IGNITE Privacy Policy

This Privacy Policy explains how the IGNITE application (“IGNITE,” “the app,” “we,” “us,” or “our”) collects, uses, stores, shares, and deletes your information — including any information we access through the Google Health API — when you use IGNITE as part of the IGNITE research study.

1. Overview

IGNITE is a research application, not a commercial consumer product. It is provided to participants enrolled in the IGNITE study — a study evaluating whether a fully digital program can help racial and ethnic minority adults ages 50–74 manage low mood and weight. Because IGNITE handles health and fitness information, we take particular care with how that information is collected and protected. This policy is written to be clear and understandable, and it applies to all IGNITE users.

2. Who we are (Data Controller)

IGNITE is operated by the Vitoux Program on Clinical Research for Equitable Health, Department of Medicine, University of Illinois Chicago (“UIC”), in collaboration with Washington University in St. Louis. The study is funded by the National Institute on Aging (NIA) of the National Institutes of Health (NIH).

• Principal Investigator: Jun Ma, MD, PhD — Beth and George Vitoux Professor of Medicine; Director, Vitoux Program on Clinical Research for Equitable Health; Department of Medicine, UIC
• Multiple Principal Investigator: Thomas Kannampallil, PhD — Associate Professor, Department of Anesthesiology, Washington University School of Medicine in St. Louis
• Mailing address: 840 South Wood Street, Clinical Sciences North, Room 401C, MC 718, Chicago, IL 60612
• Study contact: vcare-support@uic.edu  ·  (312) 413-9830

3. Information we collect

We collect the following categories of information:

4. Data we access through the Google Health API

With your permission, IGNITE connects to your Fitbit device through the Google Health API using Google’s secure OAuth authorization. We follow the principle of minimum necessary access — we only request the permission scopes required for IGNITE’s features.

What we request and why

• Activity (steps, distance, active minutes, activity sessions) — to track your movement toward your goals and personalize coaching.
• Sleep (sleep duration and summaries) — to help your coach understand patterns that affect mood and energy.
• Heart rate (resting and activity heart rate) — to provide an accurate picture of your activity and progress.

Note: The exact data scopes IGNITE requests are shown to you on the Google authorization screen before you grant access, and they match the list above.

5. How we use your information

We use the information we collect only to:

• Provide and personalize the IGNITE program, including coaching from Lumen and your progress feedback;
• Track outcomes relevant to the study (mood and weight) and support your participation;
• Conduct the approved research analyses described in your informed consent;
• Maintain the security, integrity, and proper functioning of the app;
• Communicate with you about the study and provide support;
• Comply with applicable laws, regulations, and research-oversight requirements.

We do not use your data to build advertising profiles, to train unrelated machine-learning models, or for any purpose outside the scope of this research study.

6. Limited Use of Google user data

In keeping with these requirements, our use of data obtained from the Google Health API is limited to providing and improving the user-facing features described in this policy. We do not transfer this data to third parties except as needed to provide these features (with your consent), for security purposes, to comply with applicable law, or in connection with a merger or acquisition with your prior consent. We do not allow humans to read this data except in the limited circumstances permitted by the policy (such as with your explicit consent, for security, to comply with law, or when the data has been aggregated and anonymized for internal operations). We never sell Google user data, use it for advertising, use it for credit or lending decisions, or use it in connection with a regulated medical device.

7. How and with whom we share information

We share information only as necessary for the study and as described in your informed consent. We do not sell your data. Specifically, your information may be shared with:

• The study research team at UIC and Washington University in St. Louis, who use it to run the study and support you;
• Service providers / processors that host or process data on our behalf under contract and confidentiality obligations (for example, secure cloud hosting and the transcription/speech services used by the coaching feature);
• The University’s Institutional Review Board (IRB) and the UIC Office for the Protection of Research Subjects, for ethical oversight;
• The study sponsor, the National Institute on Aging (NIA) of the NIH, and other government or regulatory bodies responsible for oversight of research (for example, the Office for Human Research Protections, OHRP);
• Others as required by law, or to protect the safety, rights, or health of participants.

Whenever possible, data shared for analysis is de-identified. We do not share Google Health API data with any party for advertising, data-brokering, or any purpose unrelated to this research.

8. How we store and secure your information

We protect your information using administrative, technical, and physical safeguards, including:

• Encryption of data in transit (HTTPS/TLS) and at rest;
• Access controls that limit data access to authorized study personnel on a need-to-know basis, with authentication and audit logging;
• Separation of identifiers — your direct identifiers (such as name, phone, and address) are stored separately from study and health data and linked only by a coded study ID;
• Secure, access-controlled storage on University-managed or contracted systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security; however, we work to protect your information and to promptly address any issues that arise.

9. How long we keep your information

We retain study data for as long as needed to fulfill the purposes described in this policy and to meet the research, legal, and regulatory record-keeping requirements that apply to NIH-funded human-subjects research. We do not keep cached copies of Google Health API data longer than permitted, and we delete or de-identify data when it is no longer needed for these purposes. Specific retention periods are described in the IRB-approved study protocol and in the informed consent documents you received upon enrollment.

10. Deleting your data & revoking access

You have several ways to control your data:

Disconnect your device from IGNITE

You can revoke IGNITE’s access to your Google Health API / Fitbit data at any time:

• Within the IGNITE app settings, choose to disconnect your device; or
• Through your Google Account at myaccount.google.com/permissions and/or your Fitbit account settings, remove IGNITE’s access.

After you revoke access, IGNITE stops collecting new data from the Google Health API.

Request deletion of your data

To request deletion of data we hold about you, contact us at vcare-support@uic.edu. Upon request, we will delete or de-identify your personal data, except where we are required to retain certain records to comply with legal, regulatory, or research-integrity obligations governing the study (in which case we will explain what must be retained and why). Withdrawing from the study does not affect any care or benefits you are otherwise entitled to.

11. Additional safeguards for research data

Because IGNITE is used for health research, we also comply with the Google Health API User Data and Health Research Policy. This means, among other things, that:

• The study is reviewed and approved by an Institutional Review Board (IRB) whose role is to protect the rights, safety, and wellbeing of participants;
• Each participant provides informed consent before participating, and receives a copy of the documents they sign;
• We limit use of participant data to the study’s intended purpose, de-identify data to the greatest extent possible, and do not use or share participant data with third parties for unrelated, new research.

12. Your privacy rights

Depending on where you live, you may have rights to access, correct, or delete your personal information, and to withdraw consent. Health information collected in connection with the study may also be protected under HIPAA; the study’s separate HIPAA Authorization (provided during consent) describes those protections. To exercise any right, contact us using the details in Section 15.

For questions about your rights as a research participant, you may also contact:

• UIC Office for the Protection of Research Subjects (OPRS): (312) 996-1711 or toll-free 1-866-789-6215 — uicirb@uic.edu
• University of Illinois HIPAA Privacy Office: (844) 341-2201 — hipaa@uillinois.edu

13. Children’s privacy

IGNITE is intended only for adults enrolled in the IGNITE study (generally ages 50–74). It is not directed to children, and we do not knowingly collect information from anyone under 18.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify participants. Your continued use of IGNITE after an update means you accept the revised policy.

15. Contact us

If you have questions, concerns, or requests about this policy or your data, contact: