3 ms·

I would love to disclose my extremely disturbing and potentially violent intrusive thoughts to an application with a completely murky privacy policy...

by airza 12y ago

beermann 12y ago
As a fairly young company, this is something we can clearly improve. The privacy policy we have was written by our lawyers and is fairly standard. Could you expand a bit on what seems murky? In addition, it obviously isn't enough to just say that "we take privacy very seriously," although we do. While we don't store Protected Health Information, we treat the data we do store as such and are taking the same steps to protect users' data that we would have to if we were.
- th3o6a1d 12y ago
  As a med student and someone interested in health tech startups, I wanted to ask how you can say you don't store Protected Health Information. Does this mean that you store no identifiers at all? As part of HIPAA compliance training at my school, we are taught that even acknowledging that a person is a patient in a hospital over the phone is a violation of their privacy. I wonder if the same can be said about an app -- just the fact that a person has downloaded and used it is quite revealing. Just curious, because I've spent a lot of time reading about how to set up a HIPAA compliant service.
  - beermann 12y ago
    Unfortunately there isn't a lot of guidance here. We store your email address, which doesn't have to be an identifier as it can be anonymous, but we have to have a way to communicate with you. And we do ask for a name, but you can put whatever you want. As mentioned in another comment, PHI is defined as something that originates from a healthcare provider. Some of the restrictions for what we can say the app does actually come from the FDA. We don't say that we treat specific anxiety disorders (we call it "stress and anxiety"), and we don't ask our users for that type of information. But it really is a bit of a grey area. It's something that we're acutely aware of though and are trying to follow all the guidelines we can find.
    - fluidcruft 12y ago
      I agree completely with the medical student's concerns. In particular your app asks for information the way a counselor would. See for example this "Record your thoughts..." image from Google Play https://imgur.com/C5C3A5j https://imgur.com/C5C3A5j. I think there is a very big difference between for example a paper self-help workbook that someone keeps in their own possessions or mental exercises that produce no records and making voice recordings in a networked app that accesses a centralized database stored in the cloud. Emails are often trivially linked to identity. It doesn't matter that someone could have generated an "anonymous" email address (I've very skeptical that user-provided email addresses would pass muster as de-identified identifiers), if you can use that email to communicate with the person, it's definitely linked to their identity. If they link the email address to their identity elsewhere, the burden is still on you, not the user. You cannot demand that users protect the email address they use to sign up for your service the same way they would protect a social security or medical record number. That's ridiculous. You should look into obtaining HIPAA/HITECH compliance training perhaps as an unaffiliated learner on https://www.citiprogram.org/ https://www.citiprogram.org/ to understand why those of us that work in health care are expressing concern.
UrMomReadsHN 12y ago
Totally agree. Looks like you have to login and your private medical data is stored "in the cloud." I have no idea why anyone would think this would be a good idea. Storing it locally would be the only remotely sane solution. I mean, I don't mind telling someone I have an anxiety disorder (and I do have one). But the content of some of those intrusive thoughts is something I don't want anyone to know. Especially not some startup who may sell their company to, say, Facebook one day. Some of my intrusive thoughts are things that I did wrong (10 years ago...). So logging them would mean a third party would have an entire database of almost every mistake I made in my life, out of context. The potential for that to go wrong is... extreme. I'd rather have nudes be leaked. And the stupid embedded video in a jQuery modal. Stop it, you're making your videos unusable. Let me pause. Oh wait, I can't. I need to pause the video because it runs at lighting speed, so fast it is impossible to gain any information at all from it unless you pause it.
- UrMomReadsHN 12y ago
  Ok, while I'm crapping all over your app (sorry...you were looking for feedback, right?) The website rendered so badly on my phone I went to go check out how it looked on the desktop. Well, the video pause issue is fixed... (I still think putting a video in a jQuery modal is incredibly annoying...just embed the video) You need to fire your "usability consultant." Your color scheme is absolutely horrible for anyone who is older or with less than perfect vision. It is very difficult to read for me. Any time your as yourself "should I display my -main content-* in white text" the answer should be no. Doublely so if you your background is light pastel green. Light grey on white is another combo that is extremely hard to read. So is white on very light picture of a beach. Animated backgrounds(?) (The background is not animated in my mobile browser) are not only are incredibly distracting, but also actually, ironically, cause anxiety for me. I'm sure I'm not the only one. I know different people have different preferences, but at LEAST give your color scheme some halfway sane contrast. And fix the rendering errors on mobile. Both issues, besides affecting usability, make you look amateurish. In my opinion. *not saying you should never use white text, ever. Just not in paragraph form.
  - gqvijay 12y ago

I would love to disclose my extremely disturbing and potentially violent intrusive thoughts to an application with a completely murky privacy policy...

by airza 12y ago

I would love to disclose my extremely disturbing and potentially violent intrusive thoughts to an application with a completely murky privacy policy...

beermann 12y ago

As a fairly young company, this is something we can clearly improve. The privacy policy we have was written by our lawyers and is fairly standard. Could you expand a bit on what seems murky? In addition, it obviously isn't enough to just say that "we take privacy very seriously," although we do. While we don't store Protected Health Information, we treat the data we do store as such and are taking the same steps to protect users' data that we would have to if we were.

th3o6a1d 12y ago
As a med student and someone interested in health tech startups, I wanted to ask how you can say you don't store Protected Health Information. Does this mean that you store no identifiers at all? As part of HIPAA compliance training at my school, we are taught that even acknowledging that a person is a patient in a hospital over the phone is a violation of their privacy. I wonder if the same can be said about an app -- just the fact that a person has downloaded and used it is quite revealing. Just curious, because I've spent a lot of time reading about how to set up a HIPAA compliant service.
- beermann 12y ago
  Unfortunately there isn't a lot of guidance here. We store your email address, which doesn't have to be an identifier as it can be anonymous, but we have to have a way to communicate with you. And we do ask for a name, but you can put whatever you want. As mentioned in another comment, PHI is defined as something that originates from a healthcare provider. Some of the restrictions for what we can say the app does actually come from the FDA. We don't say that we treat specific anxiety disorders (we call it "stress and anxiety"), and we don't ask our users for that type of information. But it really is a bit of a grey area. It's something that we're acutely aware of though and are trying to follow all the guidelines we can find.
  - fluidcruft 12y ago
    I agree completely with the medical student's concerns. In particular your app asks for information the way a counselor would. See for example this "Record your thoughts..." image from Google Play https://imgur.com/C5C3A5j https://imgur.com/C5C3A5j. I think there is a very big difference between for example a paper self-help workbook that someone keeps in their own possessions or mental exercises that produce no records and making voice recordings in a networked app that accesses a centralized database stored in the cloud. Emails are often trivially linked to identity. It doesn't matter that someone could have generated an "anonymous" email address (I've very skeptical that user-provided email addresses would pass muster as de-identified identifiers), if you can use that email to communicate with the person, it's definitely linked to their identity. If they link the email address to their identity elsewhere, the burden is still on you, not the user. You cannot demand that users protect the email address they use to sign up for your service the same way they would protect a social security or medical record number. That's ridiculous. You should look into obtaining HIPAA/HITECH compliance training perhaps as an unaffiliated learner on https://www.citiprogram.org/ https://www.citiprogram.org/ to understand why those of us that work in health care are expressing concern.

UrMomReadsHN 12y ago

Totally agree. Looks like you have to login and your private medical data is stored "in the cloud." I have no idea why anyone would think this would be a good idea. Storing it locally would be the only remotely sane solution. I mean, I don't mind telling someone I have an anxiety disorder (and I do have one). But the content of some of those intrusive thoughts is something I don't want anyone to know. Especially not some startup who may sell their company to, say, Facebook one day. Some of my intrusive thoughts are things that I did wrong (10 years ago...). So logging them would mean a third party would have an entire database of almost every mistake I made in my life, out of context. The potential for that to go wrong is... extreme. I'd rather have nudes be leaked. And the stupid embedded video in a jQuery modal. Stop it, you're making your videos unusable. Let me pause. Oh wait, I can't. I need to pause the video because it runs at lighting speed, so fast it is impossible to gain any information at all from it unless you pause it.

UrMomReadsHN 12y ago
Ok, while I'm crapping all over your app (sorry...you were looking for feedback, right?) The website rendered so badly on my phone I went to go check out how it looked on the desktop. Well, the video pause issue is fixed... (I still think putting a video in a jQuery modal is incredibly annoying...just embed the video) You need to fire your "usability consultant." Your color scheme is absolutely horrible for anyone who is older or with less than perfect vision. It is very difficult to read for me. Any time your as yourself "should I display my -main content-* in white text" the answer should be no. Doublely so if you your background is light pastel green. Light grey on white is another combo that is extremely hard to read. So is white on very light picture of a beach. Animated backgrounds(?) (The background is not animated in my mobile browser) are not only are incredibly distracting, but also actually, ironically, cause anxiety for me. I'm sure I'm not the only one. I know different people have different preferences, but at LEAST give your color scheme some halfway sane contrast. And fix the rendering errors on mobile. Both issues, besides affecting usability, make you look amateurish. In my opinion. *not saying you should never use white text, ever. Just not in paragraph form.
- gqvijay 12y ago