Yale University Privacy Statement
Yale University, (“Yale” or “the University”) collects, uses, and shares personal information in support of our academic, research, and clinical missions and to ensure the safety of the Yale community. In Yale’s management of personal information, we seek to minimize the information we collect; limit access to that information; apply appropriate security measures to protect against loss, improper modification or disclosure; and respect the unique privacy needs of an academic environment.
This Privacy Statement applies to activities conducted by Yale and is meant to provide an overview of university privacy practices, including how we may collect, retain, process, share, and transfer your personal information. Some individual Yale websites may have their own privacy notices or additional privacy statements that supplement this Privacy Statement. In addition, some Yale websites may have links to external websites that are not owned or controlled by Yale. Yale is not responsible for the privacy practices or content of such websites.
Please review this statement carefully. By using this website or submitting information to Yale, you are consenting to our collection and use of information in accordance with Yale policies for Yale’s legitimate business purposes or as needed to provide services you request from Yale.
I. Collection and use of information
“Personal information,” also known as personally identifiable information, is any information that relates to an identifiable person. Examples of personal information include name, mailing address, phone number, email address, date of birth, University Personal Identifier, as well as employment records, student records, and health records that include identifying information. Information that does not identify a person and cannot reasonably be used to identify a person is not personal information.
Personal information we have received may be used only for legitimate University purposes as authorized by the appropriate data steward (see University Policy 1601: Information Access and Security).
Yale obtains personal information in three ways:
· Information you provide directly to us, such as through registration as a patient or through an application for admission or employment.
· Information we gather from other sources, such as transcripts provided by other schools or reference letters from former employers.
· Information that is automatically collected when interacting with a university website or mobile application.
1. Information you provide to us or that we collect from third parties
Personal information you provide to us or that we collect from third parties is used to provide services to you and for administration of the University, including administering university programs and operations, responding to your requests, providing promotional or educational materials that may be of interest to you, completing requested transactions such as the purchase of event tickets, conducting internal research, improving our programs, and to meet our legal and reporting obligations. The personal information collected will be stored in the United States and will be transferred to the US if collected internationally. In addition, personal information may be transferred to our venders in the US and in other countries, so long as those venders have signed an agreement with Yale to protect the privacy of the information in accordance with applicable data protection laws. The details of these uses depend on the types of services you are receiving and your affiliation with the University. Some of our more common uses are described below:
a. Student Information
Student information may include your name, contact information, Net ID, student provided profile information, academic performance, interactions with University resources, building access, immunization status, health information, documentation in support of academic accommodations, dietary needs, payment information such as credit card or banking information, tax ID numbers, participation in extracurricular activities, and any other information you provide to us in your capacity as a student. We may combine information you provide directly with information from third parties. This information may be used to manage student academic and residential activities such as course registrations, housing assignments, dining hall access, billing and financial aid including certifications to lenders for the purpose of loan deferral, NCAA compliance, student advising, library resource management, course evaluation and quality improvement initiatives, academic and other accommodations related to disabilities, and in other ways. The use and disclosure of student information is managed in compliance with the Family Educational Rights and Privacy Act (FERPA). Our practices with regard to personal information about current or former students are described in our FERPA statement at
https://registrar.yale.edu/rights-privacy/student-rights-under-ferpa.
Registration in online and campus-based courses with an online component will lead to collection of personal information, including your name, University net ID, email address, and any information you voluntarily provide in creating a learner profile. For both online courses and campus-based courses with an online component, we and our education vendors collect information on your interactions with the course, including online interactions with other course participants, posts to the learning community, engagement with course materials, and test and assignment scores.
International students who will be attending Yale will be asked to provide information to the Office of International Students and Scholars, which helps students apply for and maintain the appropriate visa status. Information you provide, including your name, contact information, and financial resources, and your enrollment status will be shared as required with the US Department of Homeland Security.
b. Yale non-degree programs
Yale non-degree programs collect information similar to that of our degree programs including name, contact information, payment information, and other information that you provide to us in your application to the program and in signing up to participate or creating a learner profile. Programs that do not include an on-site component may provide access to coursework, lectures, live discussion, assignments, as well as faculty and other learners through online learning systems such as Canvas and Zoom. Your participation in these platforms may be recorded and archived in the learning system. We and our education vendors collect information on your interactions with the course, including online interactions with other course participants, posts to the learning community, engagement with course materials, and test and assignment scores. For international participants, information collected will be transfer to and stored in the US which may have different privacy standards than your home country. The information collected will be used to manage the non-degree program, quality improvement of our programs, program oversight, and any other activities described in the individual program you participate in.
c. Prospective Student Information
Yale collects information related to prospective students and their family members in order to process applications for admission and determine eligibility for financial aid. The information provided in your application will be available to university staff and admission reviewers and stored in the US. The application requires that you provide your name and contact information, educational and employment history, recommendations, test scores where applicable, and other materials needed to assess your application to study at Yale. If you are applying for financial aid, you will be asked to provide financial information, including tax ID number, wages, scholarships, family financial resources, and access to standardized financial aid applications, such as FAFSA. Any personal information collected for admissions purposes is collected either directly from you or with your consent. The information you provide may be shared with third-party software vendors, who are contractually obligated to protect the privacy and security of the information. The University may use information from admissions applications for internal quality improvement and other administrative processes necessary to provide educational services.
If admitted to Yale, the information will become part of your student record and will be subject to the Family Educational Rights and Privacy Act (FERPA, 34 CFR Part 99).
d. Alumni and Donor Information
Our practices with regard to alumni and donor information, whether provided by you or third parties, can be found at Alumni Affairs & Development’s Personal Information Disclosure.
e. Patient Information
Our practices with regard to personal information collected in the course of providing patient care or as a health plan for our employees are described in our HIPAA Notice of Privacy Practices available at https://hipaa.yale.edu
f. Human Resource and Employment Information
Yale collects personal information, such as contact and demographic information, employment and educational background, salary and benefits, banking information for payroll deposits, tax and withholding information, and information related to job performance, in connection with employment applications, required federal filings, personnel management and for human resources management and trend analysis. Yale’s Human Resources and hiring systems may incorporate software with artificial intelligence components to aid in recruitment, human resources management and for other legitimate Yale business purposes. Results from such automated or AI-assisted tools will not be used as the sole basis or most important factor in decisions and will not be used to overrule human evaluation of job applications or employees. These systems are subject to oversight and review by the Talent Acquisition team, Human Resources, and Privacy.
International scholars who will be working at Yale will be asked to provide information to the Office of International Students and Scholars, which helps scholars apply for and maintain the appropriate visa status. Information you provide, including your name, contact information, and financial resources, and your employment status will be shared as required with the US Department of Homeland Security.
Yale Employee Health serves as the University’s occupational health department and provides health services related to workforce health and safety including management of workplace injury, oversight of employee immunization requirements, medical surveillance, and workforce medical clearances. In this context, Employee Health collects and creates health information about employees and prospective employees and retains this information in accordance with state and federal employment requirements for confidentiality of employee medical information. This information includes medical records that you have provided or released to Yale. Where appropriate this information may be shared with relevant University staff, including supervisors, to promote workplace health and safety.
Employees whose role requires access to restricted facilities may be asked to provide biometric information such as iris scans which are used to control access to areas with sensitive information or materials. Where biometric information is needed, the employee will be notified regarding the data collection. Use is limited to those purposes described in the notice. Biometric information is secured in accordance with university policies for high-risk data and will only be disclosed as needed to manage access, with your consent, or as required by law. Biometric information is destroyed as soon as no longer needed for the collected purposes unless required to be retained under applicable law or regulation.
g. Research Participants
Yale researchers gather personal information to conduct scientific studies. In most cases, researchers collect personal information as agreed to by participants in study consent forms, but researchers may gather information from other sources with approval from our institutional review board (a research ethics board). Commonly collected information includes name, contact information, interview and survey responses, and medical records. Yale’s institutional review board sets standards to minimize the amount of information collected and to limit access to the information. Information collected internationally will be transferred to the United States for analysis and retained through the project period. In some cases, the information may be retained indefinitely and archived for public interest, scientific or historical research or statistical purposes. Participant’s rights in research information may be limited in some cases based on study integrity needs and required reporting to federal agencies, such as the Food and Drug Administration.
h. Information stored on Yale Information Technology (IT) Systems
Yale’s policies and procedures regarding access to faculty, staff, and student information stored in Yale IT systems are described in Yale Policy 1607 Information Technology Appropriate Use Policy. The University will not access IT systems without user consent except in the limited circumstances described in Policy 1607.
Yale may utilize application logs in university systems in order to improve data accuracy or to improve user experience. For example, some university systems allow machine learning to identify possible data entry errors such as a time sheet with entries outside a staff member’s normal work schedule and then flag these for review by the user or supervisor. Other features may use application logs to enhance user navigation based on frequent use patterns.
2. Information automatically collected from use of our website or mobile applications
Unless you take steps to browse the Internet anonymously, or opt out, Yale, like most institutions and organizations on the Internet, tracks visitors’ web-browsing patterns. Generic information is collected through the use of “cookies,” which are text files placed on your computer to evaluate usage patterns so that we can improve both content and distribution. You may refuse to accept cookies by selecting the appropriate settings on your browser, but doing so may prevent you from using the full functionality of all of our websites.
Some sections of the Yale website use Google Analytics, a service provided by Google, Inc. Google Analytics uses cookies to help us analyze the use of our site. This information is transmitted to Google and stored on its servers, and Google uses this information on Yale’s behalf to evaluate use of the website, compile reports on website activity, and provide other services relating to Internet usage. Google may also transfer this information to third parties where required to do so by law, or where third parties process the information on Google’s behalf. The information generated by cookies about your use of the website includes your IP address, but Google will not associate your IP address with any other information held by Google. By using Yale’s website, you consent to the processing of information about you by Google in the manner and for the purposes set out above. Please visit the following pages for more information on Google Analytics terms of use and Google’s privacy practices.
Yale maintains an information security office, charged with monitoring the security of Yale IT systems and IT infrastructure. Industry-standard practices are employed to identify and respond to vulnerabilities, attacks, or compromises impacting Yale IT assets or Yale information.
II. Automated Decision Making and Artificial Intelligence
Yale has implemented tools to assist in legitimate Yale business purposes such as data management and decision making. These tools may use artificial intelligence (AI) and machine learning to more effectively utilize information to carry out our institutional mission. For example, we may use these tools to assist healthcare providers identify anomalies needing further medical assessment to improve patient care. AI tools also may be used to increase productivity by creating meeting summaries and transcripts. Activities that incorporate AI and machine learning tools are subject to Yale’s guidance on the use of AI available at: https://yaledata.yale.edu/yale-university-ai-guidelines-staff. In addition, AI-enabled tools are subject to oversight to ensure appropriate privacy and security controls are implemented, including contractual controls for instances involving regulated data.
III. Sharing of Personal Information
Yale may share your personal information with companies that provide services to Yale so that we can provide services to you and properly manage the University. We endeavor to minimize the information provided to our service providers and to obtain appropriate agreements with regard to their handling of personal information. We may also share personal information as necessary to comply with applicable laws and regulations, to detect and prevent fraud, to protect the security of our information, and to protect the rights and safety of others.
IV. Information retention
We follow applicable laws governing the retention of your personal information. We retain your information for as long as needed to fulfill our business and archival purposes, and some information may be retained indefinitely. Factors that influence the length of time we retain your information include our legal obligations, our need for information to provide services to you, and our interest in preserving historical records of the University and our activities.
V. Your rights in the personal information we collect
You may have the right to view, amend, or request that Yale delete personal information. For details, see the privacy statements related to the types of information we collect above. Requests to view, amend or delete personal information may be made by sending an email to [email protected]. We may require additional information to verify your identity prior to processing your request.
VI. Changes to our privacy statement
This Privacy Statement may be changed from time to time, and updates will be posted to this website. This version is current as of October 2024.
VII. Contact information
If you have questions about Yale’s privacy practices or wish to exercise your privacy rights, you may contact the Yale Privacy Office at [email protected] or by mail at Yale Privacy Office, PO Box 208255, New Haven, CT 06520-8255.
v 10-2024