Privacy

Privacy at Shared Blood

How we limit, protect, and govern the little data we handle.

Shared Blood is designed to collect as little data as possible. We define a clear purpose before collecting anything, protect what we hold, restrict who can use it, review before we publish, and delete it when it is no longer needed.

What we collect

Every collection has an approved purpose. If there is no valid purpose, we do not collect. We prefer anonymous and aggregate records and never require national identity data such as CNIC or B-Form.

Calculator privacy

The genetic calculators are educational and transient. Your inputs and results are not saved, not used for research, and never become a medical or genetic record. We do not store parent status, family relationship, or calculated risk.

Survey privacy

Survey research is anonymous and aggregate. We prefer age ranges over exact dates of birth, avoid precise addresses, and never use full IP addresses as research variables or secretly fingerprint participants.

Fieldwork & assessment data

Attendance is kept separate from assessments and sensitive data. Training assessments are anonymous and aggregate; where a before/after comparison is needed we use pseudonymous codes that carry no personal information.

Audio stories

Audio perspectives are published only with specific consent. Taking part in an interview does not by itself authorise recording, voice publication, name publication, transcript publication, or translation (each is a separate choice.

Analytics

Analytics are aggregate and privacy-minimized (for example, that a page or calculator was opened. We never infer disease status, carrier status, genetic risk, pregnancy status, or political or advocacy beliefs from your use of the site.

Retention & deletion

We keep data only while its purpose is active. When the purpose ends, retention is reviewed and data is deleted or anonymized. "May be useful later" is not a reason to keep data, and hiding a row is not deletion.

Our governance principles

Purpose limitation: Every collection resolves to an approved purpose; no purpose means no collection.
Data minimization: We collect the least data needed and prefer anonymous or aggregate records.
Informed participation: Participants are told the purpose, what is collected, and how it is used.
Voluntary participation: Participation is voluntary; recording and publication are never bundled into one required choice.
Access restriction: Access follows least privilege by role and data sensitivity.
Data separation: Contact data is kept separate from research responses; email is never a participant ID.
Publication review: Public display permission alone is not enough; required review gates must pass first.
Non-stigmatization: We never shame families or communities or use eugenic or genetic-purity language.
Vulnerable-population protection: Children, infants, and orphanage activities receive heightened review.
Genetic-information caution: Genetic information is highly sensitive; Version 1 does not collect genetic test data.
Research transparency: We describe how findings are produced and reviewed.
Limitation disclosure: Findings are published with their limitations, never hidden.
Retention limitation: Data is kept only while a purpose justifies it; "may be useful later" is not a justification.
Deletion governance: Deletion is real and verifiable; hiding a UI row is not deletion.
Incident documentation: Governance incidents are documented, corrected, and reviewed.
Human review: Ethics and publication decisions require human review; nothing is auto-approved.

Our governance principles

Purpose limitation

Every collection resolves to an approved purpose; no purpose means no collection.

Data minimization

We collect the least data needed and prefer anonymous or aggregate records.

Informed participation

Participants are told the purpose, what is collected, and how it is used.

Voluntary participation

Participation is voluntary; recording and publication are never bundled into one required choice.

Access restriction

Access follows least privilege by role and data sensitivity.

Data separation

Contact data is kept separate from research responses; email is never a participant ID.

Publication review

Public display permission alone is not enough; required review gates must pass first.

Non-stigmatization

We never shame families or communities or use eugenic or genetic-purity language.

Vulnerable-population protection

Children, infants, and orphanage activities receive heightened review.

Genetic-information caution

Genetic information is highly sensitive; Version 1 does not collect genetic test data.

Research transparency

We describe how findings are produced and reviewed.

Limitation disclosure

Findings are published with their limitations, never hidden.

Retention limitation

Data is kept only while a purpose justifies it; "may be useful later" is not a justification.

Deletion governance

Deletion is real and verifiable; hiding a UI row is not deletion.

Incident documentation

Governance incidents are documented, corrected, and reviewed.

Human review

Ethics and publication decisions require human review; nothing is auto-approved.