Privacy Policy - Echo App
mHealth Research Group Privacy Policy - Echo app
Last modified: September 15th, 2026
The mHealth Research Group and its collaborators understand the importance of protecting the privacy of personal information. The Echo (or Echo mHealth) application was developed as part of the PAGE research study to support the development of new mobile phone apps intended to help people share information that health researchers care about in a more enjoyable and less burdensome way. The project is approved by an institutional review board (IRB) at Northeastern, and participants in the experiments must provide informed consent. The IRB is responsible for the protection of the rights and privacy of human subjects who participate in the study.
Our Privacy Policy explains:
Information we collect
To support the goals of the PAGE study, we plan to collect the following information. When users install the app, we walk them through each type of data we collect, including data types necessary for the app to operate and data types users can opt in or out of. Data types labeled Optional can be shared or not shared based on a user's preferences, and users can change the data sharing settings at any time in the Echo app.
How we use information we collect
We will use the collected information for scientific research purposes only, which are described in the informed consent document that all people using the software must agree to.
This app was created by non-profit institutions for non-profit research purposes.
The data collected are strictly controlled and limited to trained personnel on the research teams, all of whom have undergone special research training in the protection of human subjects and their data.
The data collected are analyzed using various research methodologies, and the results of our work will eventually be published in scientific presentations and papers.
Data is always deidentified before presentation.
Transparency and choice
All users of this application must consent to the use of the application. Those consent forms are study-specific and overseen by our institutional review board (IRB). The consent forms provide additional detail about the nature of data collected and how it is used.
Although typically a protocol does not change during a study, if the protocol does change, it is only with additional approval from the IRB and re-consenting of the users of the application. At that time, they can choose whether to continue participating in the study or not.
All collected user data are stored as encrypted files on the phone. Consent forms specify the rights of subjects with regard to data access. Participants always have the right to have their data deleted, should they change their mind about participation in a study.
Information we share
Data is not shared with anyone outside of the trained research team, unless those data are completely deidentified, in compliance with procedures mandated by our IRB.
Aggregated, de-identified data will be presented in research publications in scientific journals and conferences.
Information security
We work hard to protect the users of this app from unauthorized access to or use of the data collected. In particular:
Changes
Our Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without a user’s explicit consent. We will post any privacy policy changes on this page and, if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of privacy policy changes). We will also keep prior versions of this Privacy Policy in an archive for your review.
If you have questions or concerns about this Privacy Policy, please contact us.
Last modified: September 15th, 2026
The mHealth Research Group and its collaborators understand the importance of protecting the privacy of personal information. The Echo (or Echo mHealth) application was developed as part of the PAGE research study to support the development of new mobile phone apps intended to help people share information that health researchers care about in a more enjoyable and less burdensome way. The project is approved by an institutional review board (IRB) at Northeastern, and participants in the experiments must provide informed consent. The IRB is responsible for the protection of the rights and privacy of human subjects who participate in the study.
Our Privacy Policy explains:
- What personal data we collect and why we collect it.
- How we use personal data collected.
- How we secure data.
Information we collect
To support the goals of the PAGE study, we plan to collect the following information. When users install the app, we walk them through each type of data we collect, including data types necessary for the app to operate and data types users can opt in or out of. Data types labeled Optional can be shared or not shared based on a user's preferences, and users can change the data sharing settings at any time in the Echo app.
- Device usage information, such as when a user interacts with a device, what apps are installed and uninstalled, what apps are used and for how long, when WiFi is switched on and off, and when the mobile device is charged or discharged.
- Device-specific information (such as the phone’s hardware model, operating system version, unique device identifiers, WiFi status, remaining battery, and mobile network information).
- App log information. The deployed devices will automatically collect and store study-specific information from the installed research application or the operating system in log files. This includes:
- Details of how the application was used, such as when the app was running or not running, and when the app uploaded user data to our research server.
- Device event information such as app crashes and system activity.
- (Optional) Sensor information. We will collect internal sensor readings from the smartphone and upload them to our server. These data may include:
- Location. The application will request location information from Android and iOS, which may provide the app with information about current and past longitude and latitude, nearby devices, Wi-Fi access points, and cell towers.
- (Optional) Nearby device information. We will collect readings from peripheral devices (e.g., other mobile devices, headphones, tablets) connected to the mobile device via Bluetooth.
- (Optional) Calendar information. We will collect the start time, end time, and names of calendar events shared by the user.
- (Optional) Workout information. Using the mobile device's Apple HealthKit/Google Health API, we will collect sleep records, detected step counts, and workout sessions explicitly tracked and logged by the user.
- Survey information. The app will prompt the user to complete surveys related to the study's goals, which users can answer whenever they want.
How we use information we collect
We will use the collected information for scientific research purposes only, which are described in the informed consent document that all people using the software must agree to.
This app was created by non-profit institutions for non-profit research purposes.
The data collected are strictly controlled and limited to trained personnel on the research teams, all of whom have undergone special research training in the protection of human subjects and their data.
The data collected are analyzed using various research methodologies, and the results of our work will eventually be published in scientific presentations and papers.
Data is always deidentified before presentation.
Transparency and choice
All users of this application must consent to the use of the application. Those consent forms are study-specific and overseen by our institutional review board (IRB). The consent forms provide additional detail about the nature of data collected and how it is used.
Although typically a protocol does not change during a study, if the protocol does change, it is only with additional approval from the IRB and re-consenting of the users of the application. At that time, they can choose whether to continue participating in the study or not.
All collected user data are stored as encrypted files on the phone. Consent forms specify the rights of subjects with regard to data access. Participants always have the right to have their data deleted, should they change their mind about participation in a study.
Information we share
Data is not shared with anyone outside of the trained research team, unless those data are completely deidentified, in compliance with procedures mandated by our IRB.
Aggregated, de-identified data will be presented in research publications in scientific journals and conferences.
Information security
We work hard to protect the users of this app from unauthorized access to or use of the data collected. In particular:
- We store all collected data in encrypted files using AES 256 algorithm.
- We use https for data uploading.
- We use firebase (operated by Google) and our own secure server (operated by Northeastern university) to store uploaded files; identifiable information is always stored in an encrypted format.
- We review our information collection, storage and processing practices, including physical security measures, to guard against unauthorized access to our systems and the data stored on them.
- We restrict access to personal information to the core research team, all of whom are trained in the protection of human subjects in experiments. These individuals are trained and certified to be able to understand the sensitivity of personal information.
Changes
Our Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without a user’s explicit consent. We will post any privacy policy changes on this page and, if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of privacy policy changes). We will also keep prior versions of this Privacy Policy in an archive for your review.
If you have questions or concerns about this Privacy Policy, please contact us.
