Privacy Policy

Effective Date: November 25, 2024

By visiting the Platform (as defined in the Terms of Use),registering on the Platform, sharing personal information with us, or using/accessing Services (as described below) in any manner, you ("User") agree to enter into a legally binding contract with Extension for Community Healthcare Outcomes (ECHO) ("ECHO") and accept the terms of this Privacy Policy.

This Privacy Policy constitutes an integral part of the Terms of Use. All capitalised terms used, but not defined herein shall have the same meaning as ascribed to them under Terms of Use. If User does not unconditionally accept this Privacy Policy, they are advised to refrain from using the Platform and Services.

This Privacy Policy describes the types of information (including personal information and sensitive personal data and information) collected by ECHO from User or that User may provide to ECHO in the course of accessing or using Services (“Information"). It also lists ECHO policy with regards to collection, usage, storage, protection and disclosure of Information.

We may change and/or update our Privacy Policy by posting a new version of it on the Platform from time to time. We encourage you to review this Privacy Policy regularly for any changes. If we modify this Privacy Policy, we will make it available through the Platform and indicate the date of the latest revision. If such modifications materially alter your rights or obligations hereunder, we will make reasonable efforts to notify you of the change via email or through our Platform. Your continued use of the Platform and/or continued provision of personal information to us will be subject to the terms of the then-current policy.

In this Privacy Policy, “we”, “us” and “our” refer to ECHO; and “you” and “your” refer to you, the User.

1.What Information we collect

We only use your information in the manner described in this Privacy Policy.

• a. Personal Information:

  We consider "Personal Information" to include information that alone or when in combination with other information may be used to readily identify or contact you, such as: name, address, email address, or phone number. We do not consider “personal information” to include information that has been anonymized so that it does not allow a third party to reasonably identify a specific individual.

• b. Information you provide:

  We collect information to provide more effective services, such as:

  • (i) Account information: We ask for personal information such as your name, salutation, pronoun, email, country, phone, organisation, roles, invited by, profile picture, visibility setting, time zone, languages, description, interest areas, occupation, academic credentials, address, gender and other such information when you register / create an account to use certain features of our Platform. We may also store your password(s) in a hashed / encrypted format to enable sign in.

  • (ii) Information sharing: When you post or share any information on the Platform such as learning presentations, research articles, photos, such information may be visible to all Users on the Platform (subject to the visibility settings enabled by you), and maybe in the public domain. You may also choose to share other information such as messages and files with other Users using any interactive features on the Platform. All such sharing of information is done at your own risk. If you disclose personal information in your profile or when posting on our forums this information may become publicly available.

  • (iii) User information: We may collect data based on your use of the Services such as user behaviour, preferences, the links / webpages browsed, time spent, etc for research purposes and to improve our functionality. We may use third party services such as Google Analytics, Mixpanel and Hotjar for this purpose.

  • (iv) User communications: When you send email or other communication to us, we may retain those communications in order to process your inquiries, respond to your requests and improve our services.

  • (v) TeleECHO® Programs: We may collect your Personal Information in relation to registration, participation, questions / answers, chat comments and poll responses for some TeleECHO programs. This information may be used for reports, maps, communications, surveys, quality assurance, evaluation, research, and to inform new initiatives. To learn more about the TeleECHO programs, click here.

  • (vi) iECHO and iECHO sessions: When you participate in session conducted by ECHO, we may receive your personal information. Such Personal Information may be used by project ECHO staff and hub admins for research and evaluation purposes.

• b. Cookies:

  We use cookies and/or similar in-house and third-party tracking tools to track user traffic patterns. Tracking tools also used are beacons, tags and scripts to collect and track information and to improve and analyse our website/Platform. You may choose to disable cookies through your browser settings. For more information, please refer to our cookie Notice.

• c. Log information:

  When you access our Platform, our servers automatically record information that your browser sends whenever you visit a Platform. These server logs may include information such as your Internet Protocol (IP) address and auto-detected location based on IP address.

• d. Authentication Partners:

  In the event you access the Platform through third party authentication platforms such as Google, you may be required to enter your login details, at which stage you will be required to grant us permission to access and collect your basic information such as name, email address and profile picture you have set to public on such other platform. In the event such information is not public, but you permit us to access this information, we shall have access to the same. This information is stored along with other information pertaining to you.

2. How we use your personal information

• As noted in section 1A above, the information (including personal information) we collect enables us to better understand our Users’ needs and provide you with a better experience. We may use your information in any of the following methods:

• Type of information	Use
  Name	To identify Users on the Platform.
  Salutation	To display the Users’ name in a suitable form.
  Pronoun	To be inclusive and ensure the User is addressed appropriately in the community.
  Email	To communicate with Users and enable authentication.
  Country	To ensure the legal / data privacy framework is complied with, and for data analytics / reporting needs.
  Phone	To communicate with Users and enable authentication.
  Organisation	To enable organisation-level functionality and for reporting.
  Roles	To grant access to specific administrative or hub-specific functions.
  Invited by	To keep track of peer-to-peer invitations on the Platform.
  Profile picture	To create a sense of community on the Platform.
  Visibility setting	To allow for community interaction and searching.
  Location	To identify the location of the User.
  Profession	To be informed about the profession.
  Time zone	To display session details in appropriate times for the Users.
  Languages	To display information in a language that the User understands.
  Description	To allow for Users to create their digital profile / identity.
  Interest Areas	To recommend suitable content and programs based on a User’s needs.
  Occupation	To recommend suitable content and programs based on a User’s needs, and for reporting purposes.
  Academic credentials	To recommend suitable content and programs based on a User’s needs, and for reporting purposes.
  Address	For reporting purposes to understand geographic impact and reach of ECHO, and for geo-specific legal / data privacy regulations.
  Gender	To understand the impact of ECHO and ensure that ECHO is being inclusive and gender neutral.

• a. We may use your personal information such as your name, writing, image, and likeness, including voice and image in any form by Project ECHO for the purpose of advertising and promotion of Project ECHO in any media, throughout the world until you withdraw your consent for using your personal information.

• b. We may alert you by email or phone to inform you about new service offerings or other information which we feel might be useful for you.

• c. From time to time, we may use personal information for new and unanticipated uses not previously disclosed in our Privacy Policy. If our information practices change regarding information previously collected, we shall make reasonable efforts to provide notice and obtain consent of any such uses as may be required by law

• d. When you use iECHO and participate in ECHO sessions, you acknowledge that project ECHO staff and hub admins may use your Personal Information for research and evaluation purposes

3. Disclosures and cross border transfer

• a. We may provide information including personal information to service providers and/or business partners to help us bring you the Services we offer. Specifically, we may use third parties to facilitate our business, such as to host the Platform at a co-location facility for servers. Where we utilize third parties for the processing of any personal information, we implement reasonable contractual and technical protections limiting the use of that information to our specified purposes. We engage with the following third parties for the purposes described below

• Name of third party	Purpose of engagement
  Zoom	For hosting and participating in videoconferencing sessions
  AWS (Amazon Web Services)	For cloud infrastructure
  Freshdesk	For customer support
  Mixpanel	For product and data analytics
  Mapbox	For mapping and geospatial visualization
  WhatsApp	For sending reminder messages and transactional communications (Only in India)
  Salesforce	As a customer relationship manager (CRM)

• b. We may disclose and/or transfer your personal information in connection with a sale, merger, or reorganisation of all or substantially all of the equity, business, or assets of ECHO.

• c. We may share your personal information with our partners and affiliate entities to enable or support us in providing the Platform, such as ECHO Institute, University of New Mexico in the United States. Specifically, we may share reporting data and analytics with our partners and affiliates in relation to learning programs and other such services offered on the Platform.

• d. We may transfer your personal information to our partners and affiliate entities in other jurisdictions such as the ECHO Institute (University of New Mexico) in the United States. ECHO Institute is the owner of intellectual property rights in Project ECHO, iECHO, and the ECHO Model, and will require data for reporting and monitoring purposes. By joining ECHO programs, the respective hubs and superhubs (program organizers) will have access to the user data for the programs that they are managing / governing.

• e. We may share with third parties certain pieces of aggregated, non-personal information, for reporting, mapping, communications, surveys, etc. Such information does not identify you individually.

• f. Aside from the above, we only share your personal information in limited circumstances if we have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to:

• • (i) Satisfy any applicable law, regulation, legal process or enforceable governmental request;

  • (ii) Enforce applicable Terms of Use, including investigation of potential violations thereof;

  • (iii) Detect, prevent, or otherwise address fraud, security or technical issues, or;

  • (iv) Protect against imminent harm to the rights, property or safety of ECHO, its Users or the public as required or permitted by law.

4. How we protect your personal information

• We employ procedural and technological security measures, which are reasonably designed to help protect your personal information from loss, unauthorized access, misuse, alteration or disclosure. Advance Encryption Standards (AES) are implemented for data at rest and in transit.

  While no computer system is completely secure, we believe the measures implemented by our Platform reduce the likelihood of security problems to a level appropriate to the type of data involved. Data pilferage due to unauthorized hacking, virus attacks, technical issues is possible, and we will take necessary measures to mitigate such events.

5. External Links

• We may present links in a format that enables us to keep track of whether these links have been followed. We use this information to improve our customized content. Clicking on links may take you to sites outside our domain. We are not responsible for the privacy practices of other web sites. We encourage our Users to be aware when they leave our Site to read the privacy statements of each and every web site that collects personally identifiable information. This Privacy Policy applies solely to information collected by our Platform.

6. How long we retain your personal information

• Currently, we plan to retain Users’ information for a minimum of 10 years. We may alter this practice according to legal and business requirements. For example, we may lengthen the retention period for some data if needed to comply with law. Unless otherwise prohibited, we may shorten the retention period for some types of data if needed to free up storage space or where we are otherwise required to do so under applicable law.

7. Your Privacy Rights

• Users have the right to access Personal Information in our possession, right to have us rectify or modify any such Personal Information, right to have us erase/delete right to restrict us from processing such Personal Information, right to object to our use of Personal Information, withdraw consent at any time where we are relying on consent to process Personal Information. Users may access, correct and delete their Personal Information through their user account. Depending on the nature of the request, we may ask you to complete a Personal Information request form or seek certain details to verify the request. All requests for Personal Information will be handled within a reasonable period. If you would like to exercise ANY of these rights, please contact support@iecho.org.

8.Information for UK and European Users

• Residents of the European Union (““EU”) and United Kingdom (“UK") should note that this Privacy Policy has been updated in accordance with the requirements of the EU General Data Protection Regulation (the “GDPR”) and the UK GDPR, the United Kingdom Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and any regulation superseding any of the foregoing (““UK Privacy Laws””). As per the provisions of the GDPR and UK Privacy Laws we shall be considered the Controllers of the Personal Information collected as a result of your use / access of the website and Processors of the Personal Information collected as a result of your use / access our services of the Platform.

• Legal Basis (for EU residents and UK residents): We will not process your Personal Information without a lawful basis to do so. We will process your Personal Data only on the legal bases of consent, contract, or on the basis of our legitimate interests, provided that such interests are not overridden by your privacy rights and interests.

• Transfer of your personal information across borders (for EU Residents): The Personal Information we collect (of EU and UK residents) is stored on AWS data centres located in the USA and India. Personal Information might be processed outside the EU and UK. We collect and transfer Personal Data outside the EU and UK in accordance with the provisions of the GDPR and UK Privacy Laws. If you have questions, please contact privacy@iecho.org.

• Your Rights (For EU and UK Residents):

  You have the right to request us:

• • (i) to let you know what Personal Information belonging to you, we hold in our possession,

  • (ii) withdraw consent at any time where we are relying on consent to process your Personal Information,

  • (iii) right to have us rectify or modify any such Personal Information,

  • (iv) right to have us erase/delete your Personal Information,

  • (v) right to restrict us from processing such Personal Information,

  • (vi) right to object to our use of your Personal Information,

  • (vii) you have the right to lodge a complaint with a data protection authority.

UK residents have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance. We may need to request specific information from you to help us confirm your identity or also contact you for further information in relation to your request. If you would like to exercise ANY of these rights, please contact privacy@iecho.org.

Governing Laws: For any EU and UK residents, this Privacy Policy shall be governed respectively by the provisions of the GDPR and UK Privacy Laws.