Institutional Review Board (IRB) Information
ExpiWell Data Security and Privacy information
• ExpiWell uses industry best standards to protect customer data and data collected for research.
• Our servers are protected by high-end firewall systems, and scans are performed regularly to ensure that any vulnerabilities are quickly found and patched.
• ExpiWell uses Transport Layer Security (TLS) encryption, or HTTPS, for all transmitted data. All stored data is encrypted at rest using a standard Amazon EBS encryption protocol.
• Our services are hosted by Amazon Web Services (AWS) which is a well-known and trusted data center that meets the requirements of security-sensitive organizations while providing data privacy.
o As further discussed in the web link: https://aws.amazon.com/compliance/dataprivacy-faq/ “AWS’s alignment with ISO 27018 has been validated by an independent third party assessor. ISO 27018 is the first International code of practice that focuses on protection of personal data in the cloud. It is based on ISO information security standard 27002 and provides implementation guidance on ISO 27002 controls applicable to Personally Identifiable Information (PII) processed by public cloud service providers. This demonstrates to customers that AWS has a system of controls in place that specifically address the privacy protection of their content.”
• ExpiWell subscribers control their users and their data. Therefore, it is important for subscribers to practice sound security practices by using strong account passwords, not storing passwords in easily accessible places, and restricting access to their accounts to authorized persons who can access data.
• ExpiWell Makers control their users and their own data. Makers may request any of their data to be deleted and it will immediately be removed from ExpiWell’ databases. To make a deletion request, Maker must select the item they wish to delete and confirm they would like to send their request. ExpiWell performs daily backups and thus the deleted data will be retained for a set period of time. After this retention period (8 days), the Data will be automatically removed from ExpiWell’ servers.
Personally Identifiable Information (PII) and Passive info
• ExpiWell collects sensitive information and follows industry standards to protect this data (see above). Information that may be collected include: first name, last name, date of birth, ethnicity, gender, country and state.
• This information collected is for the purpose of building a Taker’s ExpiWell profile and not shared with Makers at any time.
• Submission data may also include sensitive information, but will not include profile information and both are protected under our Data Protection practices.
• ExpiWell currently collects only two forms of passive information.