Anspar Foundation
Version 1.0
Last Updated: November 27, 2025
This Comprehensive General Privacy Policy (Policy) establishes the foundational privacy framework for all Anspar Foundation activities. Project-specific privacy requirements are addressed in separate Project Privacy Addenda that supplement—but do not replace—this Policy.
Anspar Foundation ("Anspar," "we," "us," or "our") is a technology development organization that builds applications and systems for healthcare, research, and charitable purposes. We work with partner organizations, including patient advocacy foundations, research institutions, and healthcare providers, to develop technology solutions that advance health outcomes and scientific understanding.
This Comprehensive General Privacy Policy ("Policy") describes how Anspar Foundation collects, uses, shares, protects, and retains personal information across all our activities, projects, and services. This Policy applies to:
This Policy establishes our foundational privacy framework. Because we engage in diverse projects with varying data collection requirements, we use a modular structure:
Comprehensive General Privacy Policy (This Document): Establishes core principles, rights, security standards, and governance that apply to all Anspar activities.
Concise General Privacy Policy: A summary document containing the essential Policy information necessary to comply with GDPR and other regulations.
Project Privacy Addenda: Supplemental documents that specify project-specific data collection, use, sharing, and retention practices. Each addendum incorporates this Policy by reference.
When you use a specific Anspar project or service, both this Policy and any applicable Project Privacy Addendum govern your information. In the event of a conflict between this Policy and a Project Privacy Addendum, the Project Privacy Addendum controls for that specific project, except that a Project Privacy Addendum may not reduce the core protections and rights established in Sections 6 (Your Rights), 7 (Data Security), and 14 (Complaints) of this Policy.
This Policy is designed to comply with applicable privacy and data protection laws, including:
Specific regulatory requirements for individual projects are detailed in the applicable Project Privacy Addenda.
Anspar Foundation frequently develops technology in partnership with or under contract to other organizations. This Policy is designed to ensure continuity when:
Upon any such transfer, existing consents and authorizations remain valid, the successor organization assumes all applicable obligations, and users are notified but are not required to provide new consent for the transfer itself.
The following definitions apply throughout this Policy and all Project Privacy Addenda:
"Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. This includes "Personal Data" as defined under GDPR.
"Protected Health Information (PHI)" means individually identifiable health information transmitted or maintained in any form or medium, as defined under HIPAA.
"Special Categories of Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation, as defined under GDPR Article 9.
"Sensitive Personal Information" means (under CCPA/CPRA) Personal Information that reveals social security number, driver's license number, financial account information, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of communications, genetic data, biometric information, health information, or sex life/sexual orientation information.
"Data Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
"Data Processor" means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller.
"Business Associate" means a person or entity that performs certain functions or activities involving the use or disclosure of Protected Health Information on behalf of, or provides services to, a Covered Entity, as defined under HIPAA.
"Project" means any application, service, research study, or other initiative undertaken by Anspar Foundation, whether independently or in partnership with other organizations.
"Project Privacy Addendum" means a supplemental privacy document that specifies data practices for a particular Project and incorporates this General Privacy Policy by reference.
Across our activities, Anspar Foundation may collect the following general categories of information. We endeavor to collect only the minimal information necessary to fulfill the service requested. Specific data elements collected for each Project are detailed in the applicable Project Privacy Addendum.
For Projects involving health applications or research:
For donors, partners, or vendors:
We collect information through:
The specific data elements collected for each Project are detailed in the applicable Project Privacy Addendum. Before using any Anspar Project, please review both this Policy and the Project-specific Addendum.
We use Personal Information for the following general purposes across all Projects:
Under the GDPR, we process Personal Data based on the following legal grounds:
For Special Categories of Personal Data (including health data), we rely on additional legal bases under Article 9, including explicit consent (Article 9(2)(a)) and scientific research purposes (Article 9(2)(j)) with appropriate safeguards.
Specific purposes for each Project are detailed in the applicable Project Privacy Addendum.
We may share your information with the following categories of recipients:
We do not share your Personal Information with partner organizations by default. Data sharing with partner organizations occurs only when you affirmatively request a service that requires such sharing, and only after you provide explicit consent through a clear consent process.
Types of partner organizations we may work with include:
Consent Process: Before any data is shared with a partner organization, you will be presented with a specific consent request that identifies: (1) the partner organization, (2) the specific data to be shared, (3) the purpose of the sharing, and (4) any additional terms. You may decline without affecting your use of our core services.
We engage trusted service providers who assist in our operations:
All service providers are bound by contractual obligations (including Business Associate Agreements under HIPAA and Data Processing Agreements under GDPR) that require them to protect your information and limit its use.
We may disclose information when required by law or to:
In the event of a merger, acquisition, reorganization, or transfer of assets, your information may be transferred to a successor entity that agrees to be bound by the terms of this Policy.
Anspar Foundation does not sell Personal Information. We do not share data for third-party advertising purposes. Any data sharing is conducted solely for the purposes described in this Policy and applicable Project Privacy Addenda.
Specific data sharing arrangements for each Project are detailed in the applicable Project Privacy Addendum. All partner organization sharing remains opt-in and requires your explicit consent before any data is shared.
CORE PROTECTION: The rights in this Section represent core protections that apply to all Anspar activities and cannot be reduced by any Project Privacy Addendum.
Regardless of your location, you have the right to:
If you are a U.S. resident and we maintain your Protected Health Information:
If you are in the European Economic Area:
California residents have the following rights under CCPA/CPRA:
To exercise any rights, contact us using the information in Section 13. We will respond within applicable timeframes:
Certain rights may be limited where permitted by law, including for clinical trial data integrity, regulatory compliance, or legal obligations. Any limitations are specified in the applicable Project Privacy Addendum.
CORE PROTECTION: The security standards in this Section represent core protections that apply to all Anspar activities and cannot be reduced by any Project Privacy Addendum.
We implement comprehensive safeguards to protect your information:
In the event of a security breach:
We retain Personal Information only as long as necessary for the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce agreements.
Certain data is subject to extended retention as required by regulation, including clinical trial data (up to 25 years under EU Clinical Trial Regulation) and FDA-regulated records. Extended retention requirements are specified in applicable Project Privacy Addenda.
When data is no longer required, we securely delete or anonymize it. Anonymized data that cannot be linked to individuals may be retained indefinitely for research and statistical purposes.
Anspar Foundation is based in the United States. Your data may be processed and stored in the United States and potentially other countries where our service providers operate.
For transfers from the EEA, UK, or Switzerland to countries without adequate data protection, we use:
Our websites and applications may use:
You can manage cookies through your browser settings. Note that disabling certain cookies may affect functionality. We honor Global Privacy Control (GPC) signals.
Our general services are not intended for children under 13 (or 16 in certain EU jurisdictions). We do not knowingly collect Personal Information from children without appropriate parental consent.
For Projects involving pediatric participants (such as clinical research), appropriate consent mechanisms are implemented as required by applicable law and specified in the Project Privacy Addendum.
We may update this Policy periodically. When we make material changes:
Your continued use of our services after notice constitutes acceptance of the updated Policy.
General Privacy Inquiries:
Anspar Foundation
Attention: Privacy Officer
Email: privacy@anspar.org
Data Protection Officer:
Email: dpo@anspar.org
EU Representative (for GDPR):
[To be designated when applicable]
CORE PROTECTION: Your right to complain about our data practices cannot be limited by any Project Privacy Addendum.
If you have concerns about how we handle your data:
We will not retaliate against you for filing a complaint.
Each Project Privacy Addendum should address the following elements:
Each Project Privacy Addendum must include the following incorporation clause:
This Project Privacy Addendum supplements and incorporates by reference the Anspar Foundation General Privacy Policy (Version [X], Effective [Date]). In the event of conflict between this Addendum and the General Privacy Policy, this Addendum controls for this Project, except that this Addendum may not reduce the core protections established in Sections 6 (Your Rights), 7 (Data Security), and 14 (Complaints) of the General Privacy Policy.
21 CFR Part 11: FDA regulations on electronic records and signatures.
CCPA/CPRA: California Consumer Privacy Act as amended by California Privacy Rights Act.
Clinical Trial Regulation (EU) No 536/2014: EU regulation on clinical trials for medicinal products.
EU Annex 11: EU GMP guidelines for computerized systems.
GDPR: General Data Protection Regulation (EU) 2016/679.
HIPAA: Health Insurance Portability and Accountability Act of 1996.
HITECH Act: Health Information Technology for Economic and Clinical Health Act.
ICH-GCP: International Council for Harmonisation Good Clinical Practice.
Version History:
Version 1.0 – November 27, 2025 – Initial Release
Review Schedule:
This Policy shall be reviewed at least annually and updated as necessary.