Privacy notice

What is collected

The site collects identifying information, so it can run your account, and study information, recorded under a research ID.

Identifying information

• Your email address, used for invitations, reminders, and password resets.
• Your password, stored only as a salted hash. The password you type is not kept.
• The time you agreed to this notice, and this notice’s version.
• If you allow notifications, a browser push subscription tied to your sign-in account.
• A sign-in cookie that lasts 14 days. The database stores a hash of that cookie.

Study information, under a research ID

• A research ID and an assigned display name.
• The program you joined and your study group. Your learning page shows the research ID. It leaves the study group unnamed.
• Module progress, time spent on each lesson section, and any reflection you write.
• Quiz answers and scores. Practice questions inside a module are checked and then discarded. A reflection is saved.
• Survey answers and the time you submit them.
• Activity such as activating your account, signing in, and whether a reminder email was sent.
• Community posts, comments, and reports.

Technical records

Sign-in, sign-up, and password-reset attempts are counted. A network address is stored only as a hash, and that count is deleted after one day. An email address used in those attempts is stored for the same day so repeated tries can be limited, and withdrawal deletes it immediately. Vercel and Supabase may keep their own short security logs, which can include a network address. Those logs are separate from the study file.

The site does not run advertising trackers, and the study team does not sell personal information.

A free-text answer, a reflection, or a community post can identify you if you include your name, email, phone number, or research ID. Leave those out.

Surveys

Research surveys are answered on this site. Your answers are stored in the study database with your research ID. They are not sent to a separate survey company. Analysis screens and downloaded files show that research ID. They do not show your email.

Learning quizzes are separate from research surveys. They are stored under the same research ID. Research-survey downloads do not include them.

Confidentiality

Each person has a research ID. Answers, progress, reflections, and quiz results are recorded under that ID. The email address sits on the account.

Research administrators see research IDs, study group, answers, and progress. Those screens do not list email addresses. Content editors can change learning materials and moderate community posts, which show a display name. They cannot open participant contact details, the participant directory, or analysis files.

The database can still connect the email to the research ID. The mailer uses that connection to send a reminder when a step is due. The reminder names the program and the step. It does not include survey answers. A person with direct access to the database could also make that connection. The study screens keep the two apart. In a small study, someone who can see the research IDs and also reach the email records could still match them by hand.

The record is confidential and coded. A research ID can be linked back to the email on the account. Published results use the research ID or a group summary. Your name is published only with your permission, unless the law requires otherwise.

Who can see it

• You, on your account and learning pages. The learning page shows your research ID so you can quote it to the study team.
• Other participants in the same program and the same study group, who see community posts under your display name.
• Research administrators for the study, who see research IDs, answers, progress, reflections, and community posts.
• Content editors, who see learning materials and community posts under display names.
• The mail service, which sees your email and the message. Messages are invitations, password resets, reminders, release notices, and announcements the study team writes. They are not filled in from your survey answers. A message already delivered stays in that mailbox.
• If you allow notifications, Apple, Google, or your browser vendor delivers the notice. They see the device endpoint. They do not receive survey answers.
• Vercel, which hosts the website, and Supabase, which hosts the database, as service providers.

Information is used to run the program and for the research described in the consent for that study. It is shared with other researchers only when that consent says so.

Where it is stored

The site is hosted outside Ontario Tech University’s own web servers. Survey answers collected on this platform are stored with the rest of the study database.

The database is hosted by Supabase on Amazon Web Services in the United States, region us-east-1 (Northern Virginia). The website is hosted by Vercel, a company in the United States. Pages may pass through Vercel’s network in more than one country. The study database, including survey answers, stays in that United States region. Information collected through this site is stored outside Canada.

United States law can require a company there to disclose information it holds, including information about people in Canada. Supabase and Vercel are service providers for the study. Their privacy policies are linked at the end of this page.

Images and other files used in a module are stored in a private Supabase storage bucket in that same United States project. The site serves a file only after the same release check as the module.

Email is sent by the mail service the study team configures. The planned sender is an Ontario Tech University mailbox. The mail service sees your email address and the message text.

Safeguards

• The public site is served over HTTPS. The sign-in cookie is httpOnly, and on that site it is marked Secure so the browser sends it only over HTTPS. The database stores a hash of the session token. A session lasts 14 days.
• Supabase encrypts the stored database. Passwords are stored as salted scrypt hashes.
• Invitation and password-reset links are stored as hashes.
• A participant account can read that participant’s own rows.
• Sign-in attempts are rate limited. A network address used for that limit is stored as a hash. An email used for that limit is kept for one day.
• Research staff, content editors, and the mailer have the separate access described above.

No online system can promise that information will never be lost, copied, or intercepted.

How long it is kept

Research answers, progress, reflections, community posts, and the research ID are kept for the period named in the Research Ethics Board-approved protocol for that study, and for the period in Ontario Tech University’s research records schedule. The study team destroys or de-identifies them when that period ends. The number of years is set in the ethics file.

Sign-in attempt counts are deleted after one day. A session ends after 14 days, or sooner when you sign out.

Deleted information can remain in a Supabase or Vercel backup until that backup expires. The study team records the host backup window in the ethics file.

Withdrawal

You can withdraw from the account page. Withdrawal signs you out and stops new learning activity, email, and notifications. The platform removes your contact email, replaces the sign-in address so the account cannot be used, deletes the password, invitation addresses, unused password-reset links, sign-in sessions, and push subscription, and cancels reminders that have not been sent. Email addresses kept for attempt limits are deleted. A message already delivered stays in the mailbox that received it.

Answers already submitted, module progress, reflections, community posts, and the research ID stay, so the study record remains intact. Community posts stay under your display name. Other participants still see that name, not your email.

After results are published as a group summary, those published results stay as published. If you want submitted answers destroyed before the retention period ends, ask the study team. The platform keeps submitted answers when you withdraw.

Open account

Limits of confidentiality

Your privacy shall be respected. No information about your identity will be shared or published without your permission, unless required by law. Confidentiality will be provided to the fullest extent possible by law, professional practice, and ethical codes of conduct. Please note that confidentiality cannot be guaranteed while data are in transit over the Internet.

That is the confidentiality statement the Ontario Tech Research Ethics Board asks studies to include.

• Community posts are visible to other people in your program and study group.
• Email can be copied or forwarded. Keep study answers on the site.
• Because the servers are in the United States, a legal demand there can require the host to disclose information.
• The consent for your study describes any further limit, including a duty to report a risk of harm.

Your choices

• Joining is voluntary. You agree to this notice when you create an account.
• Notifications are optional. Email reminders still use the address on the account.
• You can withdraw, with the limits in the withdrawal section.
• You can ask the study team what is held under your research ID. Quote the ID from your learning page.
• Submitted survey answers stay as you submitted them. To correct your email, contact the study team.

Changes

The version is 2026-09-30. When this notice changes, a new account stores the new version with the time you agreed. The study team tells current participants about a change that affects them, in the way the Research Ethics Board requires.

Contact

Questions about a program go to the people listed on the contact page. Their email addresses appear there after an administrator adds them.

Questions about your rights as a participant go to the Ontario Tech University Research Ethics Board.

Ontario Tech University Research Ethics Board
researchethics@ontariotechu.ca
905.721.8668 ext. 3693
2000 Simcoe Street North, Oshawa, Ontario L1G 0C5
Research Ethics Board contact page

Service providers

• Vercel privacy policy
• Supabase privacy policy

To attach this notice to an ethics application, print this page or save it as a PDF.