Weill Cornell Medicine (WCM) Privacy Policy

This Website is owned and operated by Cornell University, a New York Education Corporation, including Weill Cornell Medicine and/or any department or affiliate thereof, (“Cornell” or “WCM” or “we”, “us” or “our”). By using this website and its Services, you agree to this Policy. Please read the following carefully before proceeding.

This Policy applies to WCM’s’ website located at weillcornell.org, and weill.cornell.edu as well as all other websites owned, operated, licensed, or controlled by WCM, and certain affiliate websites that are hyperlinked to them. This Policy also applies to all mobile applications offered under the WCM name that do not have a separate privacy policy or that link to this Policy (the “Apps”). Collectively, the Websites and Apps are referred to in this Policy as the “Services”.

This Policy applies to the use of the Services and the information provided by and obtained from users of the Services. WCM maintains a separate Notice of Privacy Practices (NPP) in connection with HIPAA that can be viewed on the weillcornell.org/privacy website at Notice of Privacy Practices (cornell.edu). The NPP covers the ways we may use and disclose Protected Health Information and other medical information about you. “Protected health information” (PHI) is defined in the Health Insurance Portability & Accountability Act and related regulations (collectively referred to as “HIPAA”) and includes individually identifiable information you provide to a WCM clinical care facility or to our affiliated entity, NewYork Presbyterian (NYP), while being treated as a patient or within the MyConnect portal.

In areas where there may be conflict between this Policy and the NPP, the NPP takes priority.

BY ACCESSING OR USING THE SERVICES, YOU AGREE TO BE BOUND BY THIS PRIVACY POLICY AND THE TERMS OF USE. IF YOU DO NOT AGREE WITH THIS PRIVACY POLICY OR THE TERMS OF USE, DO NOT ACCESS OR USE THE SERVICES.

Your Consent, Information We Collect, and How We Use Your Information

WCM collects two types of information through the Services: (1) personally identifiable information (“PII”), including but not limited to name, address, email and phone number that you provide voluntarily when you access certain features of the Services as noted below in this Policy, and (2) usage information that we collect automatically as you access the Services. This information is often used by WCM staff to help deliver Services to you, such as study surveys, incentives, and email reminders.

By using any of these Services, you consent to the collection, use and sharing of information as described in this Policy. By providing us with an email address, you agree that we may use it to communicate with you about our Services. (NOTE: Opt-out options are discussed below.)

WCM also uses the information that it collects to ensure the proper functionality of the Services across various devices, to process user inquiries and respond to user requests, to analyze usage trends, to improve the Services, and to develop new Services. WCM processes information only for the purposes for which it was collected and in accordance with this Policy.

WCM will share your PII with authorized third-party contractors/providers that perform business or administrative services for us (for example, Qualtrics survey tool, our online incentives provider, Tango). These include the Services described below under the heading Cookies, Tracking, Analytics, and Internet-based Advertising. A third-party contractor/provider is an independent individual or organization that provides services to WCM under a contractual agreement. They are hired for specific tasks and are paid for their services. Some examples of third-party contractors include: Research organizations, Manufacturers, Academic collaborators, Web-hosting platforms, Software services, Consultants, and Outsourced data centers.

Information That You Provide Voluntarily on the Services

WCM collects personally identifiable information (“PII”) that you enter into data fields on the Services. For example, when you complete the eligibility survey, you will be asked for certain PII including but not limited to your name and email address so that we are able to contact you throughout the length of the study. Other features of the Services may ask for other PII necessary for the proper functionality of such features. If you decline to provide certain information while using a Service, you may not be able to use or participate in some or all the features offered through the Services.

Usage Information That Is Automatically Collected on the Services

When you access the Services, WCM may collect certain information automatically without your actively providing such information. This information may include technical information collected from your device (e.g., your IP address, device identifiers, the type of mobile device you are using, and your operating system), as well as information about your usage of the Services (e.g., how you interact with the Services, the search terms you enter, and how often you use the Apps). When you access certain Services, we may assign you a unique analytics tracking identification number (ID). WCM uses this ID to collect information about your interaction with the Apps in order to improve your experience. Certain Services may also use location services to provide location-based features. If you enable location services on your device and grant permission for such Services to access this feature, we may collect your location via GPS in order to provide you with these features.

We may also use your information to:

Send you information and updates about the study.
Administer a promotion, survey or other feature of the Services.
Communicate changes to our Privacy Policy or terms of use.
Fulfill online requests, and respond to customer service inquiries, or in other ways as required by law.

WCM implements online security measures to safeguard and keep your information private.

Cookies, Tracking, Analytics and Internet-based Advertising

Our Services work with third-party providers (“Providers”). These include Google, Mixpanel and other authorized third parties who help us track and analyze visitor activity on the Websites and Apps, measure the effectiveness of our advertising efforts, and optimize our digital marketing campaigns.

To accomplish this, the Services use “cookies,” tracking pixels, and related technologies. These can be set by WCM or by our Providers.

Cookies are small data files that online services can store information on and retrieve from a user’s computer or mobile device through the user’s web browser. The information in the file is stored and is retrievable either for the duration of a website visit (known as “session cookies”), or until some later point in time set by the website delivering the cookie (known as “persistent cookies”).

Most internet browsers accept cookies by default, but you can modify your browser preferences to block or restrict cookies if you do not want your web browsing activity tracked. There are a variety of tools publicly available to manage cookies and similar technologies that collect information related to your use of the Services.

We and our Providers use this information in the aggregate (in total) to understand how our visitors as a group use different resources and to help us improve our Services. We and our Providers also collect information about the activity of individual Users. This information may be used to direct WCM advertisements and/or informational content to Users when they visit other websites.

Our Providers may acquire additional information about your activity when using our Services including pages you visit, access times, duration of visit, how you arrived at our Website and your IP address. An IP address is a number that identifies a device connected to the Internet. Our Providers may also acquire device identifiers and specific information about the browser you use. In some cases, this information may be unique to you.

WCM also uses platforms of Providers such as Google, Apple, Microsoft, Meta and Mixpanel to manage and deliver digital advertisements about its services on third-party, non-WCM websites. In providing this service, these platforms may collect limited data related to your activity on those third-party websites using cookies to measure the effectiveness of our advertising efforts, and optimize our digital marketing campaigns.

WCM advertises on those websites for Users that may find them relevant. For example, cookies on those third-party websites may capture data such as date and time of web browsing, browser type, operating system type, IP address, or alphanumeric identifier. To provide verification to WCM that an ad was delivered, these platforms may report some of this data to WCM on an aggregated basis.

How Long Do We Keep Your Information?

We will only keep your personal information for as long as is necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law (e.g. for the purposes of tax accounting or other legal requirements).

When we have no ongoing legitimate business need to retain or process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. For data protections and retention policies for the Weill Cornell ITS server, please visit https://its.weill.cornell.edu/policies/1102-privacy-of-the-network.

Information That You Provide Voluntarily on the Websites

We may retain email and other communications that you send us in order to process your inquiries, respond to your requests, and improve your website experience.

Usage Information That Is Automatically Collected on the Websites

Third-Party Websites and Applications

In order to provide you with other valuable information, the Services may provide links to other websites and applications, including third-party websites and applications outside the WCM network. Please be aware that this Policy does not apply to those outside websites and applications. WCM exercises no authority over, and does not necessarily endorse, such third-party websites and applications. We encourage you to carefully read the terms of use and privacy policy any of the other websites or apps before providing the third party with your personal information.

These destination links provided through the Services are provided only for your convenience and, as such, you access them at your own risk. However, WCM wishes to assure the integrity of the Services and their destination links, so any comments pertaining to the Services, or any websites accessed through our links are greatly appreciated. Comments can be submitted to webmaster@med.cornell.edu.

Email Information

Please do not provide personal information to us via email unless it is through a secure channel or dedicated secure email addresses (these will be marked, for example as secure online forms). Remember that email messages, unless encrypted while in transit, can be viewed by other Internet users. If you have personal information to communicate, please use the appropriate secure online form or contact the necessary party using traditional means such as phone or mail.

If you receive an email that looks like it is from WCM and asks for your personal information (such as your social security number or bank information), do not respond. This may be a scam or “Phishing” email intended to steal your information. WCM will never request your password, username, credit card information or other personal financial information through email.

Legal Matters

WCM reserves the right to comply with the law and to release PII relating to any user of the Services (i) if we reasonably believe that the user is in violation of our Terms of Use, this Policy, or other published guidelines or is engaged in illegal activity, (ii) in response to court and governmental orders, other enforceable requests from government entities, civil subpoenas, discovery requests and otherwise as required by law, (iii) if we reasonably believe that such release is required to protect the rights, property, safety or security of any of our users or the public, or (iv) to respond to an emergency.

Children’s Privacy

The Services are not intended for use by children under the age of 18. In accordance with the Children’s Online Privacy Protection Act of 1998 (COPPA), WCM does not knowingly request PII from anyone under the age of 13 without parental consent. In compliance with COPPA, when we do receive information (with parental consent) from users under the age of 13, we will not share their PII with third parties, regardless of their stated preference given at registration.

Changes To Privacy Policy

WCM may change this Policy from time to time. We encourage you to check this page regularly for any changes to the Policy and for new versions thereof. By continuing to access, browse, and/or use the Services, you agree to accept any posted revised terms.

Last updated: February 11, 2025