Privacy Policy

BOOTSTRAPP PRIVACY POLICY.

Effective: October 18th, 2024

The BootstrApp („Company”,“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, and disclosed by the BootstrApp.

This Privacy Policy applies to our app, and its associated subdomains (collectively, our “Service”) alongside our application, BootstrApp. By accessing or using our Service, you signify that you have read, understood, and agree to our collection, storage, use, and disclosure of your personal information as described in this Privacy Policy as well as in the parent and participant information of the BootStRaP research project.

Definitions and key terms

To help explain things as clearly as possible in this Privacy Policy, every time any of these terms are referenced, are strictly defined as:

Cookie: small amount of data generated by a website and saved by your web browser. It is used to identify your browser, provide analytics, and remember information about you such as your language preference or login information.
Company: when this policy mentions “Company,” “we,” “us,” or “our,” it refers to Ulm University, Helmholtzstraße 16, 89081, Ulm, Germany with its acting Department of Molecular Psychology (Department address: Helmholtzstraße 8/1, 89081 Ulm, Germany) that is responsible for your information under this Privacy Policy.
Customer: refers to the company, organisation or person that signs up to use the BootstrApp Service to manage the relationships with your users or service users.
Device: any internet connected device such as a phone, tablet, computer or any other device that can be used to visit the BootstrApp and use the services.
IP address: Every device connected to the Internet is assigned a number known as an Internet protocol (IP) address. These numbers are usually assigned in geographic blocks. An IP address can often be used to identify the location from which a device is connecting to the Internet.
Personal Data: any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person.
Service: refers to the service provided by the BootstrApp.
Third-party service: refers to any websites or services that are being accessed via link from the BootstrApp during the use of the BootstrApp.
App/Application: the BootstrApp app, refers to the SOFTWARE PRODUCT identified above.
You: a person or entity that is registered with the BootstrApp to use the Services.
Joint Controllers: The partners of the BootStRaP research project which have signed the “Agreement on Data Sharing and Joint Controllership on the Processing of Personal data pursuant to art. 26 GDPR”

Information (automatically) collected:

When a participant joins the study, they enter a code into the BootstrApp. This code is linked to their parents’ consent form, but the form is kept separately from the study data to protect their privacy. Once enrolled, each participant is assigned an anonymous code (participant ID) in the BootStRaP project.

We collect answers that participants choose to give when using the BootstrApp during the study. These answers may include personal details such as biological sex, gender identity, age, and school year.

We do NOT collect personal information, such as names, date of birth, financial details, political opinions, genetic or biometric data, IP addresses, addresses, or ethnicity. The mobile sensing data in Table 1 below is automatically collected from devices when using the BootstrApp. The data is encrypted and anonymised before being sent to the secure BootstrApp servers.

Table 1: A full list of data that may be collected from mobile sensing.

The table below lists the types of data that may be collected from smartphones (both Android and iPhone) as part of the study.

Data Collection Table

Data Item	WE ARE COLLECTING	WE ARE NOT COLLECTING
Contact List*	Total number of contacts Time of contact list reading	The contact's name The contact's phone number
Time on phone**	Time and duration screen is on and off Time and duration screen is locked and unlocked Total duration of phone use session
Phone Calls**	When phone calls are made Time spent on a call Type of call: incoming, outgoing, or missed call Hashed value (hiding the actual number) of the contact's phone number Anonymous contact ID	What is being said in the phone call The contact's name Actual phone number of contact
Text Messages (SMS)**	When texts are sent Length of text Type of text: incoming or outgoing Hashed value (hiding the actual number) of the contact's phone number Anonymous contact ID	Content of the text message The contact's name Actual phone number of contact
Installed Apps	Number of apps	What is being done during app use Web page(s) (URL) visited
App Sessions*	When apps are used When app starts When app ends Duration of app use session	App content including Web page(s) (URL) visited
App Statistics	Which apps are used, how often, and for how long per day	App content including Web page(s) (URL) visited
Accelerometer**	Timestamp Linear micro-movements; was the phone moved since the last reading	Exact location Type of movement, i.e., walking, cycling, etc.
Rotation Rate**	Timestamp Rotation-based micro-movements; was the phone moved since the last reading	Exact location Type of movement, i.e., walking, cycling, etc.
Pedometer**	Number of steps per day Distance Ascended/descended floors Pace Cadence	Exact location
Visits**	General type of place visited (e.g., school, home, etc.) How far the place is from home	Exact location
Location*	When at anonymised location Anonymised position Speed	Exact position
Device Information*	Operation system and version Manufacturer Model and version Screen size Version of the BootstrAre

For iPhone users, please note:
*Data items may be collected on both Android and iPhone, but on iPhones, they are collected using a specific Apple method part of the iOS operating system.
**Data items may also be collected on both platforms, but on iPhones, these are collected via Apple’s SensorKit and will only be collected following in-app consent.

How We Use Your Personal Data

We use the collected BootstrApp data as part of the “Boosting Societal Adaptation and Mental Health in a Rapidly Digitalizing, Post-Pandemic Europe” (BootStRaP) research project. The BootStRaP project is being realized by an international multidisciplinary consortium of 22 partners bringing together scientists from 14 countries and 22 institutions. The BootStRaP project is funded by the European Health and Digital Executive Agency (HADEA) under the Grant Agreement No. 101080238. (Horizon Europe website: https://cordis.europa.eu/project/id/101080238; project website: http://www.internetandme.eu/). Within the BootStRaP project all data is disclosed either in aggregate form or with information that can identify you removed. In addition, we contractually prohibit other project partners from attempting to re-identify individuals from data that has been de-identified. Only Joint Controllers within the Framework of the BootStRaP project, are allowed to get access to information that can identify you.

Your personal data will only be collected to fulfil the specific purpose of the research project described herein and it will only be used for that purpose.

We reserve the right to use and disclose non-personal data (e.g., de-identified or aggregate data) for any purpose and also to third parties. For example, we show aggregate questionnaire, performance and mobile sensing measures to users to allow them to evaluate themselves. Moreover, only anonymized data will be made publicly accessible in research repositories.

Governing Law

The applicable data protection law for the BootStRaP project and its Privacy Policy is the GDPR, the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), and any additional locally applicable data protection legislation. Personal data shall be handled in accordance with applicable data protection laws. Fundamental ethical principles outlined under Article 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union, the European Union (EU) Regulation 2016/679 (General Data Protection Regulation (GDPR)) and the United Kingdom (UK) Data Protection Act 2018 (DPA 2018) – applies in so far as it is in conformity with the rules of GDPR.

All disputes arising out of or in relation to the terms of this Privacy Policy that cannot be settled amicably, shall be exclusively referred to the competent courts of Belgium. By using the BootstrApp or contacting us directly, you signify your acceptance of this Privacy Policy. If you do not agree to this Privacy Policy, you should not engage with our app, or use our services. Continued use of the app, further direct engagement with us, following the posting of changes to this Privacy Policy that do not significantly affect the use or disclosure of your personal information will mean that you accept those changes.

Information about General Data Protection Regulation (GDPR)

We may be collecting and using information from you if you are from the European Economic Area (EEA), and in this section of our Privacy Policy we are going to explain exactly how and why this data is collected, and how we maintain this data under protection from being replicated or used in the wrong way.

What is GDPR?

GDPR is an EU-wide privacy and data protection law that regulates how the personal data of the EU residents’ may be processed and transferred and whilst enhances the control of the EU residents over their own personal data.

What is personal data?

Any data that relates to an identifiable or identified individual. GDPR covers a broad spectrum of information that could be used on its own, or in combination with other pieces of information, to identify a person. Personal data extends beyond a person’s name or email address. Some examples include financial information, political opinions, genetic data, biometric data, IP addresses, physical address, sexual orientation, and ethnicity.

The Data Protection Principles include requirements such as:

Personal data collected must be processed in a fair, legal, and transparent way and should only be used in a way that a person would reasonably expect.
Personal data should only be collected to fulfil a specific purpose and it should only be used for that purpose. Organisations must specify why they need the personal data when they collect it.
Personal data should be held no longer than necessary to fulfil its purpose.
Data subjects have the right to access their own personal data. They can also request a copy of their data, and that their data be updated, deleted, restricted, or moved upon request to another organisation.

Why is GDPR important?

GDPR adds some new requirements regarding how companies should protect individuals’ personal data that they collect and process. It also raises the stakes for compliance by increasing enforcement and imposing greater fines for breach. At BootstrApp we strongly believe that your data privacy is very important and we already have necessary security and privacy practices in place.

Individual Data Subject’s Rights – Data Access, Portability and Deletion

The BootstrApp processes or stores all personal data in fully vetted, DPA compliant vendors. In order to access Your user data, please reach out to bootstrapproject@herts.ac.uk. This is only possible until all identifying information is removed. All identifying data will be removed from the electronic data collected once the study is complete and will not be archived. After completion of the study and reporting of results, the anonymised data will be retained for at least 10 years for use in future research. Datasets uploaded to repositories, as required, will be completely anonymised. All users can withdraw their prior consent to the study participation by means of the BootstrApp and the processing of personal data at any time. The deletion of data up to the point of withdrawal of given consent is not possible. After deleting the BootstrApp, no personal data that was collected by the BootstrApp, remains on the smartphone of the user.

a) Right of access pursuant to Article 15 of the GDPR

You have the right to obtain from us information about the personal data concerning you, including for example about the purposes of their processing and the period of their storage.

b) Right to rectification pursuant to Article 16 of the GDPR

You have the right to obtain the rectification of inaccurate personal data concerning you.

c) Right to erasure pursuant to Article 17 of the GDPR

You have the right to obtain from us the erasure of personal data concerning you. Pursuant to Article 17(1) of the GDPR.

You have the right to prevent, for the time being, the further processing of the personal data concerning you where one of the grounds set out in Article 18(1) of the GDPR applies.

d) Right to withdrawal of consent under data protection law

You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The withdrawal of consent shall only apply with effect for the future. Therefore, previously given consent can still be used as a legal basis for processing based on consent before its withdrawal. In addition, consent must be given in an informed manner (Artt. 13, 14 GDPR).

You can refuse or withdraw your consent at any time without any disadvantages.

e) Right to lodge a complaint with a supervisory authority pursuant to Article 77 of the GDPR

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

Your Consent

By using our BootstrApp, you hereby consent to our Privacy Policy and agree to its terms. Your consent is the legal basis of processing your personal Data According to GDRP (Art. 9 para. 2 lit a GDPR). Before data collection starts an unambiguous declaration of consent by the user that he/she agrees to the processing is required. An active behaviour is necessary. The user is being informed during the consent process in the BootstrApp about who the controller is and for which purposes the personal data shall be processed. The user is being informed about the nature of the data processed and about the right to withdraw his/her consent at any time.

Third-Party Services

This Privacy Policy applies only to the BootstrApp Services. We may display, include or make available third-party content (including data, information, applications and other products services) or provide links to third-party websites or services (“Third-Party Services”). Hence these Services may contain links to Third-Party Content and Services not operated or controlled by the BootstrApp. Please remember that when you use a link to go from the Services to other Third-Party Services, our Privacy Policy is no longer in effect.

You acknowledge and agree that the BootstrApp shall not be responsible for any Third-Party Services, including their accuracy, completeness, timeliness, validity, copyright compliance, legality, decency, quality or any other aspect thereof. The BootstrApp does not assume and shall not have any liability or responsibility to you or any other person or entity for any Third-Party Services.

Third-Party Services and links thereto are provided solely as a convenience to you and you access and use them entirely at your own risk and subject to such third parties’ terms and conditions.

Cookies

The BootstrApp doesn’t use “Cookies” to identify the areas of our app that you have visited.

Kids’ Privacy

We collect information from kids under the age of 13 just to better our services. If you are a parent or guardian and you are aware that your child has provided us with Personal Data without your permission, please contact us. If we become aware that we have collected Personal Data from anyone under the age of 13 without verification of parental consent, we take steps to remove that information from our servers.
Parents who believe that their child has submitted personal information to us and would like to have it deleted can contact us at bootstrapproject@herts.ac.uk.

Changes to Our Privacy Policy

We may need to make changes to this Privacy Policy so that they accurately reflect our Service and policies. Unless otherwise required by law, we will notify you (for example, through our Service) before we make changes to this Privacy Policy and give you an opportunity to review them before they go into effect. Then, if you continue to use the Service, you will be bound by the updated Privacy Policy. If you do not want to agree to this or any updated Privacy Policy, you can delete your account.