NIH Web Privacy Notice

Protecting your privacy is very important to us. Our website links to other National Institutes of Health (NIH) sites, federal agency sites and occasionally, to private organizations. Once you leave the primary NIH.gov site, you are subject to the privacy policy for the site(s) you are visiting. We do not collect any personally identifiable information (PII) about you during your visit to NIH websites unless you choose to provide it to us. We do, however, collect some data about your visit to our website to help us better understand how the public uses the site and how to make it more helpful. We collect information from visitors who read, browse, and/or download information from our website. NIH never collects information for commercial marketing or any purpose unrelated to the NIH mission and goals.

When visitors submit questions or comments via the Ask NIH online form, NIH staff responds to the inquiries and files them. Only designated staff members requiring access to the emails to respond, may view, or answer them.

Types of information collected

When you browse through any website, certain information about your visit can be collected. We automatically collect and temporarily store the following type of information about your visit:

  • Domain from which you access the Internet;
  • IP address (an IP address is a number that is automatically assigned to a computer when surfing the Web);
  • Operating system and information about the browser used when visiting the site;
  • Date and time of your visit;
  • Pages you visited; and,
  • Address of the Web site that connected you to an NIH Web site (such as google.com or bing.com); and,
  • Demographic and interest data.

We use this information to measure the number of visitors to our site and its various sections and to help make our site more useful to visitors. This information cannot be used to identify you as an individual.

How NIH collects information

NIH.gov uses Google Analytics to collect the information in the bulleted list in the Types of Information Collected section above. Google Analytics gathers information automatically and continuously. No Personally Identifiable Information (PII) is collected. NIH staff conducts analyses and reports on the aggregated data from Google Analytics and those reports are only available to NIH.gov managers, members of the NIH.gov communications and web teams, and other designated staff who require this information to perform their duties.

Additionally, NIH.gov participates in the Digital Analytics Program (DAP), in which Google Analytics data is collected from websites across the Federal Government. For more information on DAP, please visit the DigitalGov website.

NIH also uses online surveys to collect opinions and feedback from a random sample of visitors. NIH.gov uses the ForeSee Results’ American Customer Satisfaction Index (ACSI) online survey to obtain feedback and data on visitors’ satisfaction with the NIH.gov website. This survey does not collect PII. Although the survey invitation pops up for a random sample of visitors, it is optional. If you decline the survey, you will still have access to the identical information and resources at the NIH.gov site as those who do not take the survey. The survey reports are available only to NIH.gov managers, members of the NIH.gov Communications and Web Teams, and other designated staff who require this information to perform their duties.

NIH retains the data from Google Analytics, and ACSI survey results as long as needed to support the mission of the NIH.gov website.

How NIH uses cookies

The Office of Management and Budget Memo M-10-22, Guidance for Online Use of Web Measurement and Customization Technologies (PDF 106 KB) allows Federal agencies to use session and persistent cookies.

When you visit any website, its server may generate a piece of text known as a "cookie" to place on your computer. The cookie allows the server to "remember" specific information about your visit while you are connected.

The cookie makes it easier for you to use the dynamic features of web pages. Cookies from NIH web pages only collect information about your browser’s visit to the site; they do not collect personal information about you.

There are two types of cookies, single session (temporary), and multi-session (persistent). Session cookies last only as long as your web browser is open. Once you close your browser, the cookie disappears. Persistent cookies are stored on your computer for longer periods.

Session cookies

We use session cookies for technical purposes such as to enable better navigation through our site. These cookies let our server know that you are continuing a visit to our site. The OMB Memo 10-22 Guidance defines our use of session cookies as "Usage Tier 1 — Single Session.” The policy says, "This tier encompasses any use of single session web measurement and customization technologies."

Persistent cookies

We use persistent cookies to enable Webtrends and Google Analytics to differentiate between new and returning NIH.gov visitors. Persistent cookies remain on your computer between visits to NIH.gov until they expire. We also use persistent cookies to block repeated invitations to take the ACSI survey. The persistent cookies that block repeated survey invitations expire in 90 days. The OMB Memo 10-22 Guidance defines our use of persistent cookies as "Usage Tier 2 — Multi-session without Personally Identifiable Information (PII).” The policy says, "This tier encompasses any use of multi-session Web measurement and customization technologies when no PII is collected."

How to opt out or disable cookies

If you do not wish to have session or persistent cookies placed on your computer, you can disable them using your Web browser. If you opt out of cookies, you will still have access to all information and resources at NIH.gov. Read instructions for disabling or opting out of cookies in the most popular browsers. Please note that by following the instructions to opt-out of cookies, you will disable cookies from all sources, not just those from NIH.gov.

How personal information is protected

You do not have to give us personal information to visit the NIH websites. However, if you choose to receive alerts or e-newsletters, we collect your email address to complete the subscription process.

If you choose to provide us with personally identifiable information, that is, information that is personal in nature and which may be used to identify you, through an e-mail message, request for information, paper or electronic form, questionnaire, customer satisfaction survey, epidemiology research study, etc., we will maintain the information you provide only as long as needed to respond to your question or to fulfill the stated purpose of the communication. If we store your personal information in a record system designed to retrieve information about you by personal identifier (name, personal email address, home mailing address, personal or mobile phone number, etc.), so that we may contact you, we will safeguard the information you provide to us in accordance with the Privacy Act of 1974, as amended (5 U.S.C. Section 552a).

If NIH operates a record system designed to retrieve information about you in order to accomplish its mission, a Privacy Act Notification Statement should be prominently and conspicuously displayed on the public-facing website or form which asks you to provide personally identifiable information. The notice must address the following five criteria:

  1. NIH legal authorization to collect information about you
  2. Purpose of the information collection
  3. Routine uses for disclosure of information outside of NIH
  4. Whether the request made of you is voluntary or mandatory under law
  5. Effects of non-disclosure if you choose to not provide the requested information

For further information about NIH privacy policy, please contact the NIH Senior Official for Privacy at privacy@mail.nih.gov; call 301-451-3426 or visit the NIH Privacy Program page

Data safeguarding and privacy

NIH uses web measurement and customization technologies to help our websites function better for visitors and to better understand how the public uses the online resources we provide. All uses of web-based technologies comply with existing policies with respect to privacy and data safeguarding standards. Information Technology (IT) systems owned and operated by NIH are assessed using Privacy Impact Assessments (PIAs) posted for public view on the Department of Health and Human Services (DHHS) Web site. NIH conducts and publishes a PIA for each use of a third-party website and application (TPWA) as they may have a different functionality or practice. TPWA PIAs are posted for public view on DHHS Web site.

Groups of records that contain information about an individual and are designed to be retrieved by the individual’s name or other personal identifier linked to the individual are covered by the Privacy Act of 1974, as amended (5 U.S.C. Section 552a). For these records, NIH Systems of Record Notices are published in the Federal Register and posted on the NIH Senior Official for Privacy Website. When you visit the NIH Institute/Center sites, please look for the Privacy Notice posted on the main pages. When web measurement and customization technologies are used, the Privacy Policy/Notice must provide:

  • Purpose of the web measurement and/or customization technology;
  • Usage tier, session type, and technology used;
  • Nature of the information collected;
  • Purpose and use of the information;
  • Whether and to whom the information will be disclosed;
  • Privacy safeguards applied to the information;
  • Data retention policy for the information;
  • Whether the technology is enabled by default or not and why;
  • How to opt-out of the web measurement/customization technology;
  • Statement that opting-out still permits users to access comparable information or services; and,
  • Identities of all third-party vendors involved in the measurement and customization process.

Data retention and access limits

NIH will retain data collected using the following technologies long enough to achieve the specified objective for which they were collected. The data generated from these activities falls under the National Archives and Records Administration (NARA) General Records Schedule (GRS) 20-item IC 'Electronic Records,' and will be handled per the requirements of that schedule. Learn more about General Records Schedules.

How NIH.gov uses third-party websites and applications

As part of the OMB Memo M-10-06, Open Government Directive (PDF 86 kb), the NIH uses a variety of new technologies and social media options to communicate and interact with citizens. These sites and applications include popular social networking and media sites, open source software communities and more. TPWAs are Web-based technologies that are not exclusively operated or controlled by NIH, such as applications not hosted on a .gov domain or those that are embedded on NIH web pages. Users of TPWAs often share information with the general public, user community, and/or the third-party operating the website. These actors may use this information in a variety of ways. TPWAs could cause PII to become available or accessible to NIH and the public, regardless of whether the information is explicitly solicited or collected by NIH.

The following list includes some of the TPWAs we use and their purpose. NIH sometimes collects and uses PII made available through third-party websites. However, we do not share PII made available through third-party websites. Your activity on the third-party websites we use is governed by the security and privacy policy of those sites, which we have linked below. You should review the third-party privacy policies before using the sites and ensure that you understand how your information may be used. If you have an account with a third-party website, and choose to follow, like, friend, or comment, certain PII associated with your account may be made available to NIH based on the privacy policy of the third-party website and your privacy settings within that third-party website. Therefore, you should also adjust privacy settings on your account to match your preferences.

For any NIH TPWA that collects PII, the list below also includes details on the information NIH collects and how we will protect your private information.

Facebook

NEI staff members manage one Facebook page — National Eye Institute. The NEI team posts news and other items of interest to be consumed by the public. If you have a Facebook account, you can log in to your account to post comments, and 'like' the NEI Facebook page and individual entries. The amount of visible personal information displayed will depend on your own Facebook privacy settings. You can completely avoid displaying any PII by not creating a Facebook account, not posting comments, not clicking on the 'like' options, or interacting with the NEI Facebook account in any way (i.e., private messaging, sharing NEI posts, etc.). NEI staff do not collect, use or disclose any PII information about visitors who comment or 'like' the NEI Facebook page. As a practice, comment moderator policy requires the removal from the NEI Facebook page of any comments that contain spam or are improper, inflammatory, off-topic or offensive. Repeat offenders may be subject to banning. The information is saved on a shared drive that’s password protected. This drive is accessible to NEI managers, system owners, communications staff, web teams, and other staff who need this information to do their job. Read Facebook’s Privacy Policy.

Twitter

NEI staff members mange one Twitter account — @NatEyeInstitute. The NEI team posts short messages or ‘Tweets’ (up to 280 characters) to share information about NEI with the public and respond to comments and inquiries sent via Twitter to NEI. While you may read the NEI Twitter feeds without subscribing to them, if you want to subscribe to (or follow) NEI Twitter feeds, you must create a Twitter account at www.twitter.com. To create an account, you must provide some personal information, such as your name, user name, password and email address. You have the option to provide additional personal information including a short biography, location or a picture. Most information you provide for a Twitter account is available to the public, but you can modify how much of your information is visible by changing your privacy settings at the Twitter.com Web site. NEI staff members monitor the number of subscribers, but the staff never takes possession of the personal information belonging to you as a Twitter follower. However, as a practice, comment moderator policy requires the removal from the NEI Twitter pages of any comments that contain spam or are improper, inflammatory, or offensive. The information is then saved on a password-protected shared drive accessible to NEI Managers, System Owners, Communications Staff, Web Teams, and other designated staff who require this information to perform their duties. Read Twitter’s Privacy Policy.

LinkedIn

NEI staff members manage one LinkedIn page — National Eye Institute. The NEI team posts news and other items of interest to be consumed by the public. To create an account, you must provide some personal information, such as your name, user name, password and email address. You have the option to provide additional personal information including a short biography, employment information, location, or a picture. You can modify how much of your information is visible by changing your privacy settings at the Twitter.com Web site. We do not collect any PII, such as name, phone number, mailing address, email address, or location, of users who interact with NEI’s LinkedIn account. You can completely avoid displaying any PII by not creating a LinkedIn account, not joining NIH LinkedIn groups, or not interacting with NEI LinkedIn groups in any way (i.e., private messaging, posting on group pages, etc.). NEI staff does not collect, use, or disclose any of this information you provide in messages or posts on LinkedIn. Read LinkedIn’s Privacy Policy.

YouTube

NEI staff members manage NEI’s YouTube channel — National Eye Institute, NIH. The NEI team posts videos to be consumed by the public.

When you watch videos, YouTube may record non-personally identifiable information about their site usage, such as channels used, videos watched, and data transfer details to improve its services. If you log on to the YouTube site before watching NEI videos, YouTube may associate information about your site usage with your YouTube account. If you log onto YouTube and comment on an NEI video, any personal information you included on your YouTube profile page will be visible to visitors who click on the comment field. If you do not log in before watching NEI videos posted on YouTube, you cannot comment on NEI videos and your site usage will not be associated with you or a YouTube account. Read YouTube’s Privacy Policy.

Mobile App Privacy Policy

NEI developed the See What I See mobile app, which is available for download on the Google Play and iOS app stores. We do not collect any PII, such as name, phone number, mailing address, email address, or location, when users download the app. We also do not collect any device-specific information, such as IP addresses or IMEI numbers.

The app does link to the NEI website. If you choose to access the NEI website through the app, we will automatically collect information about your visit to the website, as noted above.

For more information

For more information on the uses of social and new media for which GSA has negotiated a federally-friendly Terms of Service Agreement, visit the HHS Center for New Media.

For further information about NIH privacy policy, please contact the NIH Senior Official for Privacy at privacy@mail.nih.gov; call 301-451-3426 or visit the NIH Privacy Program site.  

Last updated: August 4, 2020