Privacy Policy · FORM DCC

This policy explains what information formdcc.com (the "Site") collects, how it is used, and who it is shared with. The Site is operated by the FORM Data Coordinating Center (the "DCC", "we", "us") at Baylor College of Medicine. It lets members of the FORM organization on DNAnexus request access to data, describe new data collections, request export reviews, and manage their projects in the FORM Trusted Research Environment (TRE).

Information we collect

From DNAnexus when you log in. You log in with your DNAnexus account. With your permission, DNAnexus tells us your DNAnexus username, and nothing else about your account: not your email address, and never your password. We also ask DNAnexus whether you are a member or an administrator of the FORM organization, to decide whether you may use the Site.
From the DCC's records. When you asked for a FORM TRE account, the DCC recorded your request, including your name, email address and institution, in Wrike. The Site looks those up by your DNAnexus username, to show them to you and to include them in the requests you submit.
What you submit. The information you enter into the Site's forms, such as a request's title, research purpose and collaborators, and any documents you upload with it.
Technical information. Like most websites, our web server records each request it receives: your IP address, the date and time, the page requested, and the browser's user-agent string. We use these logs only to operate and secure the Site.

We do not ask for, and the Site does not need, any other personal information.

Cookies

The Site uses only the cookies it needs to log you in:

formdcc_session keeps you logged in for up to 12 hours, or until you log out. It holds only your DNAnexus username, encrypted so that only the Site can read it.
formdcc_login lasts up to 10 minutes while you log in, and holds random security values that protect the login from forgery.

We do not use analytics, advertising or tracking cookies, and we do not allow third parties to set cookies through the Site. DNAnexus may set its own cookies when you log in on its site; those are covered by DNAnexus's privacy policy.

How we use information

to log you in and confirm that you are a member of the FORM organization
to send your requests to the DCC, and to show you your requests and whether they are approved
to set up the TRE projects and data access that your approved requests allow
to keep the Site secure, and to find and fix problems

We do not use your information for advertising or marketing, and we do not sell it.

Where information is stored

The Site does not keep its own database of users or requests. Your login lives in your browser's cookie. When you submit a form, the Site sends it, with any documents you upload, to Wrike, the service the DCC uses to track and review requests, and stores it there. Temporary copies made while sending are deleted right away. Information from DNAnexus and Wrike, such as lists of projects and files, may be cached on our server for a few minutes to make pages load faster. Web server logs are deleted automatically after about two weeks.

The Site's server is hosted by Amazon Web Services in the United States.

Who we share information with

We do not sell, rent or trade your information. We share it only:

with the people who handle your request. DCC staff and the reviewers and committees responsible for FORM data see what you submit, in order to review it.
with other FORM members, after review. Some details of an approved request, such as the name and description of a new data collection, may be shown to other logged-in members of the FORM organization once the DCC has reviewed them.
with the services that run the Site. DNAnexus (logging in, TRE projects and data), Wrike (storing requests) and Amazon Web Services (hosting). The Site's pages also load their styles and icons from the Web Awesome content delivery network, which, like any website your browser contacts, receives your IP address and browser information. Each of these services handles information under its own privacy policy.
when the law requires it. We may disclose information if required to by law, court order or other legal process, or when necessary to protect the security of the Site, FORM data or the research participants it describes.

Security

All traffic to the Site is encrypted with HTTPS. Login cookies are encrypted and cannot be read by scripts on the page. Only members of the FORM organization on DNAnexus can log in, and we remove access promptly when someone leaves the organization. No system is perfectly secure, but we take reasonable measures to protect the information we handle.

How long we keep information

The Site itself keeps information only briefly, as described above. Requests stored in Wrike are kept as long as needed to administer FORM data access and to meet the record-keeping requirements of the FORM program and Baylor College of Medicine.

Your choices

You can log out at any time, which deletes the Site's login cookie, and you can delete cookies in your browser's settings. You can ask the DCC to see, correct or delete information about you. We will do so unless we must keep it, for example as a record of who was granted access to data.

Members outside the United States

FORM includes members in the European Union, Australia and elsewhere. If you use the Site from outside the United States, your information is sent to and handled in the United States, and by the services listed above, which may also process it in other countries.

If you are in the European Economic Area, the United Kingdom or Switzerland, we process your information because it is necessary to run the FORM program you take part in, and to keep the Site and FORM data secure (our legitimate interests). Besides the choices above, you may ask us to restrict or stop using your information, or to give you a copy of it, and you may complain to the data protection authority where you live.

Children

The Site is for researchers and is not directed to children. We do not knowingly collect information from children under 13.

Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the effective date above.

Contact us

Questions about this policy or your information can go to the FORM DCC through your usual DCC contact, or by mail to the FORM Data Coordinating Center, Baylor College of Medicine, One Baylor Plaza, Houston, Texas 77030, USA.