Project ECHO

Privacy Policy

Effective Date: November 6, 2024

Welcome to iECHO, a platform that connects subject matter experts with frontline workers working in the domains of health, education, and other Sustainable Development Goals (SDGs). ("Users ", "you" or "your") to facilitate the sharing of information for enhancing knowledge and reducing global inequity. (the "Platform").

This Privacy Policy describes how we collect, store and disclose information that identifies, relates to or is associated with you when you use the Platform (your "personal information "). Please make sure you read this Privacy Policy before you use the Platform.

The Platform is operated by Extension for Community Healthcare Outcomes, a non-profit organization (referred to in this Privacy Policy as "ECHO", "we", "us" or "our").

If you have any questions about this Privacy Policy or how we use your personal information, please contact us by email at privacy@iecho.org

We may change and/or update our Privacy Policy by posting a new version of it on the Platform from time to time. We encourage you to review this Privacy Policy regularly for any changes. If we modify this Privacy Policy, we will make it available through the Platform and indicate the date of the latest revision. If such modifications materially alter your rights or obligations hereunder, we will notify you of the change via email or through our Platform.

1.What Information we collect

  • a. Information you provide:

    We collect the following personal information:

    • (i) Contact, account and profile information: When you register or create an account on our Platform, we ask for personal information such as your name, salutation, pronoun, email, country, phone, organisation, roles, invited by, profile picture, visibility setting, time zone, languages, description, interest areas, occupation, academic credentials, address, gender. We may also store your password(s) in a hashed / encrypted format to enable sign in. We use this information to: create and authenticate your access to the Platform and facilitate login; provide you with access to the features and functionalities of, and content available through the Platform; allow you to personalise your profile on the Platform, and tailor the content made available to you through the Platform; and communicate with you, including sending service-related communications and alerts, responding to support requests and sending emails with updates about Project Echo.

    • (ii) Information that you post to or share on the Platform: such as learning presentations, research articles and photos. This information may be visible to all Users on the Platform (subject to the visibility settings enabled by you), and may be in the public domain. You may also choose to share other information such as messages and files with other Users using any interactive features on the Platform.

    • (iii) ECHO Programs: We may collect your Personal Information in relation to registration, participation, questions / answers, chat comments and poll responses for some ECHO programs. This information may be used for reports, maps, communications, surveys, quality assurance, evaluation, research, and to inform new initiatives. To learn more about the ECHO programs, click here.

    • (iv) User communications: When you send email or other communication to us, we may retain those communications in order to process your inquiries, respond to your requests and improve our services.

    • (v) Communication preferences: such as whether you have subscribed to receive news and updates from us. We use this information to send you updates about our Platform and the services offered through the Platform, in accordance with your preferences.

    • (vi) Usage information: We may collect data based on your use of the Platform such as user behaviour, preferences, the links / webpages browsed, time spent, etc for research purposes and to improve our functionality. We may use third party services such as Google Analytics, Mixpanel and Hotjar for this purpose. We use this information to: provide you with the features and functionalities of the Platform; maintain the safety, security and integrity of our Platform, the services and content offered through the Platform, our technology assets and business; and to analyse the performance of, and user interaction with the Platform to inform how we can develop and improve the Platform.

    • (vii) Information about your device and network, such as device type, manufacturer, model, operating system, IP address, browser type and unique identifiers associated with your device or your network. We use this information to: provide you with the features and functionalities of the Platform; maintain the safety, security and integrity of our Platform, the services and content offered through the Platform, our technology assets and business; and to analyse the performance of, and user interaction with the Platform to inform how we can develop and improve the Platform.

    • If you are accessing the Platform from the European Economic Area or United Kingdom, additional information about the personal information we collect and how we use it is set out in the Information for UK and European Users section below.

  • b. Cookies:

    • We use cookies and/or similar in-house and third-party tracking tools to track user traffic patterns. Tracking tools also used are beacons, tags and scripts to collect and track information and to improve and analyse our website/Platform.

    • When you access our Platform, our servers also automatically record information that your browser sends whenever you visit a Platform. These server logs may include information such as your Internet Protocol (IP) address and auto-detected location based on IP address.

    • For more information about the cookies and/or similar tools that we use, please refer to our cookie Notice (http://iecho.org/cookie-notice).

    • If you are in the UK or EEA, other than cookies and similar technologies that are necessary to present the Service to you or provide a feature or functionality of the Service, we will only use cookies and similar technologies to the extent you have given us your consent to do so. You can change your preferences and withdraw your consent at any time by clicking on the floating cookie widget.

    • Most browsers will also allow you to change your browser settings to limit automatic data collection technologies on websites. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our Platform, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies, or you may need to update your preferences on multiple devices or browsers.

    • Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.

  • c. Authentication Partners:

    In the event you access the Platform through third party authentication platforms such as Google, you may be required to enter your login details, at which stage you will be required to grant us permission to access and collect your basic information such as name, email address and profile picture you have set to public on such other platform or that you otherwise permit us to access

3. Disclosures and cross border transfer

  • a. We may provide information including personal information to service providers and/or business partners to help us operate the Platform. Specifically, we may use third parties to facilitate our business, such as to host and maintain the Platform. Where we utilize third parties for the processing of any personal information, we implement reasonable contractual and technical protections limiting the use of that information to our specified purposes. We engage with the following third parties for the purposes described below:

  • Name of third partyPurpose of engagement
    ZoomFor hosting and participating in videoconferencing sessions
    AWS (Amazon Web Services)For cloud infrastructure
    FreshdeskFor customer support
    MixpanelFor product and data analytics
    MapboxFor mapping and geospatial visualization
    WhatsAppFor sending reminder messages and transactional communications (Only in India)
    SalesforceAs a customer relationship manager (CRM)
  • b. We may disclose and/or transfer your personal information in connection with a sale, merger, or reorganisation of all or substantially all of the equity, business, or assets of ECHO.

  • c. We may share your personal information with our partners and affiliate entities to enable or support us in providing the Platform, such as ECHO Institute, University of New Mexico in the United States. Specifically, we may share reporting data and analytics with our partners and affiliates in relation to learning programs and other such services offered on the Platform.

  • d. We may transfer your personal information to our partners and affiliate entities in other jurisdictions such as the ECHO Institute (University of New Mexico) in the United States. ECHO Institute is the owner of intellectual property rights in Project ECHO, iECHO, and the ECHO Model, and will require data for reporting and monitoring purposes. By joining ECHO programs, the respective hubs and superhubs (program organizers) will have access to the user data for the programs that they are managing / governing.

  • e. Aside from the above, we only share your personal information in limited circumstances if we have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to:

    • (i) Satisfy any applicable law, regulation, legal process or enforceable governmental request;

    • (ii) Enforce applicable Terms of Use, including investigation of potential violations thereof;

    • (iii) Detect, prevent, or otherwise address fraud, security or technical issues, or;

    • (iv) Protect against imminent harm to the rights, property or safety of ECHO, its Users or the public as required or permitted by law.

    If you are accessing the Platform from the European Economic Area or United Kingdom, additional information about how we disclose personal information and the safeguards we rely on for doing so to recipients outside the EEA or UK is set out in the Information for UK and European Users section below.

4. How we protect your personal information

  • We employ procedural and technological security measures, which are reasonably designed to help protect your personal information from loss, unauthorized access, misuse, alteration or disclosure. Advance Encryption Standards (AES) are implemented for data at rest and in transit. While no computer system is completely secure, we believe the measures implemented by our Platform reduce the likelihood of security problems to a level appropriate to the type of data involved.

5. External Links

  • We may present links in a format that enables us to keep track of whether these links have been followed. We use this information to improve our customized content. Clicking on links may take you to sites outside our domain. We are not responsible for the privacy practices of other web sites. We encourage our Users to be aware when they leave our Site to read the privacy statements of each and every web site that collects personally identifiable information. This Privacy Policy applies solely to information collected by our Platform.

6. How long we retain your personal information

  • We retain Users’ personal information for:

    • as long as you have an active account on the Platform; and

    • otherwise for no longer than necessary for the purposes set out and in accordance with our legal obligations and legitimate business interests.

  • If you or we close your account on the Platform, we will delete your personal information within thirty (30) days.

  • You can close your account using the features and functionalities of the Platform or by contacting us using the details set out at the top of this Privacy Policy. We may also close your account if you have been inactive on the Platform for two (2) years.

  • If you are accessing the Platform from the European Economic Area or United Kingdom, additional information about how long we keep your personal information is set out in the Information for UK and European Users section below.

7. Your Privacy Rights

  • Depending where you are ordinarily resident and from where you access the Platform, you may have various rights in relation to your personal information under the law of the country you are in, including the right to access personal information in our possession, right to have us rectify or modify any such personal information, right to have us erase/delete right to restrict us from processing such personal information, right to object to our use of personal information, withdraw consent at any time where we are relying on consent to process personal information. Users may access, correct and delete their personal information through their user account. Depending on the nature of the request, we may ask you to provide certain details to verify the request. All requests for personal information will be handled within a reasonable period.

  • If you would like to exercise any of these rights, please contact privacy@iecho.org .

  • Further information about your rights in relation to your personal information if you are in the UK or EEA, India or Canada is set out below under the relevant country-specific section.

  • If you are accessing the Platform from the European Economic Area or United Kingdom, additional information about how long we keep your personal information is set out in the Information for UK and European Users section below.

8.Information for UK and European Users

  • Additional information about who is responsible for your personal information

  • ECHO is the controller of your personal information when we use it as set out in this Privacy Policy. This means that we determine and are responsible for how your personal information is used.

  • We also process some of the personal information we receive, such as information posted or shared to the Platform, user account credentials, program participation and profile information, as a processor on behalf of the relevant program partner. This will be the university or institute you work for and that grants you access to the Platform. This means that we use that personal information on behalf of, and on the instructions of the relevant program partner, and the program partner determines and is responsible for how that personal information is used.

  • For more information about how we process personal information as a processor, please refer to the relevant program partner's privacy notice.

  • Additional information about personal information we collect and how we use it

  • Personal information we collectHow we use itLawful basis we rely on
    Contact information, such as your name, salutation, pronoun, email, and phone number.We use this information to communicate with you and respond to your enquiries.The processing is necessary for our legitimate interests, namely to communicate with users and prospective users of our Platform.
    We use this information to send you service-related updates about the Platform.The processing is necessary for our legitimate interests, namely to distribute updates in relation to the Platform.

    Account information, such as your access credentials (username and password) for accessing the Platform, or, if you access the Platform using a third party authentication service, tokens provided by that third party to confirm your authentication through that third party.

    We use this information to maintain the safety, security and integrity of the Platform.

    The processing is necessary for our legitimate interests, namely maintaining the security and integrity of the Platform.

    Profile information, such as your profile picture, visibility setting, time zone, languages, interest areas, occupation, organisation worked for, role, academic credentials, address and gender.

    We use this information to review and analyse the demographics of our users to understand how our Platform is used, how we can improve our Platform and report on the scope and reach of our Platform.

    The processing is necessary for our legitimate interests, namely understanding user demographics and identifying improvements to the Platform and our distribution of the Platform.

    Information that you post to or share on the Platform, such as learning presentations, research articles and photos.We use this information to ensure that the content on the Platform complies with our terms of service.The processing is necessary for our legitimate interests, namely content moderation.
    We use this information to identify content trends to inform our business strategy and the partnerships we enter into.The processing is necessary for our legitimate interests, namely identifying improvements to the Platform and information our strategy for distributing the Platform.

    ECHO Programs: We may collect your personal information in relation to registration, participation, questions / answers, chat comments and poll responses for some ECHO programs.

    We use this information to monitor and analyse participation in the programs made available on the Platform to inform how we can improve and develop the Platform.

    The processing is necessary for our legitimate interests, namely identifying improvements to the Platform and information our strategy for distributing the Platform.

    User communications: When you send email or other communication to us, we may retain those communications.

    We use this information to respond to your queries and requests.

    The processing is necessary for our legitimate interests, namely to communicate with users and prospective users of our Platform.

    We use this information to identify how we can improve the Platform.The processing is necessary for our legitimate interests, namely informing our product development and improvement.
    Communication preferences, such as whether you have subscribed to receive news and updates from us.We use this information to ensure that we send you updates about the Platform only in accordance with your preferences.The processing is necessary to comply with a legal obligation to which we are subject.

    ECHO Programs: We may collect your personal information in relation to registration, participation, questions / answers, chat comments and poll responses for some ECHO programs.

    We use this information to monitor and analyse participation in the programs made available on the Platform to inform how we can improve and develop the Platform.

    The processing is necessary for our legitimate interests, namely identifying improvements to the Platform and information our strategy for distributing the Platform.

    Usage information, such as the pages, links and content you browse and view on the Platform, how long you spend on each page, the links you click, the approximate location you access the Platform from, the site from which you came to the Platform and to which you are going when you leave the Platform, and any other actions you taken on the Platform.

    We use this information to operate, and provide the features and functionalities of the Platform.

    The processing is necessary for our and our partners' legitimate interests, namely providing access to the Platform.

    We use this information to ensure the Platform does not get overloaded and protect it against fraudulent use.The processing is necessary for our legitimate interests, namely load balancing and fraud protection.
    We use this information to monitor the performance of the Platform in order to identify errors and improvements to the Platform.We will only use your personal information in this way to the extent you give us your consent to do so.

    Information about your device and network, such as device type, manufacturer, model, operating system, IP address, browser type and unique identifiers associated with your device or your network.

    We use this information to operate, and provide the features and functionalities of the Platform.

    The processing is necessary for our and our partners' legitimate interests, namely providing access to the Platform.

    We use this information to ensure the Platform does not get overloaded and protect it against fraudulent use.The processing is necessary for our legitimate interests, namely load balancing and fraud protection.
    We use this information to monitor the performance of the Platform in order to identify errors and improvements to the Platform.We will only use your personal information in this way to the extent you give us your consent to do so.
  • Additional information about how we disclose personal information

  • How we may share personal informationLawful basis we rely on

    Service providers, such as providers of web hosting or other technical services such as analytic services or communication services.

    These service providers will use your personal information as processors on our instructions.

    Advisors, such as legal advisors or accountants. These third-party vendors and other service providers perform services for us or on our behalf.

    The lawful basis we rely on for these transfers is that the processing is necessary for our legitimate interests, namely obtaining legal, accounting and other professional advice.

    Purchasers and third parties in connection with a business transaction. Your personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business. These recipients will use your personal information to review and assess a potential transaction to purchase our business or assets.The lawful basis we rely on for these transfers is that they are necessary for our and the purchaser's legitimate interests, namely to conduct due diligence on our business and assets in connection with a potential acquisition.
    Law enforcement, regulators and other parties for legal reasons. We may share your personal information with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements; and / or (iii) exercise or protect the rights, property or personal safety of Echo or others. These recipients will use your personal information in the performance of their regulatory or law enforcement role, or to advise us in connection with a potential claim or regulatory enforcement action.The lawful basis we rely on for sharing personal information with these recipients is that the processing is either necessary to comply with a legal obligation to which we are subject or, where there is no applicable legal obligation to share this data, that the sharing is necessary for our legitimate interests, namely enforcing our rights or complying with requests from regulatory authorities.
  • The personal information we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third-party service providers have operations, including in the United States. We will ensure that these international transfers of your personal information are made pursuant to appropriate safeguards, such as:

    • ensuring that the personal information is only transferred to countries or recipients recognised by the UK Secretary of State or the European Commission (as applicable) as offering an equivalent level of protection as compared to the level of protection in the country you are located ("Adequacy"); or

    • the transfer is to a third party who uses appropriate safeguards in respect of the processing in question, included but not limited to the UK or EU standard contractual clauses, which are recognised as offering adequate protection for the rights and freedoms of data subject, as adopted by the UK Secretary of State or the European Commission (as applicable) ("Standard Contractual Clauses").

    We may transfer your personal information to, or store your personal information in, the following countries: Country

  • CountryAppropriate Safeguard

    United States

    Standard Contractual Clauses Adequacy (for recipients certified to the EU-U.S. Data Privacy Framework and UK Extension)

  • If you wish to enquire further about the safeguards we use, please contact us using the details set out at the beginning of this Privacy Policy.

  • Additional information about how long we retain personal information

  • Personal informationHow long we keep it

    Contact information, account information, profile information

    We keep this information until the partner that granted you access to the Platform or we delete your account on the Platform. We may delete your account if you are inactive for 2 more years.

    Information that you post to or share on the Platform

    We retain this information for as long as the partner that granted you access to the Platform maintains an arrangement with us.

    ECHO Programs

    We store this information in aggregated form.

    User communications

    We keep this information until the partner that granted you access to the Platform or we delete your account on the Platform. We may delete your account if you are inactive for 2 more years.

    Communication preferences

    We keep this information until the partner that granted you access to the Platform or we delete your account on the Platform. We may delete your account if you are inactive for 2 more years.

    Usage information

    Up to 5 years.

    Information about your device or network

    Up to 5 years.

  • Additional information about your Rights (For EU and UK Residents):

  • If you are resident in the UK or EEA, in accordance with applicable privacy law you have the following rights in respect of your personal information that we hold:

    • Right of access. You have the right to obtain:

      • Confirmation of whether, and where, we are processing your personal information

      • Information about the categories of personal information we are processing, the purposes for which we process your personal information, and information as to how we determine applicable retention periods

      • Information about the categories of recipients with whom we may share your personal information

      • A copy of the personal information we hold about you

    • Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine- readable format that supports re-use, or to request the transfer of your personal information to another person.

    • Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.

    • Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.

    • Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.

    • Right to withdraw consent. Where we rely on your consent for processing your personal information, you have the right to withdraw your consent. Withdrawal of your consent will not affect the lawfulness of the processing of your personal information before you withdrew your consent.

  • You have a right to object to any processing based on our legitimate interests. There may, depending on the particular circumstances, be compelling reasons for continuing to process your personal information despite your objection, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.

  • If you wish to exercise one of these rights, please contact us using the contact details at the top of this privacy notice.

  • You also have the right to lodge a complaint to your national data protection authority. If you are in the UK, your local data protection authority is the Information Commissioner's Office, which can be contacted using the details at https://ico.org.uk/global/contact-us/. If you are in the European Economic Area, you can find your local Data Protection Authority at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

9. Information For Indian Visitors

  • The residents of India can exercise the following rights with respect to Personal Information:

    • i. Right to access

    • ii. Right to correction and erasure of

    • iii. Right of have means for raising any grievance for any acts and omissions of ECHO regarding the handling of individuals’ Personal Information or the exercise of their rights.

    • iv. Right to Nominate another individual, who will exercise these rights on their behalf in case of any resident’s death or incapacity.

  • The residents can also approach Data Protection Board of India (DPBI), in case the Company fails to resolve any privacy-related grievances, disputes and issues of the residents.

10. Information for Australian Visitors

  • i. Applicability of Privacy Act: We are bound by the Privacy Act 1988 (“Privacy Act”) and the Australian Privacy Principles (APPs) for Personal Information provided by visitors from Australia on our Website.

  • ii. Transfer of your Personal Information outside of Australia: We will ensure that the transfer of Personal Information is as per the requirements of Privacy Act.

  • iii. Inquiries and Complaints: If you have any concerns or complaints about our privacy practices or this Privacy Notice you may contact us atprivacy@iecho.org We will respond to your concerns/complaints within a reasonable period of time. If you are not satisfied how your complaint has been addressed, you may escalate your complaint to Office of the Australian Information Commissioner (OAIC) GPO Box 5218 Sydney NSW 2001.

11. INFORMATION FOR CANADA USERS

  • i. Applicability of PIPEDA: This Privacy Notice is subject to the Canada Personal Information Protection and Electronic Documents Act (the “PIPEDA”).

  • ii. Personal Information: Personal Information provided is information about an identifiable individual. Personal Information does not include business names and business contact information used in a commercial context.

  • iii. Accuracy of Personal Information: We will take reasonable efforts to ensure that Personal Information collected by us or on our behalf is accurate and complete.

  • iv. Withdrawal of Consent: As per the PIPEDA upon reasonable notice given by You about the withdrawal of Your consent given with respect to the collection, use or disclosure of Personal Information, We will inform You of the likely consequences of withdrawing this consent and will cease (and cause any of our data intermediaries and agents to cease) collecting, using or disclosing the Personal Information, unless it is required or authorized under applicable laws.

  • v. Transfer of your Personal Information outside of Canada: We will ensure that the transfer of Personal Information is as per the requirements of PIPEDA.

  • vi. Inquiries: If you have any concerns, enquiries or complaints related to your Personal Information, please contact us at privacy@iecho.org

12. Choice and Opt-Out

  • We may send you communications including but not limited to (a) notices about your use of our Platform, including those concerning violations of use, (b) updates, promotional information regarding our services, and newsletters. You may opt out of receiving promotional emails and newsletters from us by following the unsubscribe instructions provided in those emails. Alternatively, you can opt out, at any time, by emailing at privacy@iecho.org. with your specific request.

13. Withdrawal of consent

  • You may withdraw your consent to submit any or all personal information or decline to provide any permissions as covered above at any time. In case, you choose to do so then your access to Platform may be limited, or we might not be able to provide the Services to you. You may withdraw your consent by writing to us at privacy@iecho.org .

14. Grievance Officer

  • If you have any questions or comments about the Privacy Policy or in relation to the collection, storage, usage, disclosure and/or processing of your personal information, you can contact the Grievance Officer. The contact details of the Grievance Officer are as follows:

    • Name: Kartik Dhar

    • Address: 1650 University Blvd, NE Albuquerque, NM 87131, United States of America