GameBus Privacy Statement

Change log to version 3.0:

• Restructuring
• Clarification on the relevance of e-mail address data
• Update of legal basis
• Clarification on public data sharing
• Update of retention period

Change log to version 2.4:

• Restructuring
  • Use of mechanisms to hide/show details;
  • Renaming of section headers according to contemporary norms.
  • Removal of section on developer metadata, as it is covered by the general terms and conditions.
• Simplification;
• Refinement of information on data retention period;
• Clarification of obligations to external (non-TU/e) researchers

Change log to version 2.3:

• Removed references to native builds (Apple Store, Google Play)
• Removed mentioning of Actev (as it is a formal part of GameBus)

Change log to version 2.2:

• Added section 10 to clarify that metadata created by developer accounts is public

2.1 Personal data to create an account

When registering a GameBus user account, the following personal information is collected:

• E-mail address,
• Password,
• First name surname.

Remarks about these data types:

• Because email is the main communication channel between you and GameBus, your account will be suspended for a few weeks when you supply an invalid email address.
• We strongly encourage GameBus users to use a unique password for each online service they use. Furthermore, we recommend using a password manager to help users in generating strong passwords without making it complicated to memorize them.
• We do not force our users to use their real name. However, GameBus users can only find each other well using name search functionalities when names are used that are known to other users.

2.2 Images

Specific challenges can involve sharing uploaded images with the challenge sponsor or with the general public. In such cases, the challenge description will clarify that and when joining such a challenge, users explicitly provide their consent. The primary purpose of sharing pictures is to facilitate the promotion of GameBus in order to stimulate its uptake. Users can also upload a GameBus profile picture and an administrator of a GameBus circles (called a “team leader” in the following) can upload a picture for the circle they manage. Images uploaded for user profiles or for circle profiles are visible to the general public.

2.3 Message data

As a social gamification system, GameBus also allows you to send messages to and receive messages from other users. These conversation data are thus collected and stored on the GameBus servers. GameBus personnel adheres to a policy of not checking individual messages. However, all GameBus data, including any type of message is input to research efforts aimed at understanding which user characteristics influence user engagement and health related behaviors. In any case, message data will not be shared to researchers outside the GameBus core research team.

2.4 Third-party personal data

When connecting a third-party data provider (such as those listed in the following), data will be fetched automatically from third-party servers to those of GameBus:

• Apple Health, an American app and central repository for health and fitness data on iPhone and Apple Watch (https://www.apple.com/ios/health/).
• Google Fit, an American health-tracking platform developed by Google for the Android operating system, Wear OS and Apple Inc.’s IOS (https://www.google.com/fit/)
• Runkeeper, an American app that helps people to track their exercise. This application collects data related to users physical activities (https://runkeeper.com/).
• Selfcare, a Dutch app that enables users to connect health and tracking devices in order to take charge of their well-being and vitality. This application collects data related to user’s physical activity and performance (http://www.selfcare4me.com/ & https://www.selfcare4me.com/privacy-en-veiligheid/).
• Fitbit, an American app for the family of wearables from the same named wearable device provider (https://www.fitbit.com/).

The specific type of data that is transferred from these third-party applications to GameBus is shown within the GameBus and the third-party application, on the screens to establish the data integration. This involves, but is not limited to, data that is tracked automatically (e.g., on automatically recorded walks, runs, bike-rides, sleep episodes, etc.).

GameBus users who use such third-party applications agree to the individual terms of use and privacy statements available from the providers of those applications. They also opt-in for data exchange explicitly, giving specific consent to data being shared from the third-party applications to GameBus. Once inside GameBus, the data copies are subject to the GameBus policies. Data within the third-party applications remains subject to their original policies and they are outside the control of GameBus. Specifically, the processes to have data removed from GameBus or the third-party platforms are fully disconnected.

2.5 Usage data

These are data automatically collected by GameBus when you connect your device (usually called `Usage data’). This Usage data (e.g. your masked IP-address for example) collected through these automatic tracking processes are anonymous and are used in order to improve the Application’s quality only. In addition, they could be used for research and scientific publication purposes. For example, in the EUSFLAT 2019 publication entitled “Application of fuzzy modelling to learn personal preferences of mHealth users: a case study”, GameBus researchers have analyzed the relationship between page visits in GameBus and user personality types. The purpose of that study was consistent with the GameBus mission, by aiming to develop more effective health promotion support via personalization.

Please note that the Application will not implement or allow third-party companies to implement automatic tracking processes for other purposes than those explained in this Privacy Statement, without your prior consent.

2.6 Cookies

Cookies are small text files that are created by the websites you visit and may contain information about you as a visitor. These text files are stored on your computer and they often make later visits to the same websites more convenient, for example, by remembering your username and password for you automatically. The GameBus website uses cookies for improving the user experience and for targeting marketing campaigns and offers to our users. Both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your device for a set period of time or until you delete them) are used.

When you visit the GameBus website using a computer/phone or a web browser for the first time, a pop-up screen will instruct you to read the information about cookies and to choose to accept or reject the use of cookies. You can also modify your choice later by changing the relevant settings of your web browser. You can delete the cookies that have been stored on your computer in the past. In case you choose not to accept cookies, the GameBus website is still usable, but the functionality may be compromised.

All personal data are stored at the GameBus server, which is within the European Union. Personal data are shared to the following parties for the purposes of either supporting the operations of GameBus or for scientific research and publications:

4.1 GameBus affiliated research teams

The GameBus core team consists of less than five researchers within TU/e. However, this team collaborates with national and international peers in order to optimize behavior change methods for health and wellbeing. Personal data may be shared with such peers for the purpose of scientific research. When sharing data openly to the international research community at large, we will always strive to anonymize it. To ensure thorough anonymization, we may collaborate with members of smaller consortia who can assist in identifying and mitigating potential re-identification risks.

4.2 Third-parties

GameBus services are executed on private virtual servers owned by Host Europe GmbH in Germany. TU/e has a data processing agreement with Host Europe GmbH that stipulates that certain obligations concerning protection of personal data are respected, thus ensuring that data are processed with due regard for the wishes and standards of TU/e.

Security

GameBus holds the security and integrity of your personal data with high regard. In a general way, we commit to carry out technical and organizational means to protect all personal data against illegal or fortuitous destruction, fortuitous loss, alteration, diffusion or unauthorized access. Nevertheless, we shall be required to divulgate any information regarding the user to comply with any applicable law or rules, or to respond to any administrative or judiciary order.

Despite these means, personal data collected by digital systems cannot be 100% secure, and there is always a risk of data loss or unauthorized access to your personal data. You assume this risk when you register as a GameBus user. On the user’s side, we highly recommend you use a strong password to your GameBus account, and to keep the password in a safe place. You are also advised to restrain access to your browsers, computers, and phones. In particular, we strongly discourage users to use GameBus on devices they cannot control fully (e.g., public computers, shared tablets, …).

Retention Period

All personal data within the GameBus platform will be stored in encrypted form for a minimum of 10 years, starting from the date of collection, for the purpose of scientific research regarding social gamification and its potential for promoting a healthy lifestyle. This is critical for the GameBus user experience since the aim of GameBus is to leverage a user’s longitudinal data set to persuade this user to healthier behavior, or otherwise preserve already good health habits. By preserving the data during this period, we ensure specifically that we can apply newly emerging scientific data analysis and anonymization methods also on older data.