Privacy Policy

Effective date: July 18, 2026

The University of Michigan ActiveStep Research Study service (“the Service”) is operated by research teams at the University of Michigan. It collects Fitbit device data from the Google accounts of consented research study participants for approved University of Michigan research studies, using the Google Health API.

Who we are

The Service is operated by the University of Michigan for use by research studies that have been reviewed and approved by a University of Michigan Institutional Review Board (IRB) or another IRB of record. Each study that receives your data has its own IRB-approved protocol and consent document; this policy covers the service that collects and stores your data on the studies’ behalf.

What data we collect

Only after you explicitly grant permission through Google’s consent screen, we collect health and fitness data available through the Google Health API for your account. Depending on the scopes you approve, this can include:

• Activity and fitness data: steps, distance, floors, elevation, active minutes, and exercise sessions;
• Exercise GPS location data recorded during workouts;
• Heart data: heart rate measurements, resting heart rate, heart rate variability, electrocardiogram (ECG) recordings, and irregular rhythm notifications;
• Sleep data: sleep sessions, duration, efficiency, and sleep stages;
• Health metrics and measurements: weight, body fat, oxygen saturation, blood glucose, and similar metrics, where available;
• Nutrition data: food and hydration logs;
• Your Google Health profile data (such as name, birth date, and device information) and Google Health settings.

We also store the technical information needed to operate the service: your Google account identifier, OAuth tokens (encrypted), and records of when data was retrieved.

How we use your data

• Your data is used solely for the IRB-approved research studies in which you have enrolled and consented to participate.
• We store retrieved data securely so that your study team can analyze it under its approved protocol.
• We do not use your data for advertising, marketing, or profiling.
• We do not sell your data or transfer it to data brokers.
• We do not allow humans to read your data except as required for the approved research protocols you consented to, for security investigations, or to comply with applicable law.

Limited Use disclosure

The Service’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we share your data

Retrieved data is shared only with the specific University of Michigan research study (or studies) in which you enrolled, under that study’s IRB-approved protocol and the terms of the consent form you signed. Published research results contain only aggregated or de-identified information. We do not share your identifiable data with any other third party except as required by law.

How we store and protect your data

• Data is stored on University of Michigan managed infrastructure.
• OAuth access and refresh tokens are encrypted at rest.
• Data in transit is protected with TLS.
• Access is limited to authorized research and technical staff.

Data retention and deletion

Research data is retained for the period specified in the IRB protocol of the study you enrolled in, and as required by University of Michigan research record-keeping policies. You may request deletion of the data held by the Service by contacting us at activestep@umich.edu or by contacting your study team; deletion of data already incorporated into research datasets is governed by your study’s consent document.

Revoking access

You can stop future data collection at any time by:

• Withdrawing from your research study (contact your study team), or
• Revoking this application’s access in your Google Account settings at myaccount.google.com/permissions.

Children

This service is used only by research participants enrolled under IRB-approved protocols, which define any applicable age requirements and parental-consent procedures.

Changes to this policy

We will post any changes to this policy on this page and update the effective date above. Material changes will be communicated to active study teams.

Contact

For questions about this policy or your data, contact activestep@umich.edu.
For questions about your rights as a research participant, contact the University of Michigan Human Research Protection Program.