Privacy Policy — Havana Syndrome Discovery Institute

1. Overview and Scope

The Havana Syndrome Discovery Institute (HSDI) is committed to the responsible stewardship of all personal and sensitive information submitted to or collected through this platform. This Privacy Policy governs the collection, processing, storage, and disclosure of information obtained through the HSDI Helios web platform, including all case intake submissions, contact inquiries, research collaboration requests, and user account data.

This policy applies to all visitors, registered users, government partners, research collaborators, and individuals who submit incident reports through the Case Intake protocol. By accessing this platform, you acknowledge that you have read and understood the terms set forth herein.

2. Information We Collect

HSDI collects information in two principal categories: information you provide directly and information collected automatically through your use of the platform.

Information provided directly includes: full name, organizational affiliation, professional title, incident details submitted through the Case Intake form, contact inquiry content, and any supporting documentation voluntarily uploaded. For victim support submissions, this may include medical symptom descriptions, geographic incident locations, and exposure timelines.

Information collected automatically includes: browser type, operating system, IP address, pages visited, session duration, and referring URL. This technical data is used exclusively for platform security, performance monitoring, and aggregate analytics. It is not linked to individual user identities without explicit consent.

3. How We Use Your Information

Information submitted through this platform is used solely for the purposes for which it was provided. Case intake submissions are processed within the HELIOS forensic intelligence framework to assign specialist workstreams, activate Golden Hour protocols where applicable, and contribute to the aggregate evidentiary record under ECIA-7 compliance standards.

Contact inquiries are used to route communications to the appropriate HSDI team and to respond to the submitting party. Research collaboration requests are reviewed by the HSDI Scientific Advisory Board. No personal information is used for commercial purposes, advertising, or profiling.

Aggregate, de-identified data derived from incident submissions may be used in published research, policy briefings, and scientific reports. Individual identities are never disclosed in such publications without explicit written consent.

4. Information Sharing and Disclosure

HSDI does not sell, rent, or trade personal information to any third party. Information may be shared in the following limited circumstances only:

With government agencies or law enforcement when required by applicable law, court order, or when HSDI determines in good faith that disclosure is necessary to protect the safety of any person or to prevent imminent harm. In such cases, HSDI will notify the affected individual to the extent permitted by law.

With research partners and institutional collaborators who have executed a formal data sharing agreement with HSDI, subject to the same confidentiality obligations as HSDI itself. Such agreements require that data be used only for the stated research purpose and be destroyed or returned upon completion.

With technical service providers who support platform operations, including cloud infrastructure and security monitoring services. These providers are contractually prohibited from accessing or using personal data for any purpose other than providing the contracted service.

5. Data Security and Retention

HSDI implements technical and organizational measures consistent with industry best practices to protect personal information against unauthorized access, alteration, disclosure, or destruction. Case intake submissions are handled under enhanced data protection protocols, including encryption in transit and at rest.

Personal information is retained for the minimum period necessary to fulfill the purpose for which it was collected, subject to any legal retention obligations. Case intake data may be retained for a longer period where it forms part of an active investigation or contributes to the longitudinal evidentiary record, in which case retention is governed by the applicable research protocol.

You may request deletion of your personal information at any time by submitting a written request through the Contact page. Requests will be processed within thirty days, subject to any legal obligations that require retention.

6. Your Rights

Depending on your jurisdiction, you may have the right to access the personal information HSDI holds about you, to request correction of inaccurate data, to request deletion of your data, to object to certain processing activities, and to receive a copy of your data in a portable format.

To exercise any of these rights, please submit a request through the Contact page, selecting the General Inquiry category. HSDI will respond within thirty days. We may require verification of your identity before processing any such request.

Individuals located in the European Economic Area, the United Kingdom, or California may have additional rights under applicable data protection law. HSDI processes personal data on the legal bases of legitimate interest (for security and fraud prevention), contractual necessity (for case intake and research collaboration), and consent (for optional communications).

7. Cookies and Tracking Technologies

This platform uses strictly necessary cookies to maintain session state and ensure secure authentication. No third-party advertising cookies or cross-site tracking technologies are deployed. Analytics data is collected using privacy-preserving methods that do not identify individual users.

You may configure your browser to refuse cookies, but doing so may impair certain platform functions, including authenticated access to protected research materials.

8. Changes to This Policy

HSDI reserves the right to update this Privacy Policy at any time. Material changes will be communicated through a notice on the platform homepage and, where feasible, by direct notification to registered users. The effective date at the top of this page will be updated to reflect the date of the most recent revision. Continued use of the platform following notification of changes constitutes acceptance of the revised policy.

9. Contact and Questions

All questions, concerns, or requests regarding this Privacy Policy should be directed through the Contact page. HSDI does not publish direct contact details for privacy and security reasons. All inquiries submitted through the Contact page are reviewed by the HSDI compliance team and responded to within thirty days.