This Privacy Policy explains the policies put in place by the National Bleeding Disorders Foundation (NBDF) to protect the participants’ information and privacy as they interact with the CVR registry. Your participation in CVR constitutes acceptance of this Privacy Policy and our Terms of Use.
National Bleeding Disorders Foundation
Established in 1948, the National Bleeding Disorders Foundation (NBDF) is dedicated to finding better treatments and cures for inheritable bleeding disorders and preventing the complications of these disorders through education, advocacy and research. Its programs and initiatives are made possible through the generosity of individuals, corporations and foundations as well as through a cooperative agreement with the Centers for Disease Control and Prevention (CDC).
Information Security through ArborMetrix
ArborMetrix is a third-party data collection warehouse that operates the registry database where the information for the CVR surveys is stored. ArborMetrix has a non-disclosure agreement with NBDF and will not share CVR data with any third parties. ArborMetrix is compliant with applicable industry security standards. CVR requires all its service providers to implement and maintain accepted industry-standard administrative, physical and technical safeguards to protect Personal Information.
ArborMetrix staff follow strict guidelines for confidentiality. Access to identified information is limited to essential personnel based on job function and role only to ensure the proper functioning of the infrastructure and web portal. These personnel may be either ArborMetrix or NBDF staff who are specifically assigned to work within CVR’s database. CVR access controls include multi-factor authentication, single sign-on, and a strict “least-privileged” authorization policy. Least privilege is a powerful security principle which states that no single person or entity should be able to access information or exercise privileges beyond what is absolutely necessary to perform their assigned role. Each entry into the database is user, date-and timestamped for internal monitoring and auditing purposes.
ArborMetrix uses industry-standard security measures to encrypt sensitive personal data both when it is stored (data-at-rest) and when it is being transmitted (data-in-flight). Additionally, ArborMetrix segments data across logical database systems to further prevent identifiability.
ArborMetrix cloud storage provides secure storage for information in CVR databases, ensures that their infrastructure can support continued use of CVR customers, and protects data in the event of a natural disaster or other disruption to CVR. ArborMetrix works proactively to protect participants’ data by using state-of-the-art intrusion detection and prevention measures to stop any potential attacks against their networks. ArborMetrix has integrated continuous vulnerability scanning in their processes and regularly engages third party security experts to conduct penetration tests.
CVR Program Overview
CVR’s ultimate goals will be to improve the quality of life (QOL) of individuals living with bleeding disorders and that of their immediate family members as well, identify research questions important to them and, together with other research initiatives contribute to finding a cure.
CVR will be open to all individuals affected by inherited bleeding disorders as well as family members (parents, spouses, grandparents, siblings and children).
CVR is a partnership between the bleeding disorder community and NBDF. CVR is an initiative that will gather information through electronic surveys from people with inherited bleeding disorders and their immediate family members over several years (referred to as a longitudinal research registry). Asking the bleeding disorder community members about their specific experiences living with a bleeding disorder versus having it relayed by others, such as healthcare providers, will offer researchers a valuable perspective.
The data collected will have all personal identifiers removed so individuals cannot be identified by their survey answers. The de-identified answers will be grouped (aggregated) from all CVR participants so researchers can better understand bleeding disorders from the participants’ perspectives.
Based on this information, NBDF will develop educational programs and advocacy efforts tailored to the community’s needs, as well as direct research questions and research funds based upon identified priorities. CVR will provide participants a dashboard to access their personal data as well as the de-identified/aggregate data of others. This novel approach will help participants become more active in their healthcare.
CVR will help researchers understand what it means to live with a bleeding disorder from the participants’ perspectives with the ultimate goal to improve quality of life (QOL), identify trends over time and come up with research questions important to people affected with a bleeding disorder as well as their immediate family members. While research about bleeding disorders is currently available, we don’t have reliable participant-reported information from individuals affected by an inherited bleeding disorder and their immediate family members.
Information Collected
Participation in CVR will always be optional. Information gathered will be confidential and reported in a de-identified aggregate (grouped) manner. That is, all information will be grouped to prevent the identification of individual participants.
Participants will enroll in CVR via an enrollment survey and after completing the initial baseline survey, thereafter they will receive an email with a link to their CVR Personalized Dashboard. Participants will receive annual surveys which will ask the same information year after year (long-term). Additional shorter surveys focused on specific areas of interest will be sent over the course of the year as well.
These surveys will collect data (with identifiable information stripped and replaced with a number, also known as encrypted) such as:
- Name
- Email address
- Date of birth
- Race/ethnicity
- Zip code
- Healthcare provider
- Disorder and information related to the management of that disorder
- Quality of life information including psychosocial information (mental health)
- Insurance information
- Financial information (general, not specific)
In the future, information collected from other sources (for example: electronic logging systems and the American Thrombosis and Hemostasis Network (ATHN)) may potentially be linked to CVR. The linkage of this information will not occur without the participant’s (or legal guardian’s) authorization. In cases where information is collected from other sources, NBDF will adhere to the policies agreed to by the participant through the institution where the data resides.
If a participant decides they no longer wish to participate in CVR, they can opt-out at any time (see below section Right to Withdraw).
How NBDF Uses the Information
Confidential information collected will be aggregated and used to contribute and enhance research efforts already in progress. In addition, NBDF will also use it to improve their education and advocacy programs.
- Research
- Understand what it is like to live with a bleeding disorder
- Develop research questions based on community’s identified needs
- When reporting the information and/or publishing findings, all data will be grouped and de-identified
- Education
- Develop and refine educational opportunities
- Advocacy
- Enhance advocacy efforts at the legislative and payor level to maintain or improve access to care and treatment
How Information is Shared
We do not share your personal or any other individual information with any third parties for marketing or any other purposes.
Children’s Privacy (See OnGuardOnline for more information)
CVR allows parents or legal guardians to set up individual portal accounts for their children. Parents or legal guardians must consent on behalf of their children.
Persons under the age of 13, or any higher minimum age in the jurisdiction where that person resides, are not permitted to create accounts unless their parent has consented in accordance with applicable law. If we learn that we have collected the personal information of a child under the relevant minimum age without parental consent, we will take steps to delete the information as soon as possible. Parents who believe that their child has submitted personal information to us and would like to have it deleted may contact us at Research@hemophilia.orgWe are committed to protecting the privacy of children who use CVR. When we intend to collect information from children, we will:
- Notify parents about our information practices with regards to children, including the types of personal information we may collect, the uses to which we may put that information, and with whom we may share that information
- In accordance with applicable law and our practices, obtain consent from parents for the collection of personal information from their children, or to send information about our products and services directly to their children;
- Limit our collection of personal information from children to no more than is reasonably necessary to participate in an online activity; and give parents the ability to request access to personal information we have collected from their children and the ability to request that the personal information be changed.
Information Accessible to Participants
Participants have access to their own information through their individual portal -referred to the Personalize Dashboard. Participants will also have access to some grouped and de-identified data which will allow them to benchmark some of their metrics with those of others.
The participant may access, correct or update most of their registration information within their account settings. Any information that has been submitted through surveys cannot be deleted from the database.
If participants lose access to their CVR accounts, they may request to regain access by emailing CVR coordinators at Research@hemophilia.org. In certain circumstances, additional information may be requested to verify the individual’s identity before providing access or releasing protected information. If the participant chooses not to submit the required documentation or the information provided is not sufficient for the purposes sought, CVR coordinators may not be able to complete the request.
Right to Withdraw
Participation in CVR is completely voluntary. Participants who later change their minds can stop participating at any time without having to provide a reason why.
To withdraw from CVR, participants should send an email to NBDF CVR coordinators at Research@hemophilia.org. The email should specify if the request is to stop receiving CVR survey invitation and reminder emails. Please keep in mind that information provided prior to the receipt and processing of this request cannot be deleted. However, the information will continue to be treated in the same manner as described above.