Privacy policy

What we collect

What we hold about you depends on how far you go through the process. Creating an account collects very little; applying to an event collects a great deal more.

• Account and sign-in — your email address, and an account identifier held by our sign-in provider. If you sign in with Google we also receive the name and profile picture on that Google account. We record when you first signed in, when you last signed in, and how many times.
• Your profile — first and last name, preferred name, pronouns, date of birth, nationality, country, state or province and city of residence, mobile number, LinkedIn profile, affiliation, job title or degree programme, education level, field of study, gender, and ethnicity. Date of birth and nationality are required before you can use the site; most of the rest become required only when you apply to an event.
• Participant applications — your essay answers, your MIT affiliation, whether you've attended one of our hackathons before and which, how you heard about the event, whether you consent to being contacted by sponsors, whether you want our newsletter, whether you're requesting travel support and why, any dietary requirements, your shirt size, any alternate email addresses, your ranking of the event's tracks, and a resume if you choose to upload one.
• Mentor, judge and sponsor applications — your organization, title, biography, LinkedIn profile, areas of expertise, why you want to take part, which days you're available, and which tracks interest you.
• Taking part in an event — your RSVP, the profile you choose to show other attendees and which of its fields you've made visible, the hours you mark yourself available, the project you join and what that project submits, mentor requests you send or receive, and the days you check in at the venue.
• Assessments about you — the decisions and comments our reviewers record about your application, and, if you're on a project, the scores and comments judges record about that project.
• Cookies — only what's needed to sign you in and to remember your cookie choice. There is no analytics, advertising or tracking on this site. The cookie policy lists every one.

Some of this is sensitive. Dietary requirements can reveal health conditions or religious practice, and ethnicity is a protected characteristic. We ask for them to cater for you properly and to understand who our events reach; both are optional, and you can leave them blank.

How we collect it

All of it comes from you, through this site: when you create an account, fill in your profile, apply to an event, respond to an RSVP, join a project or check in at the venue. We don't buy personal information, and we don't collect it about you from third parties — beyond the name, email and picture your sign-in provider passes to us when you choose to sign in with Google.

How we use it

We use your personal information for legitimate purposes in support of MIT Hacking Medicine and its mission, to foster the growth of healthcare entrepreneurship and innovation. Specifically, to:

• Run our events — review applications and decide them, form and support teams, match mentors, run judging, and check attendees in each day.
• Contact you about an event you've applied to or are taking part in.
• Cater for you and plan logistics, using dietary requirements and shirt sizes.
• Share your details with event sponsors — including your resume, if you upload one — and let them contact you about opportunities, but only where you have explicitly consented. The participant application asks this as a single question, and you can answer no without affecting your application. Uploading a resume is optional in any case.
• Produce aggregate statistics about the reach, attendance and performance of our events, and understand and expand that reach.
• Develop case studies highlighting event outcomes, with the explicit permission of the people featured.

We don't use your information to make automated decisions about you. Applications are read and decided by people.

If you have concerns about any of these purposes, or about how we communicate with you, contact us at hackmed-directors@mit.edu. We will always respect a request to stop processing your personal information, subject to our legal obligations.

Who can see it

Inside an event, who sees what depends on the role someone holds:

• Our organizing team can see the applications and profiles for the events they run, and the platform's administrators can see every account.
• Reviewers see the applications they are reviewing, and judges see the projects in the tracks they are assigned to.
• Other attendees of the same event see your name and role in that event's directory, plus the profile fields you have chosen to make visible there. Those fields are yours to set, and start hidden until you fill them in.
• Sponsors see only what you have explicitly consented to share — including your resume, where you have both uploaded one and agreed to share it.

We never sell your personal information, and we don't share it for anyone else's marketing.

Service providers

This site runs on infrastructure operated by others on our behalf. They process your information only to provide their service to us.

• Neon — hosts the database holding everything described above, and provides the sign-in service that holds your credentials. Data is stored in the United States.
• Google — only if you choose to sign in with a Google account, in which case Google tells us the name, email and picture on it.

How it's stored and secured

MIT uses risk-assessed administrative, technical and physical safeguards to protect your personal information. On this site, access is restricted by role: being signed in is not enough to see anyone else's application, and organizing-team access is granted per event. Sign-in sessions are carried in secure, HTTP-only cookies, and organizing-team sessions are signed out automatically after a period of inactivity.

When information is shared, only the relevant parts are shared — never the full database.

How long we keep it

We retain personal information until we are asked to delete it. You can delete your own account at any time from your profile page, which removes your account and sign-in credentials.

Upon request, we will promptly remove your data from our active records in accordance with MIT policy and legal requirements. We may keep a minimal record to make sure we don't contact you again by mistake, anything needed for MIT archival purposes, and anything we are required to keep by law.

Your rights

You have the right, in certain circumstances, to (1) access your personal information; (2) correct or erase it; (3) restrict how it is processed; and (4) object to communications, direct marketing or profiling. To the extent it applies, the EEA's General Data Protection Regulation (GDPR) sets out further rights. You also have the right to lodge a complaint with your national or regional data protection authority.

If you want to exercise these rights, we'd welcome the chance to discuss any concerns with you first. To protect the information we hold, we may ask for further information to verify your identity.

You are under no statutory or contractual obligation to provide any personal data to us, though we can't process an application without the information the form asks for. The controller for your personal information is MIT.

By providing information directly to MIT, you consent to the transfer of your personal information outside the European Economic Area to the United States. You understand that the current laws and regulations of the United States may not provide the same level of protection as the data and privacy laws of the EEA.

If you are in the EEA or UK and wish to assert any of your applicable GDPR rights, please contact dataprotection@mit.edu. You may also contact MIT's representatives: in the EEA, J-PAL Europe, jpaleurope@povertyactionlab.org, 48 Boulevard Jourdan, 75014 Paris, France; in the United Kingdom, MIT Press UK, 71 Queen Victoria Street, London EC4V 4BE.

Changes to this policy

We may change this policy from time to time. If we make a significant change to how we treat your personal information, we will make that clear on this site or contact you directly. The date at the top of this page is when it last changed.

Contact us

For anything about this policy or your information, contact MIT Hacking Medicine at hackmed-directors@mit.edu. For GDPR requests, contact MIT at dataprotection@mit.edu.