Effective: September 12, 2017

This Privacy Policy ('Policy') describes St. Jude Children's Research Hospital, Inc. ('St. Jude,' 'we,' 'our,' or 'us') policies on the collection, use, and disclosure of information in connection with your use of any part of the St. Jude Cloud Platform and any related St. Jude programs ('St. Jude Programs') or St. Jude data (St. Jude Data') (collectively, referred to below as the 'St. Jude Cloud Platform,' or 'Platform').  When you use the Platform, you consent to our collection, use, disclosure, and protection of information as described in this Privacy Policy. BY ACCESSING OR USING THE PLATFORM, YOU AGREE TO THIS POLICY.  IF YOU DO NOT AGREE TO THIS POLICY, YOU MAY NOT USE THE PLATFORM. If you access or use the Platform on behalf of another person or entity, you represent and warrant that you have the authority to bind that person or entity to this Privacy Policy, and your acceptance of will be deemed an acceptance by that entity, and 'you' and 'your' herein shall refer to that entity as well as you.  

This Policy applies only to information collected on or through the Platform.  It does not apply to information collected or obtained through any other means (including, without limitation, information collected through other St. Jude websites or mobile applications, offline, in person, or from third parties outside the Platform).

Undefined capitalized terms used herein shall have the definitions as set forth in our Terms of Use, https://stjude.cloud/terms-of-use.

Information We Collect

We may collect and store information about you in various ways.  For example, we may collect information that you provide to us, information that we automatically collect through your use of the Platform or the DNAnexus platform, and information from publicly available sources or non-affiliated third parties.

Information You Provide to Us

When you use the Platform, you may be invited to provide or upload information that St. Jude may access.  For example, St. Jude may collect the following illustrative (but not exhaustive) types of information when you use the Platform:

  • Name, company or organization name, title, address, telephone number, and email address;
  • Information supporting your account application information;
  • Account registration information;
  • Any forms you fill out on or submit through the Platform;  
  • Communications with us through the Platform; or
  • Any other information that you choose to provide and/or upload to us through the Platform.

In addition, you may upload DNA and RNA sequence data, metadata, other information related to such sequence data, or other information or files held within the user-specific project on the St. Jude Cloud Platform or on DNAnexus (collectively, 'User Project Data'). St. Jude does not intend to access User Project Data unless You explicitly grant access the St Jude. In rare circumstances, St Jude may work with DNAnexus to gain access and/or remove User Project Data. St. Jude reserves the right to access or remove User Project Data if necessary to provide the St. Jude Cloud Platform services as offered, for security and fraud-prevention purposes, for the protection of St. Jude and its agents, and as required by law. 

You may also provide certain financial account information to DNAnexus and/or payment processors to make a payment, including bank account and/or credit card information.  This information is collected and stored by DNAnexus and/or payment processing partners. We do not access, store or collect your financial account or credit card information.

Information that Is Collected Automatically and/or Passively

In addition to the information you provide to us directly, we may automatically collect information about your use of the Platform as follows:

  • Device/Usage Information. When you use our Platform, we may collect and analyze information such as your IP address, browser types, browser language, operating system, the state or country from which you accessed the Platform, software and hardware attributes (including device types and IDs), referring and exit pages and URLS, platform type, the number of clicks, files you download, domain names, landing pages, pages viewed and the order of those pages, the amount of time spent on particular pages, the terms you use in searches on our sites, the date and time you used the Platform, uploaded content (such as User Data), error logs, and other similar information.  We use this information (including the information collected by our third-party service providers) for Platform analytics (including to determine which portions of the Platform are used most frequently and what our Users like or do not like).
  • Emails.  If you receive an email from us, we may collect information related to whether you open the email, and what content you select to view via the email.

Information from Third-Party Sources

We may receive information about you from publicly and commercially available sources, as permitted by law, which we may combine with other information we receive from or about you.

Cookies and Other Technologies

We and our third-party service providers may use cookies, clear GIFs, pixel tags, beacons, and other technologies that help us better understand user behavior, personalize preferences, perform research and analytics, and improve the services we provide.  You may choose to accept or decline certain cookies.  Most web browsers automatically accept cookies, but your browser may allow you to modify your browser settings to decline certain cookies if you prefer.  If you disable cookies, you may be prevented from accessing or taking full advantage of the Platform. To learn more about cookies, please visit http://www.allaboutcookies.org/.

Web Logs

In conjunction with the gathering of data through cookies, Web servers may log records such as your device type, operating system type, device advertising identifier, browser type, domain, and other system settings, as well as the language your system uses and the country and time zone where your device is located. The Web server logs also may record the address of the Web page that referred you to the Platform, the IP address (and associated city and state or province for the IP address) of the device you use to connect to the Internet, and data about your interaction with the Platform, such as which pages you visit.

Online Analytics

We may use third-party web analytics services, such as those provided by MixPanel Analytics. These service providers use cookies and other technologies described in this Policy to help us analyze how Users use the Platform. The information collected by the technology will be disclosed to or collected directly by these service providers. To prevent MixPanel Analytics from using information for analytics, a user may https://mixpanel.com/optout/.

Do Not Track Signals and Similar Mechanisms

We do not recognize or respond to browser-initiated Do Not Track signals, as the Internet industry is currently still working on Do Not Track standards, implementations, and solutions.

User Software and Reference Data

You may also be permitted to upload your own software and data, including reference genomes, to the Platform in the course of using the Platform. As set forth in the St. Jude Cloud Platform Terms of Use, you agree to and accept full responsibility for obtaining all permissions, consents, and rights necessary for uploading and using any such software and data to and with the Platform.

How We Use the Information We Collect

We may use your information for any of the following reasons:

  • For the purposes for which you provide it;
  • To enable you to use the Platform, including evaluating your application for access to the Platform, registering you for a Platform account, and verifying your identity and authority to use the Platform;
  • For customer support and to respond to your inquiries;
  • For internal recordkeeping purposes;
  • To analyze, improve and maintain the Platform and for product development;
  • To address fraud or safety concerns, or to investigate complaints or suspected fraud or wrongdoing;
  • To provide you with a personalized experience on the Platform;
  • To contact you with information about your use of the Platform;
  • For other research and analytical purposes; and
  • To protect, enforce, or defend the legal rights, privacy, safety, security, or property of St. Jude, its employees or agents, or other users, and to comply with applicable law.

We may combine information that we collect from you through the Platform with information that we obtain from affiliated and non-affiliated third parties, and information derived for any other products or Platforms we provide.

We may aggregate and/or de-identify information collect through the Platform.  We may use de-identified or aggregated data for any purpose, including without limited for research and marketing purposes and may also share such data with any third parties.

How We Share Information

The following provides information about entities with whom we may share information. Our practices may vary depending on the type of information.

Affiliates and Partners . We may share information with our affiliates. Information may also be available to Platform Partner, DNAnexus, as described in its privacy policies and terms.  See https://www.dnanexus.com/termshttps://www.dnanexus.com/privacy.

Service Providers. We may share information with third parties that help us operate our business and provide our services, such as contractors that provide us with technology, services, data or content.

Other Parties When Required by Law or as Necessary to Protect Our Users and the Platform . We may share information when we believe that doing so is necessary to protect, enforce, or defend the legal rights, privacy, safety, or property of St. Jude, our employees or agents or users, or to comply with applicable law or legal process, including responding to requests from public and government authorities.

Business Transfers . We may transfer the information we hold in the event we sell or transfer all or a portion of our business or assets (such as in connection with a merger, acquisition, reorganization, dissolution or liquidation) or in connection with steps we take in anticipation of such a transaction.

Aggregated or De-Identified Information. We may share aggregated or de-identified data without restriction.

Otherwise with Your Consent or at Your Direction . In addition to the sharing described in this Policy, we may share information with third parties whenever you consent to or direct such sharing.

Information You Share with Other Users

The Platform allows you to upload and share the sequence data, reference genomes, and other information ('User Data') you submit to the Platform with other Users of the Platform. St. Jude is not responsible for such other Users' use of User Data. You understand and acknowledge that, if you choose to share User Data with other Users, such information might be copied or redistributed by those Users. Even after you remove information from your account or delete your account, copies of that User Data may remain viewable elsewhere to the extent it has previously been shared with others.

Protected Health Information

YOU AGREE THAT YOU MAY NOT UPLOAD ANY PERSONAL HEALTH INFORMATION OR PERSONALLY IDENTIFYING INFORMATION AS DEFINED BY APPLICABLE LAW IN THE UNITED STATES OR THE YOUR COUNTRY OF RESIDENCE OR THE COUNTRY AND LOCATION FROM WHICH THE DATA IS UPLOADED TO THE ST. JUDE CLOUD PLATFORM.

Children's Privacy

We do not knowingly collect any personal information on this Platform directly from children under the age of 13 without parental consent, unless permitted by law. If we learn that a child under the age of 13 has provided us with personal information (as defined by the Children's Online Privacy Protection Act), we will delete it in accordance with applicable law.

Security

We employ administrative, technical, and physical security measures to help protect information from unauthorized access.  These measures vary depending on the sensitivity of the information we have collected.  However, no method of transmission over the Internet or via mobile device, or method of electronic storage, is absolutely secure.  Therefore, while we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

Third Party Links and Services

The Platform may contain links to third-party websites or services.  If you choose to use these sites or services, you may disclose your information not just to those third parties, but also to their users and the public more generally depending on how their services function.  Because these third-party websites and services are not operated by St. Jude, St. Jude is not responsible for the content or practices of those websites or services. The collection, use, and disclosure of your personal and other information will be subject to the privacy policies of the third party websites or services, and not this Policy.  We urge you to read the privacy and security policies of these third parties.

California Residents: Your California Privacy Rights

St. Jude does not disclose your personal information to third parties for the purpose of directly marketing their services to you unless you first agree to such disclosure.

How to Access or Update Your Information & Other Privacy Choices Available to You

Manage Your Account Information.  You may modify your account information by logging into your account through http://platform.dnanexus.com

Cookies and Other Automated Technologies.  For information about opt-out options relating to data collected using cookies and other automated technologies (e.g., for analytics), please review the information and hyperlinks in the 'Cookies and Other Technologies,' and 'Online Analytics' sections of this Privacy Policy, above.

International Users and Consent to Transfer to Us

Our computer systems are currently based in the United States, so your data will be processed by us in the United States. If you create an account with the Platform as a visitor from outside the United States, by using the Platform, you agree to this Policy and you consent to the transfer of all such information to the United States and to the processing of that information as described in this Policy, and you represent and warrant that you have obtained all appropriate consents from the person who owns the data and the person from whose tissue the data was derived for the processing and storage of the data in the United States.

Modifications to This Policy

Modifications or changes to the Policy will be reflected in the most current Privacy Policy, which is available through the Platform. We reserve the right to modify this Policy at any time, so we encourage you to review it frequently. Your continued use of the Platform following any changes signifies your acceptance of our Privacy Policy as modified.

Contact Us

If you wish to provide feedback to us regarding the Platform, please contact us at https://stjude.cloud/contact.

If you have any questions about St. Jude Children's Research Hospital or our privacy protections, please contact us at hipaaprivacy@stjude.org.