Privacy Policy

Effective date: October 8, 2026 | Last updated: October 8, 2026

1. Introduction

This Privacy Policy explains how the University of California, San Francisco ("UCSF," "we," "us," or "our") collects, uses, stores, shares, and protects information obtained from wearable activity and health trackers in connection with an Institutional Review Board (IRB)–approved research study (the "Study").

The Study uses two companion applications:

BRIDGE Gather ("GATHER") — the data-collection application that connects to your Google account, retrieves your data through the Google Health API, and stores it on UCSF internal servers. Google's sign-in and permission screens, and the Linked apps list in your Google Account, show it as "BRIDGE Gather"; and
BRIDGE — the application used by the clinical and research team to view the collected data, primarily during patient appointments.

Together they are referred to as the "Applications." This Policy applies specifically to data that GATHER retrieves through the Google Health API from the Google account you connect, and that BRIDGE displays to the care team, on behalf of participants who have enrolled in the Study and provided informed consent. It also covers data collected from Oura and Garmin devices through those platforms' APIs, as described in Section 10. It supplements, and does not replace, the informed consent documents you signed when enrolling, the UCSF Notice of Privacy Practices, and the privacy policies of the wearable device manufacturers.

If you have questions about this Policy, contact the study team at bridge@ucsf.edu.

2. About BRIDGE, BRIDGE Gather, and the Research Study

BRIDGE and BRIDGE Gather ("GATHER") are UCSF research and clinical-care applications operated by the Weill Institute for Neurosciences. GATHER connects to the account your wearable device syncs to, collects your data through that platform's API — for Fitbit devices, the Google Health API — and stores the data on UCSF internal servers. BRIDGE presents that collected data to the clinical and research team, primarily during patient appointments. Participants are enrolled through an IRB-approved research protocol.

As part of the Study, you are given a wearable device (a Fitbit, Oura, or Garmin tracker). For a Fitbit, you sign in to the Google account your device syncs to and allow GATHER to read your data through the Google Health API; for an Oura or Garmin device, you authorize access through that platform's account.

Participation is voluntary. You may decline to participate or withdraw at any time, as described in your informed consent form and in Section 12 below.

3. Information We Collect

3.1 Wearable device data

With your permission, GATHER collects the health and activity data stored in the account you connect, for each day from your Study start date to your Study end date. For Fitbit, GATHER reads your Google account through the Google Health API, not one particular device, so if other devices or apps also send data to that account, their data for those days may be collected too.

Google asks you to let BRIDGE Gather see, read-only, the categories below. GATHER uses and keeps only the items listed, even where a Google permission covers more:

Activity and fitness: your steps for each minute and your daily Active Zone Minutes.
Health metrics and measurements: your average heart rate for each minute, your daily resting heart rate, and your daily heart-rate variability (RMSSD).
Sleep: each sleep session, including naps, with its start and end times and time-zone offset; its sleep stages (awake, light, deep and REM, or asleep, restless and awake when stages are not available); its sleep efficiency; and whether it was your main sleep of the night.
Settings (optional): the time zone in your Google Health settings, used only to divide your data into your own calendar days. If you decline, GATHER uses the time zone the study team recorded for you, or the Study's default.

From this data GATHER calculates daily summaries: total steps, lowest and highest heart rate, hours asleep, and minutes the device was worn during the day (6 a.m. to 10 p.m.) and at night. GATHER cannot change or delete anything in your Google account.

[Team to confirm: if a start date can be set before the consent date, add — "This can include days before you enrolled, back to the start date set by the study team."]

For Oura and Garmin devices, GATHER collects comparable activity, heart-rate, and sleep data made available through the Oura and Garmin APIs for the same date range; see Section 10.

3.2 Account and authorization data

When you connect, you sign in to Google and choose which permissions to give BRIDGE Gather. Google then gives GATHER an access token, a refresh token and the token's expiry time. GATHER stores these in the Study database on UCSF servers so it can keep retrieving your data until access is revoked. GATHER does not request your name, email address or Google profile from Google, and it never receives your Google password. Connecting an Oura or Garmin device works the same way through that platform's sign-in, giving GATHER tokens that are stored on UCSF servers.

3.3 Study and participant data

We maintain limited information needed to administer the Study, such as your study identifier, enrollment status, and records linking your device data to your participation. If you are a UCSF patient, BRIDGE may show your wearable data next to information from your UCSF medical record so your care team can review them together.

3.4 What we do not collect

We request only the data scopes necessary for the Study. We do not collect your wearable-platform password, and we do not access data outside the scopes you authorize.

4. Sources of Data (Third-Party Wearable Platforms)

GATHER obtains data directly from the platform you authorize:

Google — through the Google Health API (read-only), which provides the data your Fitbit or other wearable uploads to your Google account through the Google Health app (formerly the Fitbit app).
Oura — via the Oura API.
Garmin — via the Garmin Health and Garmin Connect APIs.

[Team to confirm: if the Study still holds data collected earlier through the Fitbit Web API, add — "Data collected before <date> was retrieved through the Fitbit Web API, which Google is retiring."]

Your use of each device and platform is also governed by that manufacturer's own terms and privacy policy. We encourage you to review them:

Google: policies.google.com/privacy
Oura: ouraring.com/privacy-policy
Garmin: garmin.com/en-US/privacy/connect/

5. How We Use Your Information

We use the information described above only for the following purposes:

To conduct the IRB-approved research Study and fulfill its protocol;
For research analysis, including scientific and statistical analysis of health and activity patterns;
To improve patient care and clinical decision-making for Study participants, where applicable and permitted by the protocol;
To display your data to you and/or your clinical care team through the BRIDGE application, including during patient appointments;
To operate, secure, troubleshoot, and maintain the GATHER and BRIDGE applications; and
To meet legal, regulatory, IRB, and institutional obligations.

We do not use wearable data for advertising or marketing, we do not use it for any purpose unrelated to the Study, and we do not sell your data.

6. Why We May Use Your Data

We collect and use your wearable data because you agreed to it in your IRB-approved informed consent form [Team to confirm: and in your signed authorization to use your health information for research (your HIPAA authorization)], and because you approved access on Google's permission screen. UCSF is a covered entity under the federal Health Insurance Portability and Accountability Act (HIPAA). When your wearable data is combined with your UCSF medical information, we protect it as HIPAA requires. Your consent form [and HIPAA authorization] describe our data practices, the risks, and your rights; if they differ from this Policy, they control.

7. How We Store and Protect Your Data

GATHER transmits data over encrypted connections and stores it on UCSF-managed internal servers within UCSF's protected computing environment. BRIDGE accesses this data only to display it to authorized users. We apply the following safeguards (items in brackets to be confirmed by UCSF IT before publishing):

Encryption of data in transit between GATHER and Google (HTTPS)[, and encryption at rest of the Study database];
Access to GATHER and BRIDGE limited to authorized Study personnel through [the UCSF network or VPN / UCSF sign-in];
[Logging of who accessed GATHER and BRIDGE, kept and reviewed under UCSF policy;]
Access and refresh tokens kept only in the Study database on UCSF servers and out of GATHER's application logs; when the study team disconnects you or removes you from GATHER, GATHER asks Google to revoke them; and
Institutional network, firewall, and endpoint protections.

Study staff can export a participant's data from GATHER as files for analysis; these files are kept only in [UCSF-approved locations]. BRIDGE reads the data from GATHER to display it [and does / does not keep its own copy].

We treat your data as confidential and limit disclosure. We may share information only as follows:

Authorized Study personnel at UCSF (investigators, research staff, and, where relevant to your care, your clinical care team);
Oversight bodies, such as the UCSF IRB, auditors, and regulators, as required to monitor and ensure the integrity of the Study;
De-identified or aggregated data for research, publication, or presentation, in a form that does not reasonably identify you;
Service providers acting on UCSF's behalf under appropriate agreements, only as needed to operate the Study; and
When required by law, or to protect the rights, safety, and security of participants, UCSF, or others.

We do not sell your data, and we do not share it for advertising or marketing purposes. We do not transfer, use, or disclose data obtained from the wearable platforms except as described in this Policy.

9. Google Health API — Limited Use Disclosure

The use and transfer to any other app of information received from Google APIs, including the Google Health API, by BRIDGE Gather (called GATHER in this Policy) and by BRIDGE will adhere to the Google API Services User Data Policy, the Google Health API Developer and User Data Policy, and the Google Health API User Data and Health Research Policy, including the Limited Use requirements. These commitments cover the data we receive from Google and any data aggregated, anonymized, de-identified, or derived from it. Specifically:

We request only the read-only Google Health permissions listed in Section 3.1. We never change your Google data.
We use your Google Health data only for this Study, as described in Section 5 and in your informed consent form. We do not use or share it for any other research study or purpose unless you give separate informed consent or the UCSF IRB waives that requirement.
We transfer your Google Health data to others only (a) with your consent, to provide the Study features described in this Policy, such as showing it to your UCSF clinicians in BRIDGE; (b) for security purposes, such as investigating abuse; or (c) to comply with applicable law.
We do not sell your Google Health data, and we do not transfer it to advertising platforms, data brokers, or other information resellers, even in aggregated or anonymized form.
We do not use or transfer your Google Health data to serve advertisements, or to determine credit-worthiness or for lending purposes.
People may read your individual Google Health data only (a) with your consent: by signing the Study's informed consent form, you agree that authorized Study investigators, research staff, and your UCSF clinicians may view your individual data in GATHER and BRIDGE for the purposes of the Study; (b) when necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) when the data has been aggregated and anonymized and is used for internal operations.

[Team to confirm: that the consent form says what the last bullet says, and name any vendor that receives the data in the transfer bullet and in Section 8.]

10. Platform-Specific Terms (Oura and Garmin)

In addition to the practices above, GATHER's handling of Oura data complies with the Oura API License Agreement, and its handling of Garmin data complies with the Garmin Health / Garmin Connect Developer Program and applicable Garmin platform agreements. GATHER accesses and stores, and BRIDGE displays, Oura and Garmin data solely for the Study purposes described in this Policy; we do not sell it, and we do not disclose it to third parties except as described in this Policy or as required by law.

11. Data Retention

GATHER retrieves data only for the days between your Study start and end dates. We keep your wearable data, and the daily summaries calculated from it, on UCSF servers while you take part and then for [retention period from the protocol, e.g. "N years after the Study ends"]. Afterward, data is retained, de-identified, or securely destroyed in accordance with the IRB-approved protocol, UCSF and University of California records-retention policies, and applicable law. De-identified or aggregated data may be retained indefinitely for research.

12. Your Choices and Rights

You have the following choices regarding your wearable data:

Withdraw from the Study at any time by contacting the study team. The team then disconnects GATHER from your Google account, which stops future data collection.
Disconnect: at your request, the study team revokes GATHER's access to your Google account. Data already collected is kept and handled as described in Section 11.
Deletion: at your request, the study team removes you from GATHER, which revokes its access to your Google account and permanently deletes the wearable data GATHER stored for you. [Team to confirm: what happens to exported copies, data shown in BRIDGE, and backups.] Some data already used in analyses or required for research integrity may not be able to be deleted.

To exercise any of these rights, contact bridge@ucsf.edu. Participants also retain the rights described in their informed consent form and the UCSF Notice of Privacy Practices.

13. How to Disconnect a Device or Revoke Access

You can revoke GATHER's access to your wearable data at any time. In your Google Account, GATHER is listed as "BRIDGE Gather":

Google (Fitbit and other devices that sync to your Google account): in your Google Account, open Linked apps (myaccount.google.com/connections), select BRIDGE Gather, and choose Delete all connections. This stops new collection; it does not delete data GATHER has already collected (see Sections 11–12).
Oura: in your Oura account, go to Authorized / Connected applications and remove BRIDGE Gather.
Garmin: in your Garmin Connect account, remove BRIDGE Gather from authorized applications.

You may also email bridge@ucsf.edu and we will disconnect your device and stop collecting data. Upon revocation we stop retrieving new data; previously collected data is handled as described in Sections 11–12.

14. Children's Privacy

The Study enrolls only adults 18 and older. GATHER and BRIDGE are not intended for children, and we do not knowingly collect data from anyone under 18. If you believe a child's account has been connected, email us and we will disconnect it and delete the data.

15. Changes to This Policy

We may update this Policy from time to time. Material changes affecting participants will be communicated as required by the IRB. The "Last updated" date above indicates when this Policy was last revised.

16. Contact Us

BRIDGE and BRIDGE Gather — Weill Institute for Neurosciences, UCSF
Email: bridge@ucsf.edu
Address: 1651 4th St, San Francisco, CA 94158

If you have questions about your rights as a research participant, or concerns you would like to raise with someone other than the study team, contact the UCSF Human Research Protection Program (HRPP), which oversees the UCSF Institutional Review Board (IRB): call 415-476-1814 (Monday–Friday, 8 a.m.–5 p.m., except UCSF holidays) or visit irb.ucsf.edu/contact-us. Please mention the IRB number on your consent form.

See also: Terms of Service · BRIDGE Home