Privacy Policy

C. Clocks for Communities

C.1 What this section covers

Clocks for Communities is our program in which people who share a condition, a treatment, an experience, a place, a heritage or a way of life join a community together, so that their pooled, de-identified data can be used to build an epigenetic clock for that community. This section covers:

• members, meaning people who reserve a spot or enroll;
• Champions who lead a community;
• people who give a test to someone else;
• sponsors and their representatives;
• employers and partner organizations;
• people and organizations we contact about the program.

C.2 Why your membership is treated as confidential

Belonging to some communities says something about you. It can show that you live with a health condition, take a particular treatment, served in the military, or belong to a heritage group. We treat the fact that you belong to a community as confidential. We do not show that you belong to a community unless you choose to.

When membership could reveal health status or identity, we mark the community as sensitive. Communities about a condition, a treatment, an experience or a heritage are marked sensitive by default. Sensitive communities get the extra protections described in sections C.7 and C.10.

C.3 Reserving a spot

Reserving is free and non-binding, and it is for adults: you must be 18 or older, and we ask you to confirm that when you reserve. To reserve, we ask only for your first name and email address. We do not ask for health information or payment at this stage. Every reservation form links to this policy and to our Terms.

You may also choose to tell us:

• that you are interested in becoming a Champion;
• that you might know a possible sponsor;
• that you would like to receive Clock Foundation news (see C.10);
• the first three digits of your ZIP code, for communities based on a place (we never keep your full ZIP code);
• a display name for the community's founding-members wall, if you want to appear on it.

Some communities ask you to confirm that the community's description fits you before you reserve. We check that box but do not store your answer.

When you reserve, we also record some information automatically:

• the date and time, including when you confirmed you are 18 or older;
• the IP address you reserved from;
• the page that sent you to us;
• any campaign tags in the link you followed;
• the personal link of the member, squad or partner organization that invited you, if any;
• whether you used the built-in browser of an app such as Facebook or Instagram. We record that as a category only, not your full browser details.

We use this to:

• confirm and count your reservation;
• credit the person or organization that invited you, as a count only (see C.7);
• prevent automated abuse;
• understand which ways of sharing the program work.

We send one email asking you to confirm your address. Your spot counts only once you confirm. After you reserve, we may ask a few optional questions: how far along you are with the thing your community is about, how you heard about us, and what you would most like your community's clock to tell you. You do not have to answer them.

C.4 Taking part in research

Taking part in research is voluntary and separate from reserving a spot or becoming a Champion. Before you take part you will see the full research consent form, which describes the research, its risks and your rights, and you take part only if you give your consent. You can withdraw at any time. This policy explains how we handle your information; the consent form governs your participation in the research.

If your community locks in and you complete your enrollment details, we collect:

• your answers to eligibility questions. These include questions about your health, for example whether your body mass index is over 35, whether you have had an alcohol or drug use problem in the last six months, and whether you have certain psychiatric, cognitive or unstable medical conditions;
• your date of birth (you must be 18 or older) and sex, which the clock needs;
• your answers to any questions specific to your community, which may concern your health;
• your shipping name, address and phone number, so we can send your sample kit;
• whether you would like help with the cost of your test.

When you sign the consent form, we record your typed name, the date and the IP address you signed from. We keep a PDF copy in private storage and email a copy to you.

C.5 Your sample, your data and your report

You send a small blood sample using the at-home kit we mail you. Our laboratory partners process it to measure DNA methylation. The resulting data files are kept in private cloud storage that is not publicly accessible.

When your community's results are ready, your personal report appears in your member portal. Your report measures biological aging. It is not a medical diagnosis.

You can also download your own raw data files from the member portal. Only you can download them. Each download is a link that works for 15 minutes, and we keep a record of each download.

C.6 The member portal

The member portal at my.clockfoundation.org does not use passwords. When you sign in, we email you a link and a six-digit code. Both work once and expire after 15 minutes, and we store only a scrambled (hashed) form of them. You can also turn on two-step verification with an authenticator app.

Your session ends after 30 minutes without activity, unless you choose "remember this device", which keeps you signed in on that device for up to 14 days. To see your consent form, payments, results or raw data, you must have signed in within the last 30 minutes.

To protect your account, we log the following, each with the time and IP address:

• sign-ins and sign-in attempts;
• when you view your consent form, payments, receipts or results;
• when you download your raw data or your information;
• when you change your preferences, withdraw consent or delete your account.

Our staff cannot sign in as you. In the portal you can:

• download a copy of your information in a machine-readable file;
• change your email and display preferences;
• withdraw your consent;
• delete your account (see C.12).

C.7 What others can see

The public and other members. Your membership is not shown publicly unless you opt in. If you choose, you can appear on your community's founding-members wall under a display name you pick. If you join through a squad (a small group of friends who join together), you can choose to show your first name to that squad. The share links we give you point to a neutral page. A page opened by one of your personal invitation links (a squad invitation or a "recruit a Champion" link) shows your first name only if you have chosen to show it; otherwise it says that a member invited them.

For sensitive communities:

• the founding-members wall is never shown, and we do not store a display name;
• share links and link previews do not name the community;
• image descriptions never name the condition;
• Champion photos and named quotes are not used;
• a "recruit a Champion" page never shows the name of the person who shared it.

Champions see numbers about their community: how many people have reserved, confirmed and enrolled. They do not see members' names, email addresses or who invited whom. A referral leaderboard shows "A member" unless that member chose a display name for the wall, and on sensitive communities it always shows "A member". Co-champions of the same community see each other's first names, and each other's email addresses only if both have agreed. Messages through "Ask a Champion" are relayed by us, so neither side sees the other's address.

Sponsors see counts and progress only, never information about an individual member. If a member introduces a sponsor, the sponsor and the Champion learn the organization, not the member who introduced it.

Employers that cover tests for their staff see counts only, never which employees took part, and we do not show counts for groups smaller than 20.

Partner organizations whose link brought you to us are credited with a count, never with who you are.

Our staff. Access to member information is limited by role. Program administrators must accept a confidentiality commitment before they can see any program data. In it they agree to use member information only to run the program, not to export or share it, and never to name members or confirm anyone's membership outside the program. Their access is time-limited and logged. Only senior site administrators can export the member list of a sensitive community. Staff views and exports of member information are recorded in a log that cannot be edited or deleted.

C.8 Research use and publication

A community's clock is built from pooled, de-identified data, and it never includes anyone's individual information. We report findings as group patterns. We will name you in an individual story only if you separately opt in to that, and the option is off unless you turn it on. When a community's clock is released, you can see where you stand within your community without anyone else's individual results being shown.

For heritage communities, we do not compare clock results between heritage groups. A community that concerns a specific nation or tribe is held back until that nation's involvement has been recorded.

We intend to publish findings from the program, whatever the outcome. Publications report de-identified, aggregate results. The use of your data in research is described in full in your consent form, and the consent form takes precedence over this section on research use.

C.9 Payments, gifts and sponsorships

Payments are processed by Stripe on Stripe's own hosted pages. Your card or bank details go directly to Stripe and never reach our servers. Stripe also receives your name and email address and keeps them under its own privacy policy.

When you commit to your test, Stripe saves your card. We charge it only after you have enrolled and consented.

We keep a record of each payment:

• the amount, fees and status;
• the payer's email;
• whether it was paid by card, bank transfer or invoice;
• Stripe's reference numbers;
• any refund and the reason for it.

We send receipts ourselves.

Gifts. If you give a test to someone, we ask for your email address and, optionally, your name. If you give your name, the person who uses the gift sees "Gift from" followed by it. We never contact the recipient ourselves: we send you a link to pass on. The recipient claims the gift with their own first name and email. If you ask for help with the cost of your test, we record your request and our decision.

Sponsors. For a sponsoring organization we keep the representative's name, title and email, a billing email, and the typed signature and IP address recorded when an agreement or pledge is accepted. A sponsor's name is shown publicly on the community's page once we confirm the pledge, unless the sponsor chooses to be listed anonymously or not at all. A logo is shown only if the sponsor provides one and we have reviewed it. Employer programs are not named publicly unless the employer agrees.

C.10 Email from the program

We send program email through Mailchimp Transactional (Mandrill). Members receive service email about their reservation and community: confirmation, milestones, lock-in and enrollment, sign-in links and receipts. These messages are about the reservation you made, so they are sent whether or not you asked for news. For a sensitive community, the subject line and the preview text of these emails never name the community.

Open and click tracking. Email we send to members, Champions, followers, supporters and individual people we contact is sent with open and click tracking turned off. We turn tracking on only for program messages to sponsor representatives and partner organizations, and for outreach email to organizations (see C.11). For those messages we record whether and when a message was opened and which links were clicked.

Clock Foundation news. If you tick "Also send me Clock Foundation news", we add your email address and first name to our mailing list, run on Mailchimp. We also use that mailing list for our MyAgingTests service. We tag your entry as coming from Clocks for Communities, with your role (member, Champion or sponsor contact). For communities that are not sensitive, we also add the community's name as a tag. For sensitive communities we never send the community's name to Mailchimp. We do not send your IP address, campaign tags, answers or ZIP code to Mailchimp. If you do not tick the box, nothing about you reaches Mailchimp.

Unsubscribing. Program messages, outreach email, and the confirmations and reminders we send when you follow a community or answer an event invitation include an unsubscribe link. Program messages and those confirmations and reminders also let your email app unsubscribe you in one click. When you unsubscribe, or when a message bounces or is reported as spam, we add your address to a suppression list so that we do not email you again. If you turn news off in the member portal, delete your account, tell us an invitation is "not for me" or use an unsubscribe link, we also unsubscribe your address from our Mailchimp mailing list. Because that list is shared with MyAgingTests, this also stops MyAgingTests marketing email to that address.

C.11 Contacting organizations and community leaders

To find Champions, sponsors and partners, we contact organizations and people in public roles, such as the leader of a patient organization, a club or an association. For each, we keep:

• information from public sources: name, title, organization and public contact route;
• where that information came from;
• our notes on why the organization or person may be a good fit;
• our messages and the replies and, for email to an organization, whether a message was opened or a link clicked;
• any meeting request, together with the IP address it was sent from.

We calculate an internal interest level from this activity, and it fades over 60 days. We use it only to decide whom to follow up with.

For sensitive communities we contact organizations only, and we invite only a named public leader of a listed organization. We never invite individual members or private individuals. We do no staff outreach at all for heritage communities.

If you tell us "not for me", unsubscribe, or ask us to stop, we record that and do not contact you or, where you ask, your organization again.

If you register for a program event such as a town hall, we keep your name, email and response and send you the meeting link and reminders.

C.12 How long we keep information, and deleting your account

You can delete your Clocks for Communities account at any time from the member portal. When you do, we remove or blank:

• your email address, name and display name;
• your shipping address, phone number and kit tracking number;
• your date of birth, sex, eligibility answers and survey answers;
• your raw data files, which we delete from storage;
• the IP address, referring page, campaign tags, in-app browser category, ZIP code digits and invitation, squad and partner links recorded when you reserved;
• your optional answers and your email and display choices;
• Champion settings, invitations, Ask a Champion messages, photos and quotes you gave us;
• any follow, supporter or event registration under your address, and your sign-in links and codes.

We also cancel any reservation where you had not yet enrolled, so it stops counting; cancel any commitment that has not yet been charged and remove your saved card; unsubscribe your address from our mailing list; and close your account.

Some records stay after you delete your account:

• If you enrolled, your community still counts you, without anything that identifies you.
• A record of which consent form you agreed to and when. We remove your typed name, the IP address and the signed copy, unless the law requires us to keep them.
• Payment records keep their amounts and payment reference numbers for our accounts and taxes.
• Our suppression list keeps your address so that we keep honoring your request not to be emailed.
• Security logs of account activity are kept. The record of the deletion itself does not store your email address.

We delete used or expired sign-in links and codes, and records kept to limit repeated sign-in attempts, after 30 days. We remove the identifying details from a cancelled reservation after 180 days. We keep other program records as long as needed for the purposes in this policy, as described in section 7.

Withdrawing your consent stops your further participation. Data already contributed is kept, as your consent form describes, unless you also delete your account.

You can download a copy of your information from the portal at any time. For any other request about your data, contact us using section 13.

C.13 Cookies on program pages

Clocks for Communities pages use a session cookie to remember the invitation or campaign link you arrived from, for up to two weeks, and a security cookie that protects our forms. The member portal uses its own session cookie to keep you signed in. Program pages do not load analytics or advertising trackers, and most use fonts hosted on our own servers.

A few pages related to the program use the main site's layout: the event registration page, the claim invitation page, the unsubscribe page and the pages for organizations we contact. Those pages load fonts, icons and page styling from Google Fonts, jsDelivr and the Tailwind CSS service, which receive your IP address in order to deliver them. They do not load analytics or advertising trackers.

C.14 Protecting program information

We protect program information in several ways:

• role-based access, checked on every request;
• private storage with short-lived signed links for consent forms and data files;
• hashed sign-in links and codes;
• limits on sign-in attempts;
• a confidentiality commitment for program staff;
• an access log that cannot be edited.

Pages that are personal to you, such as your enrollment, payment, invitation and squad pages, are marked so that search engines do not index them.