Consent dataset: We use Qualtrics for the consent process. All data collected as part of that process is initially stored on Qualtrics servers. Once the study period has ended, it will be transferred in an encrypted, password-protected file to FileZilla, a secure transfer server, and finally into a secure storage environment called Stronghold which runs on Brown servers Stronghold is specifically designed to store and protect sensitive study data. All data stored in Qualtrics will then be deleted.

Demographic dataset: Like for the consent dataset, we use Qualtrics to collect and initially store your demographic data. At the end of the study period, it will be transferred to Stronghold using the same process as for the consent dataset after which all data will be deleted from Qualtrics.

Location dataset: This data will be collected through the MAPPS app which uses Firestore, a cloud storage platform managed by Google, as a backend. All data collected through the app or with environmental sensors will be sent to Firestore. Once data collection is complete, a study team member will move all the encrypted Bluetooth and Wi-Fi mobility data directly into Stronghold using FileZilla, a secure transfer server. All data stored in Firestore will then be deleted.

Both Firestore and Qualtrics are approved by Brown for storing sensitive data.

The concept of siloed collection and storage is visualized above in the data flow diagram.

We use secure databases (Qualtrics, Firestore, Stronghold) for storing all study datasets, encrypt them for transfer between databases, and limit access to all study data to a select group of MAPPS researchers who will access the data for study purposes only.

The main threat to participant privacy comes from the risk of re-identification in case of a data breach. For more information on re-identification, see “What are the risks of participating in this study?” above.

Here’s what we do in order to minimize the amount of information revealed and thus the risk of re-identification in case of such a data breach: if unauthorized actors gained access to any of the separate datasets we store, questionnaire data or consent data can only be connected with the location data from the mapping exercise if those unauthorized actors gain access to at least two of those data sets and the table linking the separate participant IDs from all data sets. (Links to the consent data which contains participants’ identifying information will be removed once data collection is complete, which further separates this data from the other datasets.)

While this scenario cannot be ruled out entirely, data breaches would have to affect multiple datasets. The mapping table, specifically, is protected by an additional layer of password protection. This approach of data separation protects against some cases of re-identification. As outlined above, the threat of re-identification increases with each data point that can be tied to a specific individual. Mitigating the risk of unauthorized linking of the location-related mapping data and the demographic data contained in the questionnaire helps lower the risk of re-identification.

The concept of siloed collection and storage is visualized above in the data flow diagram.

Only a small select number of MAPPS staff and researchers will have access to the dataset that contains explicitly identifying information you provide when you sign up for the study, i.e., your email address. All of this data will be deleted 5 years after the end of the study period. In the meantime, staff and researchers with access to that information keep information about your participation confidential. Your decision to participate or not will not be communicated to anyone outside the study, including but not limited to administrators at Brown, and your decision will neither help nor hurt your current role in the School of Public Health.

That said, location data always carries a risk of accidental or targeted re-identification. (See “What are the risks of participating in this study?” above.) For the steps we take to minimize this risk, see the previous question.

No, your data will not be analyzed or used by Google for any purpose. Firestore is a Cloud Service Provider which provides backend infrastructure for a variety of apps and services. It is separate from Google’s main advertising platform and associated free-to-use services (Search, Gmail, Drive, etc.). Under the terms and conditions governing our use of Firebase, data stored in Firebase is only accessed by Google, its employees and contractors if necessary to maintain storage infrastructure and security. In other words, your data will not, under any circumstances, be “mined” by Google as is the case for many other Google services you use.

This is a valid concern. One aim of MAPPS is to develop tools for researchers which make it easier to collect and analyze health-related personal data, including contact data. Deploying those tools at large scale could, in the long run, desensitize people to the collection of fine-grained, intimate information about their bodies and their whereabouts. Many of us already engage in this kind of self-quantification (using smartwatches, health apps and other devices). However, every additional piece of surveillance (however valuable and useful its purpose may be) carries the risk of desensitizing us to further demands for data and specifically demands by other, external actors and institutions beyond ourselves and the service providers we choose.

Habituation of surveillance carries the risk of lowering our resistance to potentially harmful or malicious surveillance efforts over time. From a societal perspective, this is not a desirable outcome: we must remain vigilant and able to critically assess the utility of expansions in data collection and surveillance and weigh it against individuals’ rights to informational self-determination and the harms that come with a loss of privacy.

In the long run, normalizing surveillance and data tracking also makes it more difficult for more privacy-conscious individuals who do not want their data collected at large scale to resist such efforts. The latter is not the case for the MAPPING@Brown study since participation is strictly voluntary, but we do realize that our study may contribute to an overall environment in which location tracking at educational institutions might become normalized.

One of the key objectives of the research activities in MAPPs is to figure out how to build tools which allow public health researchers to collect the location- and health-related information that they need while minimizing the collection of directly and indirectly identifiable information. We also want to build study tools which can be deployed in a targeted and time-limited way to study specific populations and communities.

In this feasibility study of MAPPING@Brown we made a start at integrating privacy preserving principles into the data collection and storage design. The data we collect as part of the pilot study will serve as a basis for exploring the feasibility of implementing more ambitious privacy protecting techniques, such as masking and aggregating specific locations, introducing artificial noise to individual data locally to further spoof individual identities, and further limiting centralized data storage.

Even if you decide to be in this study, you can change your mind and stop at any time.

If you decide to withdraw from the study while data collection is ongoing, you can do so by clicking the “Delete My Data” option in the app menu. You will be able to choose whether you want the study to retain and use any data collected up to that point, or whether you want your app data, or both your app and socio-demographic data to be deleted.

You can also quit the study by deleting the app from your phone. In that case, all data collected from you up until the point of withdrawal can still be used by the study team for research purposes.

Questions about MAPPING@Brown Phase I can be directed to primary investigator (PI) Mark Lurie at mark_lurie@brown.edu.

If you have concerns related to study ethics and our approach to privacy and data protection, please contact co-PI Julia Netter at julia_netter@brown.edu.