Privacy Policy for EPHI IRB System

Effective Date: 20-Jun-2024

1. Introduction

The Ethiopian Public Health Institute (EPHI) is committed to protecting the privacy and security of information pertaining to research ethics review. This Privacy Policy outlines how the EPHI IRB system collects, uses, stores, and discloses personal and research-related information. By using this system, you consent to the practices described in this policy.

2. Information We Collect

The EPHI IRB system may collect the following types of information:

• Personal Information of Researchers and IRB Members: This may include names, affiliations, contact information (email addresses, phone numbers), professional titles, and roles within the research or IRB process.
• Research Proposal Information: This includes the full content of research proposals submitted for review, including methodologies, data collection instruments, participant information, and ethical considerations.
• Participant Information (as detailed in research proposals): While the system itself may not directly collect data from research participants, the proposals will contain detailed information about the data to be collected, including potentially sensitive personal data, health information, and demographic details. This information is provided by the researchers.
• Review and Decision Information: Records of IRB reviews, meeting minutes, decisions (approvals, rejections, modifications required), and any related communications.
• System Usage Data: Information about how users interact with the system, such as login times, actions performed, and documents accessed. This helps us improve the system and ensure its security.
• Technical Information: This may include IP addresses, browser type, operating system, and device information for system administration and security purposes.

3. How We Use Your Information

The information collected through the EPHI IRB system is used for the following purposes:

• Facilitating the IRB Review Process: To manage the submission, review, communication, and decision-making related to research ethics proposals.
• Communication: To communicate with researchers, IRB members, and relevant stakeholders regarding the status of proposals, requests for information, and IRB decisions.
• Record Keeping: To maintain accurate and auditable records of all submissions, reviews, decisions, and related activities, as required by EPHI guidelines and applicable regulations.
• System Administration and Security: To administer the system, troubleshoot issues, monitor usage, prevent unauthorized access, and ensure the security and integrity of the data.
• Reporting and Analysis: To generate reports and conduct analysis for internal purposes, such as improving the efficiency and effectiveness of the IRB process.
• Compliance: To comply with applicable laws, regulations, and EPHI policies.

4. Data Security

EPHI takes the security of your information seriously. We implement reasonable administrative, technical, and physical safeguards designed to protect personal and research-related information against unauthorized access, use, disclosure, alteration, or destruction. These measures include:

• Secure data storage and transmission protocols.
• Access controls and authentication mechanisms to limit access to authorized personnel.
• Regular security assessments and updates to our systems.
• Training for personnel on data privacy and security practices.

However, please be aware that no method of transmission over the internet or method of electronic storage is completely secure.

5. Data Retention

We will retain personal and research-related information for as long as necessary to fulfill the purposes outlined in this Privacy Policy and as required by EPHI policies, legal obligations, and regulatory requirements. Research proposal information and related records will be retained in accordance with established IRB record retention guidelines.

6. Disclosure of Information

We may disclose information collected through the EPHI IRB system in the following circumstances:

• To IRB Members: For the purpose of reviewing research proposals and making decisions.
• To EPHI Officials: As necessary for oversight, reporting, and compliance purposes.
• To Researchers: To communicate feedback, decisions, and requests related to their proposals.
• As Required by Law: If we are required to disclose information by law, legal process, or government request.
• In Case of System Maintenance or Support: To authorized third-party service providers who assist us in operating and maintaining the system, under strict confidentiality agreements.

We will not sell, rent, or otherwise disclose your personal information to third parties for their marketing purposes without your explicit consent.

7. Your Rights

Depending on applicable laws and EPHI policies, you may have certain rights regarding your personal information, such as the right to access, correct, or request the deletion of your information. To exercise these rights, please contact the EPHI IRB Secretariat using the contact information provided below. We will respond to your request in accordance with applicable law.

8. Third-Party Links

The EPHI IRB system may contain links to third-party websites or resources. This Privacy Policy applies solely to information collected by our system. We are not responsible for the privacy practices of third-party websites, and we encourage you to review their privacy policies before providing any information to them.

9. Changes to this Privacy Policy

EPHI may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will post any changes on this page and update the "Effective Date" accordingly. We encourage you to review this Privacy Policy periodically.

By using the EPHI IRB system, you acknowledge that you have read and understood this Privacy Policy.