Privacy Policy

Protecting your privacy is very important to us. We do not collect any personally identifiable information (PII) about you during your visit to the NIH Intramural Research Program (IRP) Web site unless you choose to provide it to us. We do, however, collect some data about your visit to our Web site to help us better understand how the public uses the site and how to make it more helpful. We collect information from visitors who read, browse, and/or download information from our Web site. NIH IRP never collects information for commercial marketing or any purpose unrelated to the NIH IRP mission and goals.

When visitors send e-mail messages containing personal information to the general IRP.NIH.gov e-mail box IRPinfo@mail.nih.gov, IRP staff responds to the letters and files them. Only designated staff members requiring access to the e-mails to respond may view or answer them.

TYPES OF INFORMATION COLLECTED

When you browse through any Web site, certain information about your visit can be collected. We automatically collect and temporarily store the following type of information about your visit:

• Domain from which you access the Internet
• IP address (an IP address is a number that is automatically assigned to a computer when surfing the Web)
• Operating system and information about the browser used when visiting the site
• Date and time of your visit
• Pages you visited
• Address of the Web site that connected you to the NIH IRP Web site (such as google.com or bing.com)

We use this information to measure the number of visitors to our site and its various sections and to help make our site more useful to visitors.

HOW NIH IRP COLLECTS INFORMATION

The NIH IRP Web site uses a variety of different Web measurement software tools and specific information regarding information collection can be found on this site.

IRP.NIH.gov uses Google Analytics measurement software to collect the information in the bulleted list in the Types of Information Collected section above. Google Analytics collects information automatically and continuously. No personally identifiable information is collected. The IRP staff conducts analyses and reports on the aggregated data from Google Analytics. The reports are only available to IRP.NIH.gov managers, members of the IRP.NIH.gov Communications and Web Teams, and other designated staff who require this information to perform their duties.

IRP also uses online surveys to collect opinions and feedback from a random sample of visitors. IRP.NIH.gov uses the ForeSee Results’ American Customer Satisfaction Index (ACSI) online survey to obtain feedback and data on visitors’ satisfaction with the IRP.NIH.gov Web site. This survey does not collect personally identifiable information. Although the survey invitation pops up for a random sample of visitors, it is optional. If you decline the survey, you will still have access to the identical information and resources at the IRP.NIH.gov site as those who do not take the survey. The survey reports are available only to IRP.NIH.gov managers, members of the IRP.NIH.gov Communications and Web Teams, and other designated staff who require this information to perform their duties.

IRP retains the data from Google Analytics and ACSI survey results as long as needed to support the mission of the IRP.NIH.gov Web site.

HOW NIH IRP USES COOKIES

The Office of Management and Budget Memo M-10-22, Guidance for Online Use of Web Measurement and Customization Technologies allows Federal agencies to use session and persistent cookies.

When you visit any Web site, its server may generate a piece of text known as a “cookie” to place on your computer. The cookie allows the server to “remember” specific information about your visit while you are connected.

The cookie makes it easier for you to use the dynamic features of Web pages. Cookies from NIH IRP Web pages only collect information about your browser’s visit to the site; they do not collect personal information about you.

There are two types of cookies, single session (temporary) and multi-session (persistent). Session cookies last only as long as your Web browser is open. Once you close your browser, the cookie disappears. Persistent cookies are stored on your computer for longer periods.

Session Cookies: We use session cookies for technical purposes such as to enable better navigation through our site. These cookies let our server know that you are continuing a visit to our site. The OMB Memo 10-22 Guidance defines our use of session cookies as “Usage Tier 1—Single Session.” The policy says, “This tier encompasses any use of single session web measurement and customization technologies.”

Persistent Cookies: We use persistent cookies to enable Google Analytics to differentiate between new and returning IRP.NIH.gov visitors. Persistent cookies remain on your computer between visits to IRP.NIH.gov until they expire. We also use persistent cookies to block repeated invitations to take the ACSI survey. The persistent cookies that block repeated survey invitations expire in 90 days. The OMB Memo 10-22 Guidance defines our use of persistent cookies as “Usage Tier 2—Multi-session without Personally Identifiable Information (PII).” The policy says, “This tier encompasses any use of multi-session Web measurement and customization technologies when no PII is collected.”

HOW TO OPT OUT OR DISABLE COOKIES

If you do not wish to have session or persistent cookies placed on your computer, you can disable them using your Web browser. If you opt out of cookies, you will still have access to all information and resources at IRP.NIH.gov. Instructions for disabling or opting out of cookies in the most popular browsers are located at https://www.usa.gov/optout-instructions. Please note that by following the instructions to opt-out of cookies, you will disable cookies from all sources, not just those from IRP.NIH.gov.

HOW PERSONAL INFORMATION IS PROTECTED

You do not have to give us personal information to visit the NIH IRP Web site. However, if you choose to receive alerts or e-newsletters, we collect your e-mail address to complete the subscription process.

If you choose to provide us with personally identifiable information, that is, information that is personal in nature and which may be used to identify you, through an e-mail message, request for information, paper or electronic form, questionnaire, customer satisfaction survey, epidemiology research study, etc., we will maintain the information you provide only as long as needed to respond to your question or to fulfill the stated purpose of the communication. If we store your personal information in a record system designed to retrieve information about you by personal identifier (name, personal e-mail address, home mailing address, personal or mobile phone number, etc.), so that we may contact you, we will safeguard the information you provide to us in accordance with the Privacy Act of 1974, as amended (5 U.S.C. Section 552a).

If NIH IRP operates a record system designed to retrieve information about you in order to accomplish its mission, a Privacy Act Notification Statement should be prominently and conspicuously displayed on the public-facing website or form which asks you to provide personally identifiable information. The notice must address the following 5 criteria:

• NIH IRP legal authorization to collect information about you
• Purpose of the information collection
• Routine uses for disclosure of information outside of NIH IRP
• Whether the request made of you is voluntary or mandatory under law
• Effects of non-disclosure if you choose to not provide the requested information

For further information about the NIH IRP privacy policy, please contact the NIH Senior Official for Privacy at privacy@mail.nih.gov, call 301-451-3426 or visit https://oma.od.nih.gov/DMS/Pages/Privacy-Program.aspx.

HOW IRP.NIH.GOV USES THIRD-PARTY WEB SITES AND APPLICATIONS

Third-Party Web sites and Applications (TPWA) are Web-based technologies that are not exclusively operated or controlled by NIH IRP, such as non-.gov hosted applications and those embedded on an NIH IRP Web pages that could cause personally identifiable information (PII) to become available or accessible to NIH IRP, regardless of whether NIH IRP solicits or collects it.

As part of the Open Government Directive, IRP.NIH.gov uses a variety of new technologies and social media options to communicate and interact with citizens. These sites and applications include popular social networking and media sites, open source software communities and more. The following list includes the Web sites and applications we use and their purposes. For any sites or applications that collect PII, this list also includes details on information collected and how NIH IRP protects your private information.

Data Safeguarding and Privacy

All uses of Web measurement and customization technologies will comply with existing policies with respect to privacy and data safeguarding standards. Information Systems (IT) systems owned and operated by NIH IRP are assessed using Privacy Impact Assessments posted for public view on the Department of Health and Human Services Web site. Groups of records that contain information about an individual and are designed to be retrieved by the name or other personal identifier linked to the individual are covered by the Privacy Act of 1974, as amended (5 U.S.C. Section 552a). For these records, NIH Systems of Record Notices are published in the Federal Register and posted on the NIH Senior Official for Privacy Web site. For more information, please refer to the NIH Privacy Policy posted on the NIH.gov Web site. When you visit the NIH Institute/Center sites, please look for the Privacy Notice posted on the main pages. When Web measurement and customization technologies are used, the Privacy Policy/Notice must state:

• Purpose of the web measurement and/or customization technology;
• Usage Tier, session type, and technology used;
• Nature of the information collected;
• Purpose and use of the information;
• Whether and to whom the information will be disclosed;
• Privacy safeguards applied to the information;
• Data retention policy for the information;
• Whether the technology is enabled by default or not and why;
• How to opt-out of the web measurement/customization technology;
• Statement that opting-out still permits users to access comparable information or services; and,
• Identities of all third party vendors involved in the measurement and customization process.

Data Retention and Access Limits NIH will retain data collected using the following technologies long enough to achieve the specified objective for which they were collected. The data generated from these activities falls under the National Archives and Records Administration (NARA) General Records Schedule (GRS) 20-item IC ‘Electronic Records,’ and will be handled per the requirements of that schedule.

Third-Party Web Sites and Applications

Bit.ly: NIH IRP uses bit.ly to shorten long URLs for use in e-mail messages, Twitter feeds and on Facebook pages. Bit.ly collects and provides data on how often e-mail recipients, Facebook and Twitter-users click on the shortened URLs distributed by IRP.NIH.gov staff. Bit.ly analytics show how many people clicked on the URLs posted by NIH IRP compared to the total number of clicks on the shortened URLs. Bit.ly analytics do not provide any personally identifiable information about the visitors who opened the shortened links. The Bit.ly Privacy policy is available at: https://bitly.com/pages/privacy

Facebook: On the IRP.NIH.gov Facebook page, IRP.NIH.gov staff posts news and other items of interest to citizens. If you have a Facebook account or ‘Like’ NIH IRP Facebook pages, you can post comments or click on the ‘like’ option for individual entries. If you comment or click on the ‘like’ button, personally identifying information will be visible to NIH IRP staff and other Facebook site visitors. The amount of visible personal information will depend on your own Facebook privacy settings. You can completely avoid displaying any personally identifiable information by not creating an account, not posting comments and not clicking on the ‘like’ options in Facebook. NIH IRP staff does not collect, use or disclose any information about visitors who comment or ‘like’ the NIH IRP Facebook site. Facebook collects and reports on non-personally identifiable information about activities on Facebook pages. This information is password protected and only available to IRP.NIH.gov managers, members of the IRP.NIH.gov Communications and Web Teams, and other designated staff who require this information to perform their duties. The Facebook privacy policy is available at: https://www.facebook.com/policy.php

LISTSERV Subscription Management: NIH IRP uses LISTSERV to send e-newsletters, alerts and other messages to visitors who subscribe to them. LISTSERV does not collect and store any personal information other than the name and e-mail address (and, optionally, a password) of any individual who asks to subscribe to a list. Name and e-mail address information is stored on the LISTSERV machine in the form of subscriber lists, one for each list on the site. Access to subscriber list(s) is controlled by the list owner. LISTSERV utilizes an optional password system for security purposes. Passwords are required for most list owner functions and some user functions. Password information is stored on the LISTERV machine, but is only readable by the LISTSERV machine itself, and is used solely for verifying access privileges within LISTSERV. The LISTSERV privacy policy is available at: https://list.nih.gov/LISTSERV_WEB/privacy.htm

Twitter: NIH IRP uses Twitter to send short messages (up to 140 characters) or ‘Tweets’ to share information about NIH IRP with visitors and respond to comments and inquiries sent via Twitter to NIH IRP. While visitors may read the NIH IRP Twitter feeds without subscribing to them, visitors who want to subscribe to (or follow) NIH IRP Twitter feeds must create a Twitter account at www.twitter.com. To create an account, you must provide some personal information, such as name, user name, password and e-mail address. Visitors have the option to provide additional personal information including a short biography, location or a picture. Most information you provide for a Twitter account is available to the public, but you can modify how much of your information is visible by changing your privacy settings at the Twitter.com Web site. NIH IRP staff members monitor the number of subscribers and respond to comments and queries via Twitter, but the staff never takes possession of the personal information belonging to Twitter followers. NIH IRP does not collect, maintain, disclose or share any information about people who follow NIH IRP on Twitter. The Twitter privacy policy is available at: https://twitter.com/privacy

YouTube: IRP.NIH.gov posts videos on YouTube to make them available to all IRP.NIH.gov visitors. You do not need to register with either YouTube or Google (YouTube owner) to watch IRP.NIH.gov videos. When visitors watch videos, YouTube may record non-personally identifiable information about its site usage, such as channels used, videos watched, and data transfer details to improve its services. If you log on to the YouTube site before watching NIH IRP videos, YouTube may associate information about your site use with your YouTube account. If you log on to YouTube and comment on an NIH IRP video, any personal information you included when registering for your account will be visible to visitors who click on the comment. If you do not log in before watching NIH IRP videos posted on YouTube, your site use will not be associated with you or a YouTube account. The YouTube privacy policy is available at: https://www.google.com/intl/en/policies/privacy/