CMS Privacy Policy

Privacy Policy for Hyfe CoughMonitor Suite (CMS)

Hyfe Inc. (“Hyfe,” “we,” “our,” or “us”) is committed to protecting the privacy of individuals participating in clinical trials using the Hyfe CoughMonitor Suite (CMS). This policy outlines how data is collected, used, stored, and protected, ensuring compliance with industry regulations and safeguarding participants' rights.

1. Scope

This Privacy Policy applies to the data collected through the Hyfe CoughMonitor Suite (CMS), a research platform designed to monitor cough in clinical trials. It is intended for use by researchers, sponsors, and participants in clinical trials.

2. Key Principles

• Transparency: We provide clear information about how your data is handled.
• Data Minimization: Only necessary data is collected and processed.
• Security: Industry-standard measures protect all collected data.
• Compliance: We adhere to regulations such as GDPR, HIPAA, and other applicable laws.

3. What Data Is Collected?

CMS collects non-sensitive, pseudonymized data, including:

• Cough Timestamps over time: acoustic signals are processed on the wearable CMS device in a privacy preserving way with no audio recorded, stored or sent outside the CMS device. Cough timestamps contain no audio and no other identifiable information.
• Device and Usage Information: device type, operating system, CMS wearable battery level timestamps and may include wear/non-wear time intervals for the CMS wearable.
• Research Data: information related to trial protocols, such as study identifiers, which are generated by Hyfe and then assigned and managed by study investigators. Hyfe does not have access to any participant-identifiable data.

Note: CMS does not collect or store sensitive personal data (e.g., names, emails, addresses, Social Security Numbers) or data that directly identifies participants.

4. How Is Data Used?

Data collected via CMS is used for:

• Supporting clinical trial research objectives.
• Analyzing cough timestamp patterns to assess medical interventions or describe observations.
• Ensuring compliance with study protocols and regulatory requirements.

All data is de-identified and analyzed in aggregate form to ensure participant anonymity. Hyfe has no access to the identities or any identifiable data of the study participants.

5. Data Storage and Security

• Storage: Data is stored on secure servers in compliant infrastructures, such as Google Cloud and AWS.
• Encryption: Data is encrypted in transit (using TLS) and at rest (using AES standards).
• Access Controls: Access is restricted to authorized research personnel and is role-based.
• Retention: Data is retained only as long as necessary for research purposes or regulatory compliance, after which it is securely deleted or remains pseudonymized.

6. Data Sharing

We do not share participant-identifiable data. De-identified, aggregate data may be shared with:

• Research institutions and clinical trial sponsors.
• Regulatory agencies, as required by law.
• Third-party service providers supporting CMS operations, under strict contractual confidentiality agreements.

7. Consent and Participant Rights

Participants in clinical trials must provide informed consent for data collection and use. This includes:

• Right to Access: Request access to your data.
• Right to Rectification: Correct inaccuracies in your data.
• Right to Withdraw: Request discontinue collection of your data, where applicable

8. International Data Transfers

If data is transferred outside the participant's country, appropriate safeguards (e.g., Standard Contractual Clauses) are implemented to ensure compliance with international data protection standards.

9. No Links to Identifiable Patient Data

The Hyfe CoughMonitor Suite is designed to operate without linking to sensitive or identifiable patient data. No acoustic data containing any personally identifiable elements is recorded or retained.

Children’s Privacy

CMS is not intended for use by children under the age of 13 unless explicitly part of a clinical trial with appropriate parental or guardian consent.

Policy Updates

We may update this Privacy Policy to reflect changes in regulations or practices. Any significant changes will be communicated to participants and stakeholders in a timely manner.

Contact Us

If you have questions or concerns about this Privacy Policy or your data, please contact our Data Protection Officer:

Hyfe Inc.

Email: privacy@hyfe.ai