1. Scope
This Addendum applies to residents of US states with comprehensive consumer privacy laws other than California, which has its own Addendum. At the date below that includes Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, and it will apply automatically as further state laws take effect.
It supplements our Participant, Researcher and Website Visitor Privacy Notices, and prevails over them where it conflicts, for residents of those states.
It applies only to the extent Voxa Research Ltd is a controller regulated by the relevant state law and only to personal data within that law's scope. Most of these laws exclude deidentified and publicly available information, and several exclude data processed purely in a commercial or employment context.
2. Sale, targeted advertising and profiling
Voxa does not sell personal data, does not process it for targeted advertising, and does not use it for profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.
Matching you to studies is profiling, but it does not produce a legal or similarly significant effect: no service is withheld from you, no price changes, and a study you do not match is simply not shown. You can see and change every profile answer that feeds it in Account & privacy.
Where an automated integrity check provisionally limits access to studies, you can ask a person to review it and contest the outcome, as described in our Data Protection and Your Rights document.
Because we do not sell data or serve targeted advertising, the corresponding opt-out rights are not engaged. If that changes we will update this Addendum first and honour universal opt-out mechanisms, including Global Privacy Control, in the states that require it.
3. Your rights
Where your state law requires consent before processing sensitive data, we rely on your consent: every optional demographic answer is opt-in, is stored separately from your ordinary profile, and can be deleted by you at any time.
In states where minors are given specific protections, note that Voxa is not available to anyone under 18 and we do not knowingly process any child's data.
- Confirm whether we process your personal data, and access it.
- Correct inaccuracies, taking into account the nature of the data and the purposes of processing.
- Delete personal data you provided or that we obtained about you.
- Obtain a copy in a portable and, to the extent technically feasible, readily usable format.
- Opt out of sale, targeted advertising, and profiling with legal or similarly significant effects, none of which we carry out.
- Where your state requires it, obtain a list of the categories of third parties to whom we have disclosed personal data.
- Not be discriminated against for exercising any of these rights.
4. Making and appealing a request
Use the Contact page and choose Privacy and data rights. Signed-in users can also use Account & privacy to update preferences, download an account export or request deletion.
We respond within 45 days of receiving a request. Where reasonably necessary we may extend once by a further 45 days, and we will tell you why within the first period. Requests are free up to twice in any 12-month period; beyond that, or where a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline and explain why.
We may need to verify your identity. If we cannot authenticate a request using commercially reasonable efforts, we may decline it and will tell you so.
An authorised agent may act on your behalf where you have given them written permission, or through a technology such as a universal opt-out mechanism.
Right to appeal. If we refuse to act on your request, you may appeal within a reasonable period by replying to our decision or contacting us again and asking for an appeal. We will respond in writing within 45 days, explaining the reasons for our decision. If we deny your appeal, we will give you a method to contact your state Attorney General to submit a complaint.
5. Consumer health data: Washington, Nevada and Connecticut
This section is our consumer health data privacy policy for the purposes of the Washington My Health My Data Act, Nevada SB 370 and the health data provisions of the Connecticut Data Privacy Act. It applies to residents of those states, and we apply it to everyone whose health-related data we hold.
"Consumer health data" means personal data linked or reasonably linkable to you that identifies your past, present or future physical or mental health status.
6. What consumer health data we collect, and why
We collect consumer health data in exactly one way: where you choose to answer an optional health-related demographic or screening question in the About you section of your account, or in a screening survey we run. Every such question is optional, and you can delete your answers at any time.
Depending on which questions you answer, that data may relate to health conditions, diagnoses, treatment or medication, interventions, procedures, bodily functions or symptoms, or reproductive or sexual health. It may also include inferences we draw from those answers about your eligibility for a study.
- We use it to determine whether you are eligible for studies that screen on a health characteristic, which is the purpose you gave it to us for.
- We use it to provide the service you asked for, and to respond to your questions and requests.
- We use it for security and integrity: preventing, detecting and investigating incidents that threaten the confidentiality, integrity or availability of stored data, and for identity verification and authentication.
- We use it for recordkeeping and auditing, and to comply with our legal obligations.
8. Your consumer health data rights
The fastest route for all of these is Account & privacy: deleting an optional health answer, or your whole sensitive profile, immediately withdraws consent and removes the data. For anything else, use the Contact page and choose Privacy and data rights.
We honour a deletion request for consumer health data within 30 days, and we notify our service providers to delete it too. Where we must retain a record to comply with law or to defend a legal claim, we will tell you what we kept and why.
You will not be denied any service, charged a different price, or given a lower quality of service for exercising these rights.
- Confirm whether we collect, share or sell your consumer health data.
- Access the consumer health data we have collected or control, together with a list of all third parties and affiliates with which we have shared or sold it, and a way to contact them.
- Withdraw your consent to our collection and sharing of your consumer health data.
- Have your consumer health data deleted, including by our service providers, contractors and affiliates.
9. Changes
State privacy law in the United States changes quickly. We review this Addendum as new state laws take effect and update it here with a new effective date. We will not make a material change to how we use consumer health data without first obtaining your consent.