Visiting our website

You can read any page on rarediseaseconnect.com, including all of our disease hubs, without identifying yourself. We do not require registration to read anything.

Cookies. The site sets two cookies, both provided by Cloudflare, who operate our security and performance layer:

• __cf_bm distinguishes genuine visitors from automated traffic. It expires after approximately 30 minutes.
• cf_clearance records that a visitor has passed a security check, so that the check is not repeated on every page.

Both are strictly necessary for the site to operate securely. Consent is not required for cookies of this kind, which is why you will not see a cookie banner. We set no advertising, marketing or tracking cookies.

Analytics. We use Cloudflare Web Analytics to record how many people visit each page. It sets no cookies, does not identify individual visitors, and does not track visitors across other websites.

Server logs. Cloudflare and WP Engine, who host our website, technical information each time a page is requested, including IP address, the page requested, the time and the browser type. This information is used to keep the site secure and available.

We do not use advertising trackers. No content is embedded in our pages from social media companies, video platforms or advertising networks.

Information you give us

We collect personal information only where you choose to provide it. There are three places on the website where you can do so.

The participate in research form

• First name and last name
• Email address
• Phone number, if you choose to provide one
• Whether you are a patient, a caregiver or a family member
• Your country, and your state if you are in the United States
• The rare disease or disease area you register

Completing this form is what we mean by registering throughout this policy, and the record it creates is your registration. Signing up on a disease hub is a separate process and does not create a registration.

The condition you give here is health information. Section 4 explains the basis on which we hold it.

The disease hub signups

• Email address
• Country

We do not ask for your name, and there is no condition field. The condition is identified by which hub page the signup came from.

The contact form

Your name, email address, country, the organisation you represent if you provide one, and the content of your message.

How we use it

To contact you about research participation opportunities relevant to the condition you registered. Where an opportunity matches, we contact you, explain what participation would involve, and you decide whether to proceed.

To send you the newsletter for a condition, where you have asked for it.

To respond to enquiries sent through the contact form.

We do not use your information for advertising, we do not profile you, and we do not make automated decisions about you.

What we do not do

We do not sell your information, to research sponsors, data brokers or anyone else.

We do not share your details with a research team unless you tell us to. Submitting a form never results in your information being shared. We share your details only when you have been told about a specific study and have agreed to your details being sent to the study team.

How sharing works

Registration involves two separate consents.

The form asks your consent to two things: that we hold the information you provide, and that we contact you about research opportunities. Neither permits us to share anything.

Where an opportunity matches, we contact you, explain what the study involves, and ask separately whether you wish your details to be passed to the study team. That second consent is given by email or by telephone, and we record it.

Registering with us does not commit you to taking part in any study. Participation is subject to the eligibility, consent and, where relevant, parental or guardian requirements of that study, which are determined by the study team and not by us.

Our legal basis

We rely on your consent, given by ticking the boxes on the form.

The condition you register is health information, which data protection law treats as a special category requiring additional protection. For this we rely on your explicit consent, given through a separate tick box.

Consent to share your details with a particular study team is a separate consent, obtained at the time and not given through the form.

You can withdraw your consent at any time. See section 7.

Who else has access

Four companies process information on our behalf, under contract, on our instructions, and for no purpose of their own.

Microsoft stores registrations in our own Microsoft 365 account, hosted in the United States. Hub signups are not held there.

Cloudflare operates the security and performance layer in front of our website, and provides our analytics. Cloudflare processes the technical information described in section 1, including IP addresses. It does not process anything you enter on a form.

WP Engine hosts our website. Their servers record the technical information described in section 1, including IP addresses, each time a page is requested.

Brevo, operated by Sendinblue, sends our emails and holds our hub signup lists. Brevo is hosted in the European Union.

For hub signups, Brevo holds your email address, your country, and which hub you signed up on. The hub is how the mailing list is organised, so being on a list indicates an interest in that condition.

For registrations, Brevo receives your first name and email address so that we can send you a confirmation. The condition you registered is removed before anything is sent to Brevo, and is held only by us.

No one else receives your information. Research teams and study sponsors receive nothing unless you have agreed to your details being sent to them for a specific study.

We may disclose information where we are required to do so by law.

How long we keep it

Registrations: five years. The period runs from the date you registered and begins again whenever you interact with us, such as replying to an email or speaking to us. Where five years pass without contact from you, we email to ask whether you wish to remain registered. If we receive no reply within 30 days, we delete your registration. If the email does not reach you, we delete your registration at that point, as we are no longer able to contact you.

Hub signups: until you unsubscribe or ask to be removed.

Enquiries sent through the contact form: six months after the exchange concludes.

Your choices

To stop receiving communications from us, reply to any email we send you or write to privacy@rarediseaseconnect.com. We cease contact on receipt of your request, with no waiting period.

To have your information deleted, write to privacy@rarediseaseconnect.com. We delete your registration in full. We keep a note that a deletion took place, and the date, but it does not contain your name, your email address or any other detail about you.

To obtain a copy of your information, correct it, or ask us to restrict how it is used, write to privacy@rarediseaseconnect.com.

We respond within 30 days.

If you are in the United States

Whichever state you live in, you can ask us to:

• confirm what information we hold about you, and give you a copy
• tell you whether it has been shared with anyone, and who
• correct anything that is wrong
• withdraw your consent
• delete your information

To do any of these, write to privacy@rarediseaseconnect.com. We respond within 30 days.

These rights come from state consumer health data laws, principally the My Health My Data Act in Washington, together with equivalent laws in Nevada and Connecticut. California residents may have further rights under the California Consumer Privacy Act, which treats health information as sensitive personal information.

We will not treat you differently for exercising any of these rights. You will not be refused a service, given a lower level of service, or charged a different price.

If you consider that we have handled your information improperly, contact us first at privacy@rarediseaseconnect.com. You may also complain to the Federal Trade Commission or to your state Attorney General.

If you are in the United Kingdom or Europe

You have the rights set out in section 7, together with the right to receive a copy of your information in a portable format, to object to our processing, and to ask us to restrict it.

Your information is stored in the United States. Data protection law restricts sending personal information outside the United Kingdom and the European Economic Area unless there are safeguards in place. Ours are Standard Contractual Clauses approved by the European Commission and, for the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner’s Office. These are contracts binding on the companies that hold your information, requiring them to protect it to the same standard. You may ask us for a copy.

You may complain to us directly. Write to privacy@rarediseaseconnect.com. We will acknowledge your complaint within 30 days, investigate it, and inform you of the outcome.

You may also complain to a data protection authority. In the United Kingdom this is the Information Commissioner’s Office, at ico.org.uk. In the European Union, you may complain to the authority in your own country.

Age

You must be 16 or over to register through the participate in research form or to sign up on a disease hub.

Registration does not mean you are able to take part in any particular study. Studies set their own age limits, and studies involving people under 18 have their own consent and parental permission requirements, determined by the study team.

Security

Your information is encrypted in transit and at rest. Access is restricted to named individuals who require it, on managed devices, using multi-factor authentication. Access is logged.

Where a breach occurs that is likely to put you at risk, we will inform you, and we will notify the relevant authorities where we are required to do so.

Changes to this policy

Where we change how we use your information, we will update this policy and amend the date above. Where a change is significant we will tell you, and where the law requires it we will ask for your consent again.

Contact

privacy@rarediseaseconnect.com

Rare Disease Connect LLC, 8 The Green, Ste B, Dover, DE 19901