Privacy Policy — Stampley AIDES-T2D

The current application supports account registration using an email address, password credential, and study key. Study features include Diabetes Distress Scale (DDS) responses and check-in information such as distress, mood, energy, context tags, reflections, coping actions, and weekly study domain. The application also maintains study progress and Stampley session records.

The project schema includes account and study records. The exact production fields, logs, analytics, and any information collected by the hosting environment must be confirmed by the study and IT teams before this list is final.

Based on current application flows, information is used to register and authenticate participants, administer surveys and check-ins, calculate study progress, maintain study session records, and provide Stampley responses. The study team must confirm the final research, operational, safety, and reporting purposes against the approved protocol and consent documents.

Participant features require an authenticated account; the project documentation describes bcrypt password verification. Administrative pages are restricted to accounts with an administrator role. These implementation details are not a security certification or a guarantee about every system involved.

This draft makes no claim about encryption, HIPAA compliance, or a privacy certification. Institutional privacy and security reviewers must confirm the safeguards, hosting configuration, incident process, and applicable standards before publication.

Submitted check-in information is stored by the application. The current Stampley generation flow sends study and check-in context to OpenAI's API to produce an AI response. The project research-review materials state that consent and external-processing approval for OpenAI remain unresolved. Do not treat this draft as participant disclosure or enable participant use based on this page; the study team must resolve the approved provider, data scope, and consent language first.

The repository also contains voice features whose use is described as disabled unless separately enabled after study approval. Any future audio processing and provider handling require separate review and participant disclosure before use.

Project documentation identifies OpenAI for Stampley generation, Resend for certain account-related email, and Neon PostgreSQL for application data storage. Vercel is described in the repository as a hosting target; the actual environment and any additional providers must be confirmed before publication.

The study team and institutional reviewers must verify each provider's role, information received, contract and data-processing terms, and whether participant consent or other approval is required. This draft does not claim that information is never shared with a service provider.

The project uses a PostgreSQL database for account and study records, including submitted check-ins and Stampley session records. The project materials reviewed for this page do not specify an approved retention period or complete deletion schedule. No retention duration is stated here.

The principal investigator and institutional data/privacy reviewers must determine retention, archival, backup, deletion, and any legal hold requirements and align them with the approved protocol and consent materials.

The application uses signed-in accounts for participant features and an administrator role for administrative pages. The exact people, roles, oversight, export access, and provider access must be confirmed by the study team and institutional reviewers. This draft does not promise that access is limited to a particular named group.

For questions or requests about information associated with you, contact the research team. You may ask how to review, correct, or request deletion of information, or how a request relates to your participation. The process, available rights, timelines, and effect of withdrawal must be supplied from the approved consent materials and applicable institutional requirements; this draft does not promise a particular outcome or response deadline.

This draft has no effective date and is not yet an approved policy. Before publication, the project must name the policy owner, set an effective date, and decide how material changes will be reviewed and communicated to participants.

For research or privacy questions, contact the project team at pcrg@umb.edu. For website support, contact support@aides-t2d.org.