF), who is the sponsor for this study and the data controller for the personal information processed as part of it. 

The data controller and its Data Protection Officer can be contacted:

• By email: privacy@michaeljfox.org 
• By post: The Michael J. Fox Foundation for Parkinson’s Research, Grand Central Station, P.O. Box 4777, New York, NY 10163-4777

Understanding your health record 

A record is made each time you visit one of our qualified clinical sites participating in a clinical research trial. Information about your examination and test results is recorded. These records provide information about your research visit pertaining to the applicable clinical study you have consented to participate in. 

Understanding what information is retained in your record, collected and how that information may be used or shared is defined in the associated clinical study informed consent document.

IND is a HIPAA waived entity. The clinical sites involved in the PPMI study who are required to comply with HIPAA have their own policies available for review.

What data we collect

The data collected by the portal includes the personal information you directly submit to us as part of the registration process, including your name, date of birth, email address, address, phone number and residency. Whilst we ask you for all of this information, you are only required to provide us with an email address to create an account. The information you do provide is used to help you register to the portal, provide you with relevant information about the study, programs and services, and to tailor and promote opportunities for engagement to meet your interests. 

Once you have signed the informed consent form in the portal, giving permission for your health information to be used as part of the PPMI study, your health record will then be processed as part of the PPMI study.

We rely on the lawful basis of legitimate interests under Article 6 of the EU GDPR for all data collection, including the collection of email address. The legitimate interests that we are pursuing by collecting and processing your information is to be able to provide a comprehensive, standardized, longitudinal data set to the research community, with the ultimate goal of advancing the treatment and diagnosis of people with Parkinson’s Disease.

Where we process your special category health data for the purpose of contributing to the PPMI study, we rely on Article 9(2)(j) of the EU GDPR as our condition for processing which relates to processing necessary for scientific research purposes. 

You are under no legal or contractual obligation to provide us with your personal information. However, failure to do so will mean that you are unable to be enrolled in the myPPMI Portal and take part in potential research studies sponsored under PPMI by MJFF.

Understanding your privacy rights

Under data protection law, you have a number of rights over your personal data: 

The right to be informed

You have the right to be informed about the collection and use of your personal information. We respect this right by providing you with this Privacy Notice which outlines how your data will be processed in the Portal. The informed consent form also has information about how your personal information will be used.

The right of access

You have the right to request a copy of the information that we hold about you, sometimes termed a Data Subject Access Request. 

The right to erasure

If you wish to have your personal information removed from our system, please contact us at support@myppmi.org and your information will be removed. However, please be aware that the right to erasure is not absolute, and once you sign the informed consent to participate in a specific research study, the data collected during your study enrollment cannot be removed.

The right to rectification

If any of the personal information we hold about you is inaccurate, incomplete or out of date, you may ask us to correct it.

The right to stop or limit our processing of your personal information

You have the right to object to us processing your personal information for particular purposes, to have your information deleted if we are keeping it too long, or have its processing restricted in certain circumstances.

The right to data portability 

The right to portability gives you the right to receive personal data you have provided to a controller in a structured, commonly used and machine-readable format. It also gives you the right to request that a controller transmits this data directly to another controller.

If you would like to exercise any of the rights above, please contact support@myppmi.org.

Withdrawing from the study

Your clinical research data record is the physical property of the clinical research study sponsor and those defined in the informed consent. 

You may request to withdraw from the study at any time by sending written notice to the study investigator. Upon receiving the written notice, the study team will no longer use or disclose your health information and you will not be able to stay in the study. Information that has already been gathered may need to be used and given to others for the validity of the study.

Data security

To protect your personal information, IND has put in place suitable physical, electronic and managerial procedures to secure the information we process. This includes:

• Restricting access to the computing environment by a least-privilege model so that only those employees who need to access sensitive data for their job function will have access
• Robust access logs and monitoring of network activity
• Implementation of multi-factor authentication (MFA)
• Implementing a comprehensive Information Security Policy  
• Pseudonymisation

The IND servers are located in a cloud-based locked, secure environment, and computer systems are maintained in accordance with industry standards to secure information. Consistent with regulations of the United States and European Union, IND takes many technical precautions to keep your identifiable data secure against security breaches. However, if there is a breach, IND will comply with its regulatory obligations.

Data retention

The PPMI study is a longitudinal study which aims to speed up breakthroughs in Parkinson’s research by collecting data over long periods and providing it as an open source resource for researchers. As such, the data you supply to the study will be kept in pseudonymised form for the duration of the study.

Our Institutions’ Privacy Practices

 We understand that health information about you is personal, and we are committed to protecting that information.  In meeting legal requirements and the organization’s efforts to protect your health information we:

• Keep your medical information private. Other than for reasons described in this notice, this organization agrees not to use or disclose your identifiable health information to individuals without your authorization.
• Provide you with this notice of your rights and our legal commitment and privacy practices with respect to the information we collect and maintain about you.
• Abide by the terms of this notice and notify you if we are unable to grant your requested restrictions or reasonable desires to communicate your health information by alternative means or to alternative locations.
• Take all possible steps to safeguard your health information.
• Ensure that all healthcare professionals and individuals with privileges, including staff members, abide by our privacy policy and practices.

Understanding our policy for specific disclosures

•  Authorization – As a research participant, your health information will be disclosed to those you have specifically authorized to receive this information and wherever possible the information will be pseudonymised. 
• Study Partners– Some or all of your health information may be subject to disclosure through contracts for services to assist the study in conducting the clinical research study.  To protect your health information, we require these Business Associates to follow the same standards held by this office through terms detailed in a written agreement.
• Additional Research – We may share your personal data with our Study Partners for the purpose of enabling you to take part in separate research studies. We will only do this where you have consented to take part in another study, and where this is the case, you will be provided with a separate informed consent form outlining the sharing in more detail.
• Limited Data Set – We may use or disclose information about you without your authorization as part of a “limited data set” which includes limited information (such as a city, but not personally identifying information such as your name or address) for research purposes.  The recipient of this information must sign a data use agreement to restrict the use of this information.
• Food and Drug Administration (FDA) – This office is required by law to disclose health information to the FDA related to the data collected in a clinical research trial conducted with investigational drugs or related to any adverse events or compliance violations occurring in the study.
• Public Health – This office is required by law to disclose information to The Office of Research Integrity (ORI) as required, which is charged with tracking mandatory reports of research integrity, 
• Law Enforcement – (1) Your health information will be disclosed for law enforcement purposes as required under state law or in response to a valid subpoena. (2) Provisions of federal law permit the disclosure of your health information to appropriate health oversight agencies and authorities when a report is made in good faith that there has been unlawful conduct or violations of professional clinical standards.
• Service providers - We may share your personal information with third parties that provide services that help us with our business activities (such as reimbursement processing, hosting and storage, imaging, database management services and legal and other professional advice). We authorize these third parties to access your personal information to the extent reasonably necessary for them to provide their services. If required by applicable law, we enter into specific data protection agreements with them. Our service providers may be located in the EU, U.S, Canada, or other foreign jurisdictions. Our main service providers are:
•        Amazon Web Services
•        Okta - Auth0

IND is not responsible for the privacy and security practices of any other website(s) noted in this privacy policy, or the content contained in it.

Where we share your personal information with third parties located in countries that have not been deemed Adequate by the European Commission, we make sure that we implement appropriate safeguards to protect your personal information by executing the relevant module of the EU Standard Contractual Clauses.

If we have a change in policy

The clinical study sponsor or IND reserves the right to change its practices and affect new policy to enhance the privacy standards of research participant records.  You will be informed of changes at your research visits.  This office will also post changes to this notice on our website.

For additional information or to report a problem

For further explanation of this notice, you may contact IND’s Privacy Officer at
(203) 590-5600. If you believe your privacy rights have been violated, you have the right to file a complaint with this office by contacting the individual above.

You can also file a complaint with the relevant European Data Protection  Authority. For example, the Irish Data Protection Commission - Homepage | Data Protection Commission.