GenomicEpi Privacy Notice

This notice covers genomicepi.com and www.genomicepi.com, messages and resource submissions to us, and our use of newsletter subscriber information. Co-author Constellation has its own privacy notice.

GenomicEpi is operated by Krisandra Allen, Seattle, Washington, United States. Contact [email protected] for privacy questions or requests. We are responsible for information whose purposes and use we determine (the “controller,” where that term applies).

You can browse without an account. Sending a message or resource does not subscribe you to the newsletter. Please do not send patient details, private medical or genetic information, passwords, or other sensitive information. This site is not a channel for clinical care, confidential case reporting, or emergencies.

Information and retention

Information	Why we use it	How long it is kept
Emails, contact details, and attachments you send	Respond to questions, corrections, and requests.	No fixed deletion schedule. Contact us to request deletion, subject to applicable exceptions.
Resource submissions through Airtable	Review and maintain training, job, and program listings. Material intended for a public listing may be edited and published.	While reviewing and maintaining the listing; public entries may remain in archives. A fixed deletion period for submission records has not yet been set.
Newsletter information from Substack	Manage subscriptions and readership: email, subscription status, profile details you provide, and engagement information available to us as publisher.	While administering subscriptions, plus records needed to honor unsubscribes. Substack has its own retention practices.
Site-use statistics from Plausible	Understand visits and measles report downloads. See the analytics details below.	5 years under our Plausible Business plan.
Technical requests, security events, and performance data	Cloudflare delivers and protects the site and measures performance. Information can include IP addresses, requested pages, times, and browser details.	Depends on the Cloudflare service and configuration; these periods have not all been verified.
Public professional and research information	Display publications, authors, affiliations, professional contacts, and resource listings from public sources and submissions.	While useful for the resource, including archives. Contact us about corrections or privacy concerns.

Please identify any private contact details in a submission separately from material intended for publication. Only share information you have permission to provide.

Legal obligations, disputes, or security incidents may require relevant records to be kept longer. Provider backups and recovery systems may retain copies after deletion. Removing a listing does not erase its source, an underlying email, or every backup. We review information for deletion or de-identification when it is no longer needed; contact us about a particular record.

Analytics and other services

Plausible analytics runs without an opt-in prompt. It measures page visits, referral sources, browser and device categories, approximate location, and a measles report download event. Plausible says it uses no cookies or persistent browser identifiers and does not store raw IP addresses. IP addresses are processed to produce statistics. Its visitor data is processed and stored in the EU. See Plausible’s data policy.

Cookie-free analytics does not mean every feature on this site is cookie-free. Other services include:

• Cloudflare: hosting, security, and a Web Analytics performance beacon. Security checks may set cookies such as cf_clearance. See its cookie documentation, analytics documentation, and privacy policy.
• Google Workspace: email sent to [email protected].
• Substack: newsletter signup and delivery, plus article images. It also handles information for its own services. See its privacy policy.
• Airtable: resource-submission forms. See its privacy policy.
• Embedded content: Nextstrain phylogenetic views, a LinkedIn post on the Ebola page, and OpenStreetMap tiles. See LinkedIn’s privacy policy and OpenStreetMap’s privacy policy.
• Content delivery services: unpkg, jsDelivr, GitHub, and Substack’s image service supply scripts, data, or images on some pages.

Some services receive requests as a page or embedded feature loads, even without a form submission. They can receive your IP address, browser details, and referring page, depending on browser settings. They may use cookies or recognize an account you hold with them. Providers’ own notices apply to information they use for their own purposes.

Your choices and rights

• Newsletter: unsubscribe using an email’s link or your Substack settings. This stops delivery; it does not necessarily delete your account or all records.
• Browser controls: restrict cookies, storage, or third-party content in your browser. Some forms, maps, or embeds may stop working; these controls do not prevent every request.
• Browser privacy signals: this site has no separate sitewide mechanism for Do Not Track or Global Privacy Control. Providers may respond independently. This does not limit applicable opt-out rights. See Co-author Constellation’s own notice for that tool.
• Information requests: email [email protected] with “Privacy request” and enough detail to locate the information involved. Do not send identity documents unless we agree on a necessary, secure verification process.

Depending on applicable law, you may have rights to access, correct, delete, obtain a copy of, or restrict use of your information; object to processing; withdraw consent; or appeal a request decision. Exceptions may apply. Withdrawing consent does not undo earlier lawful processing. You may also complain to the relevant data-protection authority, including an EEA authority where you live or work or the UK Information Commissioner’s Office.

We may need proportionate verification and will respond within legally required deadlines. Under GDPR this is ordinarily one month; permitted extensions require timely notice. We may not be able to identify your activity in aggregate statistics and will not collect extra identifiers solely to do so. We handle requests for information we control; a provider may need to handle requests about its independent use. Corrections here do not automatically change an original source.

How we manage information

Purposes and legal grounds. We use information to run and secure the site, answer messages, maintain resources, understand usage, manage requested subscriptions, and meet legal obligations. Where GDPR or UK GDPR applies, we rely on legitimate interests in those operational activities, consent for newsletter marketing where required, and legal obligations where applicable. Legitimate interests must be balanced against people’s rights and do not replace legally required consent. Contact details are not blanket permission for unrelated uses. We do not make solely automated decisions with legal or similarly significant effects on you.

Access and protection. The operator and supporting providers can access relevant information; published listings are public. We use access restrictions and safeguards, but cannot promise absolute security. We may disclose information as legally required or to address fraud, security incidents, or legal claims, subject to applicable law. A change of operator requires a review of responsibilities and appropriate notice, not unrestricted new uses.

International processing. We operate in the US; providers may process information elsewhere. Where required, international transfers must be covered by appropriate safeguards, such as applicable adequacy decisions or contractual protections. Contact us for the arrangements relevant to your information.

Children. This educational resource is not directed to children under 13. Contact us if a child has provided personal information so we can assess and address it. Other applicable protections for children and teenagers still apply.

Updates. We will update the date above when this notice changes and give additional notice of material changes where required. Updating this notice does not itself authorize incompatible new uses of existing information.