The Cystic Fibrosis Foundation (“CF Foundation” or “we”) is committed to protecting your privacy. This Privacy Statement explains what type of information we may collect and how we may collect, retain, process, share, and transfer that information from website visitors and other individuals with whom we interact, whether online or offline, why we collect it, and with whom we may share it. This Privacy Statement is designed to help you obtain information about our privacy practices and to help you understand your privacy choices when you use our websites, products, and services. It also describes how we protect your personal information and how you can contact us with any questions or to exercise the rights you may have to control our use of your information.
The CF Foundation is a nonprofit organization whose mission is to cure cystic fibrosis and to provide all people with CF the opportunity to lead long, fulfilling lives by funding research and drug development, partnering with the CF community, and advancing high-quality, specialized care.
The information we collect helps us to deliver programs centered on people with CF and to continue our work to improve the quality of life for those with CF. We value the input of our community and are committed to ensuring that we utilize personal information as stated in this Privacy Statement, in furtherance of our mission.
Our Commitment to Privacy and Scope
Our privacy commitments are fundamental to the way we operate. Unless otherwise noted, these commitments apply to everyone, online or offline, who has a relationship with us - including people with CF, other community members, and website (“Site”) visitors. It does not apply to information that is collected in connection with the following:
- The CF Foundation Patient Registry. For more than 50 years, the CF Foundation has been collecting and analyzing information that people with CF choose to submit to the CF Foundation Patient Registry. Registry data is used to produce reports on the health outcomes of people with CF receiving care at CF Foundation-accredited care centers, help inform clinical care through tools like CFSmartReports, create CF clinical care guidelines, guide quality improvement initiatives, and help researchers study CF treatments and outcomes and design CF clinical trials. People with CF execute various forms (such as Informed Consents and Health Insurance Portability and Accountability Act (HIPAA) authorizations) to submit their data into the Registry, and the use and disclosure of their Registry information is governed by those forms and laws regarding clinical research.
- Employment-related information. Information we receive regarding potential employment opportunities and actual employees is not covered by this Privacy Statement, even if you submit it electronically or through the Site.
- Services we provide to clinicians. The CF Foundation provides certain services to CF clinicians and care centers intended to help them improve clinical care. Any protected health information, as defined by HIPAA, that we receive or process in providing these services to care centers is not covered by this Privacy Statement but may be governed by HIPAA. If you want to learn more about HIPAA, visit the Office for Civil Rights website.
Information We Collect
Information You Provide or That We Collect Automatically Through Your Use of the Services
We may collect any personal information you choose to provide us and information about how you use the Site. For example, the CF Foundation may collect and use:
- Name and other personally identifiable information, like address, telephone number, or email address
- Communication preferences and details
- Connection to CF
- Health information associated with CF
- Location data
- Donation history
- Payment methods and history
- Grant applications and progress reports
- Event registration and participation
- Volunteer participation
- Information requests
- Computer and device information, such as IP address, unique device identifiers, operating system version, browser type and settings, and settings used to access the Site
- Social media information
- Date of birth
- Opt-in/opt-out preferences or other communication preferences
- Information about how you use the Site or other CF Foundation-provided services
- Online activity or profile information, if applicable
- Demographic information
We also may record virtual meetings, but we will provide notice to you that the meeting is being recorded before your participation begins.
Information You Share Through the Site
The CF Foundation or our Site may create opportunities for you to share information with others through message boards, blogs, apps, etc. Please remember any information you disclose in these areas becomes public information. Therefore, please exercise discretion in deciding what information to post or share.
Information From Third Parties
We may receive information about you from publicly and commercially available sources, as permitted by law, which we may combine with other information we receive from or about you. For example, we may receive information about you from a social media site if you connect to the Services through that site.
We may combine this information with other personal information we have collected.
We may aggregate or de-identify the information described above so that it does not identify you. Aggregated or de-identified data is not subject to this Privacy Statement.
How We Use Personal Information
The following services are among those the CF Foundation is currently providing or may provide to website visitors, members of the public, patients and families who contact us, donors, those who attend our events, grant applicants and awardees, those who register at the Site, and others. We may use personal information to provide and manage our services through the Site or offline, including to:
- provide public information about CF, including educational resources about CF;
- send you donation solicitations or follow-up communications related to CF or CF-related developments, events, or updates;
- engage in fundraising through avenues including website, email, mail, and other solicitations;
- enable individuals to sign up for events and conferences, like Great Strides, BreatheCon, the North American Cystic Fibrosis Conference, and other events, including other fundraising events;
- communicate with you regarding conferences or other CF Foundation events that may be of interest to you;
- provide people with CF and their families with insurance, financial, and legal assistance, as well as other resources;
- help connect the CF community through CF Foundation platforms that foster communications between people with CF, families, caregivers and/or researchers who want to interact with others via blogs, forums, mentoring, events, etc.;
- help people with CF find clinical trials;
- help people with CF and their caregivers find accredited care centers;
- conduct surveys of community members, including those visiting the CF Foundation website;
- process donations to the CF Foundation;
- communicate with volunteers and event attendees, including via email or text messages;
- engage people with CF to inform research being conducted in the CF community via focus groups, surveys, or other means;
- improve our operation and services, including develop new services, features, and functionality, and analyzing the usage trends and preferences of our users;
- learn about the CF community in order to inform future programs and services, including through merging certain sets of data;
- protect our rights and the rights of others, including to detect and prevent fraud, protect, enforce, or defend the legal rights, privacy, safety, or property of our services, our employees or agents, or other users and to comply with applicable law; and
- improve, measure, or expand our services and for administrative and operational functions.
We may otherwise use your information with your consent or at your direction.
How Long Do We Retain Your Information?
We will maintain and process your personal information as long as we need to, in accordance with our business needs and applicable law. If you remain an active CF Foundation community member, your information will typically be maintained as long as it is current. The CF Foundation collects no more personal information than is reasonably necessary.
Special Provisions Related to Fundraising
In addition to what is described elsewhere in this Privacy Statement, the CF Foundation has some provisions applicable to personal information that we collect and use through our fundraising operations:
- We may collect donors' personal information such as names, company names, titles, addresses, phone numbers, email addresses, payment information (like credit card data), health information connected to CF, participation information, etc. through online or offline communications.
- We use personal information about donors to respond to inquiries, process donations, issue receipts, help decide who will receive future solicitations (including matching gift requests), organize fundraising events, assess the effectiveness of CF Foundation fundraising or services, inform donors of new activities and services, communicate with event attendees during events, and similar activities.
- It is our policy to honor any no-solicitation request as quickly as possible. We are legally required to internally retain some records related to donations made, so we may not be able to delete your name at the time of your request. Instead, we flag records internally so that we can honor no-solicitation requests by suppressing mailings and other contacts.
- We do not knowingly contact or solicit donations from individuals under 18 years of age. However, outside sources occasionally give us personal information regarding potential donors without including age information. If you believe that we have contacted or solicited donations from a minor, please contact us at email@example.com so that we can remove the individual from our mailing lists, as appropriate.
Some of the fundraising sections of our Site make it convenient for you to solicit donations for the CF Foundation from your own friends and contacts. If you choose, you can provide name and contact information for your contacts you want to email to ask for donations. The CF Foundation (or the CF Foundation's vendor) will retain your friends' contact information for your convenience for your own future fundraising efforts, but the CF Foundation will not contact or seek donations from your contacts unless they become donors themselves.
Personal Information We May Share
We may share the personal information we collect with our affiliates and partners. We also may share personal information with service providers who assist us in activities such as technology, communications management, event registration, or to otherwise provide a service to us.
Sometimes the CF Foundation may wish to share the stories of those within our community publicly in order to help others. Before we share your personal information or likeness, however, for this purpose or any other purpose not described in this Privacy Statement, we will obtain your consent.
We might share personal information if we were to sell, assign, license, or transfer all or a portion of our organization or its assets. We might also disclose information about you (i) if required by law, subpoena, court order, or legal process, (ii) to law enforcement or other government authorities if legally required, or (iii) if we believe disclosure is necessary or appropriate to prevent serious physical harm or in connection with an investigation of or action involving illegal or fraudulent activity or conduct that violates our Terms of Agreement.
We may share your personal information as required by applicable law, in response to legal process, or if we believe it necessary or appropriate to protect, enforce, or defend the legal rights, privacy, safety, or property of the Site, our employees or agents, or other users.
Tracking and Cookies
These technologies include:
- Cookies. Cookies are small text files or data placed by your web browser on your computer to store information that allow a website to keep track of online patterns and preferences and make the personalization of web experiences possible. We may make use of session-based and/or “persistent or memory based” cookies, which remain on your computer until you delete them.
- Web beacons. Web beacons (or “pixel tags”) can be embedded in online content, videos, and emails, and can allow a server to read certain types of information from your device, know when you have viewed particular content or a particular email message, determine the time and date on which you viewed the web beacon, and the IP address of your device. We and third parties use web beacons for a variety of purposes, including to analyze the use of our Services.
- SDKs and mobile advertising IDs. Our mobile applications may include third-party software development kits (SDKs) that allow us and our service providers to collect information about your mobile app activity. In addition, some mobile devices come with a resettable advertising ID that, like cookies and pixel tags, allow us and our service providers to identify your mobile device over time and for advertising purposes.
Most browsers are initially set up to accept cookies. Your browser or device may offer settings that allow you to choose whether browser cookies are set and to delete them. For example, you may be able to configure your browser not to accept cookies or to notify you when a cookie is being sent. For more information about whether these settings are available, what they do, and how they work, visit your browser help material. Please be aware that some features of the Site may not function properly or may be slower if you disable cookies.
Some of these third parties participate in industry-developed programs designed to provide consumers choices about whether to receive targeted advertising. Please visit the websites operated by the Network Advertising Initiative and Digital Advertising Alliance to learn more.
We may aggregate this data to better understand how visitors use our Site, and to help manage, maintain, and report on use of our website. Aggregated data is not subject to this Privacy Statement.
Some web browsers have a “Do Not Track” feature that lets a user have the browser notify websites that the user does not want to have his or her online activities tracked. The Site does not respond to such browser-initiated signals. Regarding any potential external tracking, please consult external website policies regarding their tracking practices and their responses to Do Not Track signals.
Social Plug-In Data
The Site may use interfaces with social media websites like Facebook, Instagram, LinkedIn, Twitter, YouTube, or others. If you use these to access interfaces to login or to share information about your experience on the Site with others, we may collect information from these third-party services. In addition, the interfaces may allow the social media website to connect your visit of the Site to your personally identifiable information.
Links to Other Sites
We may provide links to other websites for your convenience and information, but we do not operate those websites and are not responsible for their privacy practices or content, nor do we have control over the security of those websites. Please review those websites’ privacy policies and contact the operators of those websites directly if you have any questions about their practices.
International Data Transfers
This website is intended for a United States audience and, accordingly, if you use our website, personal information about you will be transferred to our offices in the U.S.; but we may also transfer it to service providers in various other countries. The laws, regulations, and standards in these jurisdictions may not be equivalent to the laws in your country of residence. You understand that those transfers are necessary to provide our services, including the Site.
This Site is intended for use by adults. If you are between the ages of 13 and 18 years old, you may use this Site only if: (i) your use has been approved by your parent or legal guardian, (ii) you use the Site under the supervision of your parent or legal guardian, and (iii) your parent or legal guardian has agreed to our Terms of Agreement (and any additional registration agreements, if applicable) on your behalf.
Under no circumstances may a minor under the age of 13 use the Site.
Social Security Number Protection
The CF Foundation does not normally collect the social security number (SSN) of individuals outside the employment context. However, the CF Foundation may collect SSNs in limited circumstances, such as from CF Foundation grantees to comply with state and federal tax law. CF Foundation policy requires that records that include SSNs and personal information are maintained in accordance with applicable law. The release of SSNs to external parties is prohibited except as required or permitted by law, and subject to appropriate protections. The CF Foundation maintains physical, technical, and administrative security procedures to protect the confidentiality of all personal information, including any SSNs that we maintain.
California Privacy Rights
As a non-profit organization, the CF Foundation is not subject to the California Consumer Privacy Act (CCPA). However, please see the “Your Rights and Choices Regarding Your Information” below to review the rights you may have regarding your personal information. We do not share personal information with third parties for their own direct marketing purposes without your consent.
California residents who are registered users of the Site and are under the age of 18 are entitled, in accordance with California law, to request and obtain removal of content and information that they themselves post on the Site. You may request such removal by emailing us at firstname.lastname@example.org. In your request, please provide a description of the material that you want removed and information reasonably sufficient to permit us to locate the material, and include your name, email address and/or username, year of birth, mailing address (including city, state, and zip code), and the subject line “California Removal Request” so that we can process your request. Please note that your request does not ensure complete or comprehensive removal of the material. For example, materials that you have posted may be republished or reposted by another user or third party.
Protecting Personal Information
We are committed to maintaining the security of personal information. Although it is not possible to guarantee that security measures employed will be sufficient to protect personal information, we use administrative, technical, and physical security measures intended to protect against loss, misuse, improper access, disclosure, alteration, or destruction of personal information, and we review our data security arrangements regularly. These measures include, but are not limited to, encryption of sensitive information both in-transit and at-rest, and the tokenization of credit card numbers. Additionally, sensitive information is protected at-rest by firewalls and intrusion detection/prevention systems and restricting access to this information appropriate personnel. If we share personal information with third parties to provide services to us, we take steps to require them to employ appropriate security measures to protect it.
If you register with the CF Foundation for any services that require a username and password, we encourage you to take strong precautions to protect those credentials. While we strive to protect your personal information, we cannot ensure or warrant the security of any information you transmit to us or receive from us. This is especially true for information you transmit to us via email.
Your Rights and Choices Regarding Your Information
You may have certain rights relating to your personal information, in accordance with local laws. Depending on the applicable laws, these rights may include:
- The right to access your personal information held by the CF Foundation in a format that you can easily access, keep, and transfer to another organization, if you wish to do so.
- The right to correct incomplete, out-of-date, or inaccurate personal information.
- The right to request deletion of your personal information. Please note that your request does not ensure complete and comprehensive deletion of your personal information. We may choose not to delete your information in circumstances where we need to keep the information for our legitimate business purposes. Additionally, the CF Foundation may not be able to delete materials that have been reposted or republished by another user.
- The right to object to any processing of your personal information carried out on the basis of our legitimate interests, for the purposes of direct marketing and, to the extent applicable, any automated decision-making.
- To the extent that our processing of your personal information is based on your consent, you have the right to withdraw your consent.
- The right to complain to a regulatory authority if you believe that our processing of your personal information infringes upon your rights.
Exercising Your Rights and Choices
If you would like to exercise any rights that you have regarding the personal information you have previously submitted to the CF Foundation, please email the Privacy Officer at email@example.com, or write to us at:
Cystic Fibrosis Foundation
ATTN: Privacy Officer
4550 Montgomery Avenue, Suite 1100 N
Bethesda, MD 20814
Subject to applicable law and best practices, we will make commercially reasonable efforts to respond to your request. Please be advised that we are required by law to retain certain records, such as donation and other records, for a period of time.
If you do not wish to receive further emails, postal mail, or other communications from the CF Foundation, you may use our email opt-out form, use the unsubscribe mechanism described in the communication you received, call us at 800-344-4823, email us at firstname.lastname@example.org, or write to us at:
Cystic Fibrosis Foundation
4550 Montgomery Avenue, Suite 1100 N
Bethesda, MD 20814
It is our policy to honor any no-solicitation request as quickly as possible. We are legally required to internally retain records related to donations made for a period of time, so we may not be able to delete your name upon request. In those cases, we flag records internally so we can honor no-solicitation requests by suppressing messages as requested.
If you wish to reduce the amount of unwanted mail and/or have your name removed from other mailing lists, you may contact the Direct Marketing Association (DMA) to enroll in the DMA's program to help control the mailings you will receive.
Changes to This Notice
We may update this Privacy Statement at any time and, if so, we will post the new effective date below. If these changes would permit us to share your information more broadly than described above or use your information in a manner that is not described above, we will post an announcement on this Site and/or ask for your consent.
Your continued use of the Site after the effective date of the new Privacy Statement constitutes your consent to the new Privacy Statement.
The prior version of this Privacy Statement is available here.
We welcome your comments. If you have any questions or comments about our Privacy Statement or our information practices, please contact the Privacy Officer at email@example.com or firstname.lastname@example.org, or you may write to us at:
Cystic Fibrosis Foundation
ATTN: Privacy Officer
4550 Montgomery Avenue, Suite 1100 N
Bethesda, MD 20814.
The effective date of this Privacy Statement is November 17, 2021.