Privacy Policy
Last Updated: October 2026
1. Introduction
MyGNAO1 ("we", "our", or "the Platform") is committed to protecting the privacy of every individual who uses mygnao1.org. This Privacy Policy explains what data we collect, how we use it, how we store it, and the controls you have over it.
Given the nature of our platform — a community built around a rare pediatric neurological disorder — we treat privacy not as a compliance obligation, but as a foundational principle. Families share sensitive information about their children and their medical journeys. We take that trust seriously.
MyGNAO1 is registered and operated in The Hashemite Kingdom of Jordan. This Privacy Policy is governed by the laws of Jordan. Where applicable, we also acknowledge the rights of users under international frameworks including the General Data Protection Regulation (GDPR) for users accessing the Platform from the European Union.
By using the Platform, you agree to the practices described in this Privacy Policy.
2. What Data We Collect
2.1 Account Data
When you register an account, we collect:
- Email address
- Password (stored in hashed form — we never store plain-text passwords)
- Name or display name (if provided)
2.2 Patient Profile Data
If you register a patient profile on behalf of a GNAO1-diagnosed patient, we collect:
- The patient's first name
- Date of birth
- Country
You may also choose to provide:
- The genetic variant (mutation), if known
- A patient photo (see Section 6 for who can see it)
- A patient story
- Care updates and treatment experiences
The first name, date of birth and country are required. Everything else is optional. We do not ask for a city or any more precise location.
Profiles created with an earlier version of the profile form may also hold a city, diagnosis and background details, and notes. These remain stored with the profile but are no longer shown anywhere on the Platform.
2.3 Contributor Access Request Data
If you apply for Contributor (Editor) access, we collect the information submitted in the request form. This information must be accurate and authentic as per our Terms of Use.
2.4 Concepts Data
To improve the usability of care update entry, the Platform uses a shared concept system for fields such as medication names. When you enter a medication or similar term, the Platform checks whether a matching concept exists. If it does, it is returned for your selection. If it does not, a new concept is created and made available to other users. This helps group related data for community benefit and future research aggregation. Concepts are platform-wide and not tied to individual user identities.
2.5 Usage and Technical Data
We collect standard technical data through server logs and third-party analytics, including:
- IP address
- Browser type and version
- Operating system
- Pages visited and time spent
- Referring URLs
- General geographic region (derived from IP, not from profile data)
This data is used to maintain platform performance, diagnose issues, and understand general usage patterns. We do not use this data to build individual user profiles or track users outside of the Platform.
2.6 Communications
If you contact us via email (e.g. support@mygnao1.org), we retain that correspondence to respond to your inquiry.
3. How We Collect Data
We collect data through the following means:
- Registration and profile forms completed by you
- Care update and treatment entry forms
- Contributor access request forms
- Server logs generated automatically when you access the Platform
- Third-party analytics tools (see Section 7)
- Email correspondence initiated by you
4. How We Use Your Data
4.1 Platform Functionality
To provide core platform features including account management, patient profiles, care timelines, the Community Map, and the GNAO1 Library.
4.2 Community Support
To enable families to connect, share experiences, and access information relevant to GNAO1-related disorders — in accordance with the visibility setting you choose for each profile.
4.3 Platform Improvement
To understand how the Platform is used and to improve its performance, usability, and content.
4.4 Transactional Communications
To send essential account-related emails such as registration confirmation, OTP verification, and contributor access request updates. We do not send marketing emails.
4.5 Research (Phase 2 — Opt-In Only)
In a future phase of the Platform, anonymized and aggregated patient data may be made available to researchers studying GNAO1-related disorders. This will only occur with explicit, informed, and individually withdrawable consent from the patient's guardian. No data will be used for research without this consent. No data will ever be used for commercial purposes.
4.6 Concepts Aggregation
Anonymized concept data (e.g. medication names, treatment terms) may be aggregated to support research insights and improve the collective understanding of GNAO1 treatment experiences.
5. Data We Do Not Collect or Use
To be explicit:
- We do not collect exact GPS coordinates or precise locations
- We do not track users outside of the Platform
- We do not sell data to any third party
- We do not use data for advertising or commercial purposes
- We do not share identifiable data with researchers without explicit guardian consent
- We do not store plain-text passwords
6. Patient Profile Privacy Controls
Each patient profile has one visibility setting. It decides who can see the patient's first name on the Community Map's country list, the profile — including its story, variant and care updates — and the photo:
- Public: Anyone can see your child's first name on your country's list, the profile and the photo, including visitors who aren't signed in. Anyone signed in to MyGNAO1 can message you, unless you switch messages off.
- Community: Anyone signed in to MyGNAO1 can see your child's first name on your country's list, the profile and the photo, and can message you unless you switch messages off.
- Private: Only you can see the profile and the photo, and no one can message you. Your child still counts toward your country's total, without a name.
A new profile starts as Community unless you choose otherwise when you create it. Anyone with an email address can create a MyGNAO1 account, so Community does not limit who can see a profile to families affected by GNAO1.
Whatever the setting: every profile is counted in its country's total on the Community Map, and a profile whose variant is confirmed in ClinVar is also counted in that variant's totals, worldwide and for its country. Anyone can see these counts, including visitors who aren't signed in. If yours is one of only a few families in your country, the counts can show which variant your child has to anyone who knows of your family, even when the profile is Private. The map shows locations at country level only: no city is shown to anyone, and MyGNAO1 does not place map markers at city coordinates or any precise geographic location.
An earlier version of the profile form had separate settings for the photo and the location. A profile whose location was hidden is now Private, and every photo now follows its profile's setting, including where the photo had been set more narrowly.
You can change the setting at any time from the profile page. Changes take effect on the Platform immediately, but they cannot withdraw a photo, or its web address, that someone has already been shown.
8. Data Storage and Security
8.1 Storage Location
All data submitted to the Platform is stored on secure servers in AWS US-EAST-1 (Northern Virginia, United States). Data does not leave this environment except as described in this Privacy Policy.
8.2 Security Measures
We implement industry-standard security measures including:
- Encrypted data transmission (HTTPS enforced across all Platform surfaces)
- Encryption at rest for database and file storage
- Access controls limiting data access to authorized systems and personnel only
- No static credentials — infrastructure access is managed via IAM roles
8.3 Data Retention
We do not currently apply automated data retention or deletion schedules. Data associated with your account remains stored for as long as your account exists. Upon account deletion, all associated data is permanently deleted (see Section 9.2).
9. Your Rights
9.1 Access and Correction
You may update your patient profile at any time from the profile page, where a photo can be replaced but not removed. Account information cannot currently be changed from within the Platform. To correct it, to have a photo removed, or to see or remove details stored from an earlier version of the profile form, contact us at support@mygnao1.org.
9.2 Data Deletion
Account deletion is not currently available as a self-service feature within the Platform. To request deletion of your account and all associated data, please contact us at support@mygnao1.org. We will process your request and confirm deletion. Upon deletion, all associated data including patient profiles, care updates, and submitted content will be permanently removed.
9.3 Withdrawal of Research Consent
If you have consented to your patient's data being used for research purposes (Phase 2), you may withdraw that consent at any time. Withdrawal will prevent future use of your data for research. It will not affect any processing that occurred prior to withdrawal.
9.4 Visibility Control
You may change a patient profile's visibility setting at any time from the profile page. Changes take effect on the Platform immediately; Section 6 explains what a change cannot withdraw.
9.5 GDPR Rights (EU Users)
If you are accessing the Platform from the European Union, you have additional rights under GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority. To exercise these rights, contact us at support@mygnao1.org.
10. Children's Data
MyGNAO1 does not permit individuals under the age of 18 to register accounts. Patient profiles represent GNAO1-diagnosed patients who may be minors. All patient profile data is submitted and managed exclusively by the patient's parent or legal guardian, who confirms this when creating the profile.
Who can see data relating to minor patients is set by the guardian's visibility setting, within the limits described in Section 6. It is never sold, and never used for any purpose beyond those described in this Privacy Policy.
11. Third-Party Services
We use the following third-party services in the operation of the Platform:
- Amazon Web Services (AWS) — infrastructure, storage, and email delivery
We do not share personally identifiable information with these services beyond what is technically necessary for their function. Each third-party service operates under its own privacy policy.
MyGNAO1 does not own or control external links, third-party websites, or support groups referenced on the Platform. We are not responsible for their privacy practices.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When changes are made, the "Last Updated" date at the top of this page will be revised. We encourage you to review this page periodically. Continued use of the Platform following any changes constitutes your acceptance of the updated Policy.
For significant changes affecting how we handle your data, we will make reasonable efforts to notify registered users directly.
13. Contact
For any questions, concerns, or requests related to this Privacy Policy or your data, please contact us at:
Email: support@mygnao1.org
Or through the Contact page at: mygnao1.org/contact