Privacy policy

We never sell your personal information. This policy explains how HealthChorus handles personal data for members and visitors, wherever they live. It covers the EU and UK GDPR, India's Digital Personal Data Protection Act, the California Consumer Privacy Act and other US state laws, Canada's PIPEDA, Brazil's LGPD, Singapore's PDPA, Australia's Privacy Act and South Africa's POPIA.

1. Who we are

HealthChorus is operated by Research and Metric Corporation, 30 N Gould St, Ste R, Sheridan, Wyoming 82801, United States. We decide how and why your personal data is used, so we are the data controller (called the "data fiduciary" under India's DPDP Act). Research and Metric also has offices in India and Singapore that support the panel.

Privacy contact, including grievances and data requests: privacy@healthchorus.com.

2. What we collect

• Account details: first and last name, email address, password (stored only as a secure hash), country, date of birth and gender.
• Profile answers: what you tell us in profile quests, such as household, work, education, technology and lifestyle. Optional access needs you choose to share.
• Survey and study answers: your answers to the daily question, pre-screeners, surveys and studies, and recordings or notes from focus groups and interviews when the study tells you so first.
• Rewards and payments: points, survey cash, study rewards, cash-out requests, and the details needed to pay you, such as your PayPal email address.
• Sign-up and security checks: your IP address, the country of your internet connection, whether a VPN, proxy or hosting network is used, your browser time zone, device and browser type, and log-in records.
• Money and assets: the income and savings ranges you choose in your profile. We never ask for exact figures, statements or account numbers.
• Verification details: your mobile number and the result of the text message check; your work email address and its company domain; if you connect LinkedIn, the name, email address, photo link and account number LinkedIn shares, and which verifications LinkedIn has completed for you (identity or workplace); if you connect Facebook, Instagram, Google, YouTube or X, the account number, name, username, account creation date and follower count the platform shares; and, if you choose the ID check, a photo of your ID document (none for Aadhaar), a selfie, the details read from the document such as name, date of birth, expiry date and the last four characters of a document number, and a scrambled code of the document number.
• Messages: emails and support requests you send us.
• Cookies: only those the site needs, plus your saved display settings. See our cookie policy.

We collect this from you, from your use of the site, from the IP intelligence service we use for country and VPN checks, and from the social platforms you choose to connect.

3. How we use it

Under India's DPDP Act we rely on your consent, given when you sign up and when you take part, and on the legitimate uses the Act allows. You can withdraw consent at any time.

4. What research clients receive

Research clients are the brands, agencies and organisations that commission studies. They receive your answers combined with other members' answers, or without your name and contact details. We only share information that identifies you, such as your first name for a focus group check-in, when a study needs it, the study tells you first and you agree. Clients must keep the data confidential, use it only for research and never contact you for sales.

5. Who we share it with

• Service providers who work for us under contract: website hosting, email delivery, IP intelligence for country and VPN checks, text message verification (Twilio), and payment and gift card providers.
• Research and Metric teams that run fieldwork, such as recruiting for focus groups or shipping product tests.
• Research clients, only as described in section 4.
• Authorities, when the law requires it, or to protect members, the public or our rights.
• A new owner, if HealthChorus is ever sold or merged, under this same policy.

We do not sell personal information and do not share it for cross-context behavioural advertising.

6. International transfers

We are based in the United States and work with teams and providers in other countries, so your data may be processed outside the country where you live. When we transfer data from the EU, UK or other places with transfer rules, we use the protections those laws require, such as the European Commission's standard contractual clauses and the UK addendum, and we follow any transfer restrictions published under India's DPDP Act.

7. How long we keep it

• Account and profile data: while your account is open. When you close it, we delete or anonymise it, except what we must keep.
• Reward and payment records: as long as tax and accounting law requires.
• Sign-up and security check records: only as long as needed to prevent fraud and duplicate accounts.
• ID check photos and the details read from your document: deleted within 30 days after our team has checked them. We keep only the result.
• Scrambled codes of ID document numbers, and of a LinkedIn account that verified your identity, used only to stop one being used on two accounts: while your account is open.
• Which verifications LinkedIn has completed for you: updated each time you sign in with LinkedIn here, and deleted after 365 days. An identity verified through LinkedIn then needs a new check.
• Connected social accounts: until you disconnect them or close your account. We keep no access to the account itself.
• Browser records used to spot duplicate accounts: up to 400 days after your last visit.
• Survey answers given to clients without your name are no longer personal data and may be kept by them.

If you do not use your account for a long time, we may close it and erase your data. We will email you before we do.

8. Security

We protect your data with encrypted connections, hashed passwords, limited staff access and regular updates. IP addresses used for location checks are stored only as scrambled values where possible. If a breach puts your data at risk, we will tell you and the relevant authorities as the law requires, including the Data Protection Board of India and, within 72 hours, the supervisory authorities in the EU and UK.

9. Your rights and choices

You can access, correct, download and delete your data, withdraw consent, object to some uses, nominate someone to act for you, and opt out of marketing emails. We give these rights to all members, wherever they live, free of charge. Use your privacy choices or email privacy@healthchorus.com. We reply within one month.

10. Automated checks

When you sign up, we automatically check your email address and whether your internet connection matches the country you give. A sign-up from a VPN or proxy is stopped and you are asked to turn it off. Other sign-ups that look unusual are reviewed by a person before a decision is made. You can ask for a person to review any decision by emailing us.

Before each survey we also check that your connection is not a VPN and matches your country, and we look for signs of duplicate accounts, such as one browser or one cash-out email used by several accounts. These checks, your profile answers and your survey history add up to a trust score. If the score is low, surveys pause until a person on our team reviews the account or you verify your phone, work or identity. Virtual and internet phone numbers cannot be used for verification. When you send an ID check, we automatically check that your connection is in your country and not a VPN, that the document details are valid, that the name and date of birth match your account, and that the document is not used on another account. A person always makes the decision.

11. Sensitive information

Some studies ask about topics such as health, religion or ethnicity. Answering is always optional, the study tells you before it asks, and we only use these answers with your explicit consent and for that research.

The ID check is optional unless a study needs it, and we ask for your explicit consent first. You choose a document from the country where you live, or your passport, and the check has to be done from inside that country without a VPN. The machine-readable parts of a document, such as the QR code on an Aadhaar, the barcode on the back of a US or Canadian licence and the lines at the bottom of a passport page, are read in your browser and checked on our server. For Aadhaar we check the digital signature of UIDAI in the Secure QR code: we never ask for your Aadhaar number or a copy of your Aadhaar. We check document numbers against their format and check digits and keep only a scrambled code of the number, never the number itself. A person on our team compares the photo on your document, or the photo in the Aadhaar QR code, with your selfie by eye. We do not use face recognition software and we do not create biometric templates. The photos and the details read from the document are encrypted, only a few authorised staff can open them, every viewing is recorded, and they are deleted automatically after the check. Where a document shows a number we do not need, the page tells you which part to cover.

Connecting a social account is optional. You sign in on the platform itself, so we never see your password, and the platform tells us who you are. We read your profile once, we do not keep access to the account and we never post anything. You can disconnect it at any time on the verify page.

12. Children

HealthChorus is only for people aged 18 or over, and we check date of birth at sign-up. If we learn that an account belongs to someone under 18, we close it and delete the data.

13. Notice for California and other US states

In the last 12 months we collected these categories of personal information: identifiers (such as name and email), personal characteristics (such as age and gender), records of rewards, internet activity on our site, approximate location from your IP address, and inferences from your profile answers. If you choose the ID check, we also collect an image of a government ID, which is sensitive personal information that we use only to verify your identity and prevent fraud. We use them for the purposes in section 3 and disclose them only as described in section 5. We do not sell or share personal information, and we use sensitive personal information only as allowed by law. You have the rights in section 9 and will not be treated differently for using them.

14. Notice for India (DPDP Act)

Research and Metric Corporation is the data fiduciary. You can withdraw consent, ask for a summary of your data and who it was shared with, correct or erase it, and nominate a person to act for you, using your privacy choices. Grievances can be sent to privacy@healthchorus.com and are answered within the time the rules require. If you are not satisfied, you may complain to the Data Protection Board of India.

15. Changes to this policy

We will update this policy when our practices or the law change, and change the date at the top. If a change is important, we will tell you by email or in your account before it takes effect.

16. Contact and complaints

Email privacy@healthchorus.com or write to Research and Metric Corporation, 30 N Gould St, Ste R, Sheridan, Wyoming 82801, United States. If you are not happy with our answer, you can complain to the privacy regulator where you live. A list is on your privacy choices.