Per Article 30 of the European Union General Data Protection Act, this report
documents Open Humans personal data processing activities in writing. Because
our platform enables users to create new personal data inputs and outputs, we
maintain a semi-automated report based on the current active projects.
Name & contact details
Data controller is the Open Humans Foundation, which manages the Open
Open Humans Foundation
500 Westover Dr #10553
Sanford, NC 27330
Data protection officer is designated to be:
Open Humans Foundation
500 Westover Dr #10553
Sanford, NC 27330
phone: +1-252-513-4188 Extension 1
European Union representative is designated to be:
Marja Pirttivaara, PhD, MBA
Sepontie, FI-02130 Espoo, Finland
phone: +358 40 766 2475
Purposes of personal data processing
Member-managed personal data sharing with third parties
Members can explicitly opt-in to share selected personal data with arbitrary
third party projects that operate on the site. These projects include the
following potential uses members may wish to have:
- data analysis and exploration tools
- data cleaning tools
- data donations to research and citizen science projects
Contact and notification
Emails are collected from users to enable contact regarding events
specific to their account, messages sent to them by other members or
projects, and substantive changes to the site, as well as newsletters
for users that opt-in to receiving these.
Users are invited to create and share the following public data to
personalize their accounts within the community: username, name, profile
picture, and "about me" text.
do not require individuals to divulge their real name.
The Open Humans site collects logs of web usage, which may contain personal
data (e.g. IP address).
Categories of data subjects and personal data
Data subject categories
Our primary data subjects consist of 8090 member accounts
created on the site. Users are required to be 16 years of age or older.
Account data may come from children only through an account managed by
that child's legal guardian.
Individuals that visit the site and are not logged in may have personal
data (IP address) collected within our logging.
Personal Data Categories
Primarily this is email address, which is private personal data. Users
may also publicly share a name, username, profile picture, and "about me"
information. These may be identifying but are not required to be.
Primarily this contains IP addresses. This is collected by servers to
enable us to audit usage and debug site issues.
Projects deposit data at the explicit opt-in behest of a member to
their account. This data is typically personal data of diverse categories,
and is known to include genetic data, location data, and other identifiable
The following project data sources are documented for Open Humans:
- 23andMe Upload: Raw 23andMe genotyping data
- American Gut Project: A table describing the organism / sample counts and taxonomy.
- AncestryDNA Upload: Raw AncestryDNA genotyping data
- Data Selfies: All the data
- Data sharing and ethical oversight: Members can opt in to receive their own answers and/or all answers as an aggregate from the project once the study is over.
- FamilyTreeDNA integration: FamilyTreeDNA raw genotyping data
- Fitbit Connection: Data from Fitbit devices, including steps, heart rate, and heart rate, if available.
- Fitbit Intraday: Intraday Fitbit Records (Heart Rate & Activities)
- Gencove: Sequencing bam files
- Genetics of Personality Type: This project will return a person's personality type (i.e., INTJ, ESFJ) as determined using three personality questionnaires.
- Genome/Exome Upload: VCF files
- Google Fit: Steps, distance, calories, activity minutes from Google Fit
- Google Location History Upload: Google Location History archives
- Google search history analyzer: Google take-out archive of search data
- GoViral: survey data and possibly kit results
- GoViral (2014-2016): Sickness reports contain survey data from GoViral. Viral profiling data contains raw viral test results.
- Harvard Personal Genome Project: Full genome sequencing data and survey data, if your participant account has these data.
- Imputer: Imputer will return a file with imputed genotypes from a user's existing genotype file.
- Jawbone Connection: Steps, sleep, and heartrate data, if available.
- lineage: Remapped SNPs, merged and discrepant SNPs (if applicable)
- Mobility data of researchers: Example of the dataset collected: travel cityA → cityB of a scientist (metadata: ORCID of a scientist who travels).
- Moves connection: Moves GPS tracking
- mPower study: Survey data and task data (tapping, voice, memory)
- Nightscout Data Commons: Data from any associated project research survey such as demographics.
- Nightscout Data Transfer: Data from Nightscout: profile.json, entries.json, treatments.json, and devicestatus.json
- nobism: csv file with all timepoints and relations general information from the Profile page
- nobism Ubiqum Cluster headache Project: We want to create regular reports based on your own data and that of all that shared. These will be stored back into your OpenHumans account
- Nokia Health (Withings) Connection: Personal and environmental tracking data: body weight, temp, fat/water/muscle %; blood pressure; heart rate; air temp/quality; sleep; steps
- OpenAPS Data Commons: Data from any associated project research surveys (such as an engagement score or other QOL data gathered)
- Open Humans Healthkit Integration: HealthKit data from your iPhone or iPad (visible in the Health app)
- openSNP: Will upload a link to the openSNP user page for two-way connection
- Oura Connect: Oura sleep and activity data
- Overland connection: Overland GPS records
- Personal Data Notebooks: Personal Data Notebooks
- QCycle: Body Temperature, Oura Ring Data
- RescueTime connection: RescueTime productivity data (computer usage including window titles & web site visits)
- Runkeeper connection: Activity data from your Runkeeper account
- Spotify integration: Spotify recent played songs
- Twitter Archive Analyzer: Zipped Twitter archives
- uBiome Upload: Raw uBiome sequencing data
- Wild Life of Our Homes: Bacterial and fungal data from surfaces in participant homes
Categories of data recipients
Projects operated in the site are potential recipients of personal data.
Data is only accessible by a project if a member explicitly opts in,
joining the project and authorizing Open Humans share one or more
categories of personal data in their account.
that mandate secure practices and transparent communication
with members, including the presence of identifiable data and potential
risks. Projects undergo a
process prior to being made broadly available to members.
The following project data recipients are documented for Open Humans:
Led by Cliff Tabin and Abigail Wark
(Harvard Medical School)
- Cross-Genome Error Check:
Led by James Turner
- Dash Genomics:
Led by Dash Genomics
- Genetics of Personality Type:
Led by Dr. Denise Cook
- Genevieve Genome Report:
Led by Mad Ball
Led by Kevin Arvai
- Juno's Personal Data Exploratory:
Led by Bastian Greshake Tzovaras
(Open Humans Foundation)
- Keeping Pace:
Led by Dr. Rumi Chunara
(New York University)
Led by Andrew Riha
(Scedastic Software, LLC)
- Mobility data of researchers:
Led by L Tupikina, V Estrada-Galinanes, M Santolini, B Greshake Tzovaras
- Nightscout Data Commons:
Led by The Nightscout Data Commons Committee
(The Nightscout Foundation)
- nobism reports for Advocating:
Led by Rogier Koning
- nobism Ubiqum Cluster headache Project:
Led by Rogier Koning, Sara Marín, Daniel Castejón
(Ubiqum Code Academy)
- OpenAPS Data Commons:
Led by Dana Lewis
- Open Pokemon GO GO GO!:
Led by Madeleine Ball, Hyatt Moore, and Ernesto Ramirez
- Pokemon Go: A Socio-Technical Exploratory Study:
Led by Eric Hekler and Alexander Biel
(Arizona State University)
Led by Azure Grant
(University of California, Berkeley; Quantified Self)
- Resilience Project Study:
Led by Jason Bobe
(Icahn School of Medicine at Mount Sinai)
- The Preference Project:
Led by Christian Zuend
(Department of Economics, University of Zurich)
- The Quantified Heart:
Led by Valeria Pannunzio
(Delft University of Technology)
Time limits for erasure
Account data and project data should be permanently deleted after 60 days,
and are immediately removed from processing activities when requested
by a member. Logging data should be permanently deleted after 120 days.
Pseudonymization and encryption
Project data shared with data recipient projects is done via randomly
assigned project-specific identifiers. Data itself may or may not
contain non-anonymous content. Projects are required by
to make members aware of identifiable features in data they offer to add
to a member's account.
All interactions with the website and API are enforced to use SSL
encryption. Data in the database and file storage is encrypted at rest.
Ensuring ongoing integrity and security of processing systems and operations
The site and other infrastructure are operated with major cloud services
providers that provide up-to-date secure platforms for operating technical
infrastructure. These service providers are: Heroku, Amazon Web Services,
Google Cloud Services, and Digital Ocean.
The site software uses the Python/Django framework and is regularly updated
to new releases, and is openly available for third party inspection as an
open source project.
Backups are automatically performed for account data on a daily basis, and
are retained for a minimum of one month. Backups of project data occurs
automatically on a continuous basis and are retained for 60 days.
Projects are made broadly available on the site only after they pass a
process. This provides an open forum for regular review
of security measures in the platform and project operations. Open Humans
also maintains a public community
chatroom and open source
repositories, encouraging discussion and feedback on potential improvements.