Privacy Policy

Applies to www.nbdc-datahub.org.  Effective August 11, 2026. Last revised October 10, 2026.

‍

Privacy

The NIH Brain Development Cohorts (NBDC) Data Hub protects the privacy and accuracy of confidential information, subject to applicable federal law. Other than as required by laws that guarantee public access to certain types of information, or in response to a subpoena, court order, or other legal instrument that authorizes access, we do not actively share personal information. We do not sell or redistribute personal information collected through this website.

The NBDC Data Hub is supported by the National Institutes of Health and administered by the National Institute on Drug Abuse. The information practices that apply across NIH websites are described in the NIH Web Policies and Notices, which includes the NIH privacy policy and the NIH Privacy Act information. Read that notice alongside this statement. This statement describes practices specific to the Data Hub and does not replace it. Lasso Informatics operates the platform under contract.

‍

Information Collected

www.nbdc-datahub.org servers collect the following analytics:

  • Internet Protocol (IP) address of the computer being used
  • Web pages requested
  • Referring web page
  • Browser and operating system used
  • Date and time of the request

We do not associate this data with individual user identities. We use Datadog and Splunk to collect and process these records under written contract. Datadog and or Splunk may not use the data for its own purposes.

‍

Cookies

This site may use cookies to keep track of online state, such as an active session or a display preference. We do not store sensitive personal information in cookies, and we do not use advertising or cross-site tracking cookies. You can block or delete cookies through your browser settings, though parts of the site may then stop working.

‍

Information Collected on the Data Access Platform

This website does not ask visitors for names, email addresses, or other contact information. The Data Hub collects personal information only inside the authenticated data access platform, which sits behind a sign-in.

Researchers who request access to NBDC data sign in through the NIH Researcher Authentication Service (RAS) using Login.gov or ID.me credentials and an institutional email address. Through that process and through the Data Use Certification (DUC) workflow, the data access platform receives and stores:

  • Name, institutional email address, and institutional affiliation
  • RAS identifier and the authorizations linked to it
  • DUC application content, including the research data use statement, sub-applicants, and signing official
  • Records of responsible use training completion and NIST security attestation
  • Progress reports, close-out submissions, and access and query activity within the platform

The Data Access Committee uses this information to decide access requests and to confirm that approved users continue to meet the terms of their certification. Identity proofing happens at RAS, Login.gov, or ID.me. The Data Hub does not receive or store the credentials you use at those services.

Collection of Data Use Certification information is conducted under OMB control number 0925-0780. NIH provides the Privacy Act and Paperwork Reduction Act statements that apply to that collection.

‍

Use of Collected Information

We use the information described above to:

  • Respond to people who contact us
  • Review, approve, and administer data access requests and certifications
  • Report site access in aggregate and improve how we present content
  • Diagnose faults, investigate security events, and prevent misuse of the platform
  • Report platform usage to NIDA and NIH, and meet federal reporting, audit, and records obligations

We use browser IP address and anonymous browsing history to report site access and for aggregate profiling that improves presentation and usability. IP address information also supports troubleshooting.

We do not use information collected here for advertising, and we do not make automated decisions about you without human review.

‍

Distribution of Collected Information
  • We do not disclose personal information collected about you without your consent, except in explicit circumstances where the law requires disclosure.
  • We do not distribute or sell personal information to third-party organizations.
  • We share access request and certification information with NIDA, NIH, the Data Access Committee, and the study teams that need it to administer data access and meet federal oversight obligations.‍

‍

‍Study Data from ABCD and HBCD

The Data Hub hosts brain, behavioural, and genomic data collected from participants in the Adolescent Brain Cognitive Development (ABCD) Study and the HEALthy Brain and Child Development (HBCD) Study. This privacy policy covers information the website collects from visitors and approved users. It does not govern the study data itself.

Participant data is collected, consented, and governed through each study's protocol, informed consent and assent documents, institutional review board approvals, and the NBDC data use terms. Participants and their families who want to know how their data is used, corrected, or withdrawn should contact the study site that enrolled them or the study team. We refer participant requests we receive to the responsible study team.

Approved users hold their own obligations under the DUC, including NIH Security Best Practices for Users of Controlled-Access Data and the requirement to hold data on systems meeting or exceeding NIST SP 800-171 or equivalent standards.

‍

Where Your Information Is Stored

The Data Hub runs in the United States. Website data, account and access records, and study data are stored on United States infrastructure.

‍

How We Protect Information

The platform runs under a security program aligned to the NIST Cybersecurity Framework and NIST SP 800-53. Controls include encryption of data in transit and at rest, role-based access, multi-factor authentication through RAS, logging and monitoring, vulnerability management, vendor security review, and annual workforce privacy and security training. No system is completely secure, so we also maintain an incident response plan and notify NIDA, affected users, and regulators when the law or our contract requires it.

‍

How Long We Keep Information

We retain website and system audit and security log records for at least six years, consistent with NIST SP 800-53 and with the platform Data Management Policy. After that period we retain only aggregate statistics.

We retain study data hosted on the platform for at least six years from the date of creation or the date the record was last in effect, whichever is later. We retain account, certification, and access records for the period the NBDC data use terms, the contract, and the applicable federal records schedule require.

‍

Privacy Statement Revisions

We last revised this Privacy Statement on October 10, 2026. We may change it at any time and for any reason, so we encourage you to review it each time you visit the site. When we make a significant change, we post a notice on the site homepage for a period of time after the change takes effect.

‍

Responsibility for External Sites

This website contains links to other websites, some of them operated by third parties. We provide the links for your convenience, but we do not review, control, or monitor the privacy practices of websites operated by others.

We are not responsible for the performance of websites operated by third parties or for your dealings with them. Whenever you leave this website, review that site's privacy practices and reach your own conclusions about whether they are adequate.

‍

NBDC Data Hub Platform Components

The Data Hub relies on components that carry their own privacy policies. Review each policy for additional information.

‍

How to Contact Us

For questions about the Data Hub or about this Privacy Statement, write to Lasso Informatics, which operates the platform:

privacy@lassoinformatics.com

The Privacy Officer for the organization that operates the platform is Aleem Mohummed, Chief Operating Officer. Address privacy requests to him at the same email address.

‍