StudyRun · Selby Labs · International

Data Processing Agreement

Version 1.1  ·  Effective date: 15 April 2025  ·  Applies to: Customers outside Australia and the EU/EEA/UK
This Data Processing Agreement applies to Customers whose institution is based outside Australia and outside the EU/EEA/UK (for example, in the United States, Canada, Brazil, Switzerland, Japan, Singapore, or any other jurisdiction not covered by our Australian DPA or our EU DPA). If your institution is based in Australia, use the Australian DPA. If your institution is based in the EU/EEA/UK, or your study participants are located there, use the EU DPA.
How this agreement is formed: This DPA is incorporated by reference into the StudyRun Terms of Service. By clicking "I Agree" during registration or when upgrading your subscription, you accept this DPA. Your agreement is recorded with your name, timestamp, IP address, and the version of this document in force at the time.

1. Parties

Data Processor (Selby Labs): Selby Labs Pty Ltd, ABN 50 697 107 083, Suite 329/98-100 Elizabeth Street, Melbourne VIC 3000, Australia. Email: support@studyrun.org

Data Controller (Customer): The researcher or institution identified in your StudyRun account registration and subscription details.

2. Background

The Customer is a researcher or research institution that uses the StudyRun platform to conduct digital phenotyping studies, collecting personal data from research participants. In providing the StudyRun platform services, Selby Labs processes personal data on behalf of the Customer. This agreement governs that processing relationship, supplementing whatever data-protection legislation applies in the Customer's jurisdiction ("Applicable Data Protection Law").

Demo server: The StudyRun demo environment is hosted in Australia (AWS ap-southeast-2, Sydney). The demo environment is intended solely for testing and evaluating the platform by researchers; it must not be used to collect personal data from real research participants. The demo is a shared, multi-tenant environment; the per-Customer instance-isolation and operational security commitments described in this agreement apply only to paid subscription servers. The demo server is provided on a best-efforts basis only and may be suspended, reset, or permanently deleted at any time and without prior notice, at Selby Labs's sole discretion. No data persistence is guaranteed and no liability arises from interruption or deletion of demo data. Real participant Study Data must only be processed on a paid subscription server.
Use exclusions. The Platform, as offered under this DPA, may NOT be used to process:

3. Definitions

Personal Data means any information relating to an identified or identifiable natural person, as defined by the Applicable Data Protection Law.

Sensitive Personal Information has the meaning given in the Applicable Data Protection Law and includes, in jurisdictions that recognise the concept, health data, biometric identifiers, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, and genetic data.

Study Data means all personal data and other data collected from Participants through the Customer's studies on the Platform.

Platform means the StudyRun digital phenotyping research platform and associated services.

Services means the services provided by Selby Labs to the Customer under the Terms of Service.

4. Nature and Purpose of Processing

Selby Labs processes personal data on behalf of the Customer for the purpose of providing the Platform services, including:

The categories of personal data the Platform is capable of processing are set out below. Each category is enabled per-study by the Customer; no category is processed unless the Customer has enabled it in their study configuration.

5. Customer Obligations (Data Controller)

The Customer is responsible for:

6. Selby Labs Obligations (Data Processor / Service Provider)

Selby Labs will:

7. Sub-processors

Selby Labs uses the following sub-processors to provide the Services. All sub-processors are contractually bound to handle personal data in a manner consistent with this agreement:

Device-platform APIs (not sub-processors): The StudyRun mobile app also reads from APIs provided by the Participant's own device operating system: Apple HealthKit and Core Motion on iOS; and Google Health Connect, Google Play Services Location Services, and Google ML Kit on Android. Data read through these APIs is read from the Participant's device, not from Apple or Google.

Selby Labs will notify the Customer of any changes to the sub-processor list that could affect the processing of Study Data, with at least 14 days written notice before the change takes effect. The Customer may subscribe to sub-processor change notifications by sending an email to support@studyrun.org with the subject line "Sub-processor notifications". Unresolved legitimate-grounds objections entitle the Customer to terminate this agreement without penalty and with a pro-rata refund of prepaid fees for the unexpired portion of the subscription.

8. Security Measures

Selby Labs implements the following security measures to protect Study Data:

9. Data Retention and Deletion

Study Data is retained for the duration of the Customer's subscription. A countdown and export reminder are shown in the Platform dashboard throughout the subscription, with prominent notice as the subscription end date approaches. At subscription end the Customer has a 7-day export grace period during which read and export access to the Customer's server instance is retained. At the end of that 7-day period the server is terminated, the primary database is deleted, and Study Data is purged from backups on the next rotation of the 7-day backup cycle (no later than 14 days after subscription end).

Important: Once data is deleted from the StudyRun Platform, deletion is permanent and cannot be reversed. Please ensure you export all required Study Data before your subscription expires or before requesting deletion.

Selby Labs will provide written confirmation of deletion upon request. The Customer may request deletion of Study Data at any time during the subscription period by contacting support@studyrun.org.

10. Data Breach Notification

Selby Labs will notify the Customer without undue delay, and in any event within 48 hours of becoming aware of a data breach affecting Study Data. The notification will include, to the extent known at the time: the nature of the breach, the categories and approximate number of Participants affected, the likely consequences, the contact details of Selby Labs's data protection contact, and the steps taken or proposed to address the breach and mitigate its effects. Where information is not available in full at the time of initial notification, Selby Labs will provide it in phases without undue further delay.

The Customer is responsible for determining whether the breach is notifiable under the Applicable Data Protection Law and for notifying the relevant supervisory authority and affected Participants as required. This includes, where applicable, notification under the US state breach-notification laws (all 50 states plus DC, Puerto Rico, and the US Virgin Islands), the HIPAA Breach Notification Rule (45 C.F.R. §§164.400-414) where a BAA has been executed, LGPD Article 48 (Brazil), PIPEDA (Canada), PDPA (Singapore), APPI (Japan), PIPA (South Korea), POPIA (South Africa), and analogous rules elsewhere.

11. Data Subject and Consumer Rights

11.1 General assistance

Selby Labs will assist the Customer, on reasonable request, in responding to verifiable requests from Participants to exercise rights under the Applicable Data Protection Law, including rights of access, correction/rectification, deletion/erasure, portability, restriction, and (where applicable) opt-out of sale or sharing, by providing technical tools within the Platform dashboard.

11.2 Direct requests from Participants

If a Participant contacts Selby Labs directly with a rights request, Selby Labs will forward the request to the Customer within 5 business days and will not respond to the Participant substantively without the Customer's prior written authorisation, except as permitted by Section 11.3.

11.3 Participant-level erasure

Where a Participant withdraws consent or requests deletion of their personal data, the Customer is responsible for making a verified deletion request to Selby Labs. On receipt of a verified request from the Customer, Selby Labs will delete all personal data held for that Participant from primary storage, databases, and logs within 5 business days, and from backup systems on the next rotation of the 7-day backup cycle, with full purge completing no later than 7 business days plus 7 calendar days from the verified request. Written confirmation is provided once the backup purge completes. A non-identifiable deletion-log entry recording the date, pseudonym identifier, and type of deletion is retained for audit purposes; this log does not constitute retention of personal data.

11.4 Government access requests

If Selby Labs receives a legally-enforceable request from a public authority for access to Study Data, it will: (a) where legally permitted, promptly notify the Customer and, where the Customer cannot be reached, the affected Participants; (b) where legally prohibited from notifying the Customer, use reasonable efforts to obtain a waiver of the prohibition and document its efforts; (c) provide the minimum amount of personal data permissible based on a reasonable interpretation of the request; and (d) challenge any request that it considers unlawful or disproportionate under applicable law. Selby Labs has received no such request as at the effective date of this agreement.

12. International Data Transfers

Selby Labs is based in Australia, and Study Data may be stored on AWS servers in Sydney, Australia (or, at the Customer's request, in an AWS region within the EU). Any transfer of personal data from the Customer's jurisdiction to Australia or another country is subject to the Applicable Data Protection Law's transfer requirements. Where the Applicable Data Protection Law requires a specific transfer safeguard (for example, Switzerland's revised Federal Act on Data Protection, Québec's Law 25, or Brazil's LGPD), the parties agree to execute the Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914 (Module 2, Controller to Processor), or the equivalent model clauses adopted by the Customer's jurisdiction where available, as an appendix to this DPA on request. Contact support@studyrun.org to initiate that process.

13. Orphaned-controller fallback

If Selby Labs is made aware that the Customer can no longer be reached (for example because the Customer has ceased to exist as a legal entity, the nominated researcher contact has left the institution and no successor has been appointed, or the Customer's subscription has long since lapsed and all contact attempts have failed) and a Participant whose personal data is still held by Selby Labs for that Customer exercises a right, Selby Labs may, after at least 30 days of documented unsuccessful attempts to reach the Customer and at Selby Labs's reasonable discretion, respond to the Participant directly to give effect to that right, including by deleting the Participant's personal data.

14. Roles: joint-controller fallback

The parties have categorised their relationship as Data Processor / Service Provider, without admission that any contrary categorisation applies. This Section is a contingent fallback only and does not of itself establish joint controllership.

To the extent a competent regulator or court determines, on review of a specific subset of processing activities (such as Selby Labs's collection of platform-operational telemetry like crash reports and device-info events, or the choice of retention periods and pseudonymisation scheme for the Platform), that the parties share controller-like responsibility for that subset only, the parties agree that Selby Labs will be the point of contact for Participants in respect of platform-technical queries only, and the Customer will be the point of contact for all study-specific queries. The handling of rights requests where the Customer cannot be reached is addressed separately in Section 13 (Orphaned-controller fallback) and is subject to the 30-day attempt period described there.

15. Automated decision-making restriction

Selby Labs does not use Study Data to carry out automated decisions producing legal or similarly significant effects on Participants. The Customer must not configure the Platform to carry out such decisions, and must not export Study Data from the Platform into downstream systems that carry out such decisions, without a lawful basis under the Applicable Data Protection Law and without providing Participants with the safeguards it requires.

16. Audit

Selby Labs will make available to the Customer, on reasonable request, information necessary to demonstrate compliance with this agreement. The Customer may request an audit of Selby Labs's data-processing practices with no less than 30 days written notice, at the Customer's cost, subject to reasonable confidentiality protections. Selby Labs may provide relevant third-party certifications or security assessment reports in lieu of on-site audits.

17. Severability

If any part of this agreement is held to be invalid, illegal, or unenforceable, that part will be severed and the remaining provisions will continue in full force and effect.

18. Term

This agreement commences on the date the Customer accepts the StudyRun Terms of Service and continues until all Study Data has been deleted following subscription termination. Clauses relating to security, confidentiality, deletion, and liability survive termination.

19. Governing Law

This agreement is governed by the laws of Victoria, Australia, without prejudice to non-excludable rights the Customer or any Participant may have under the Applicable Data Protection Law of the Customer's or Participant's jurisdiction. The parties submit to the non-exclusive jurisdiction of the courts of Victoria, Australia. Nothing in this clause deprives a Participant of the right to bring proceedings against Selby Labs in the courts of the Participant's habitual residence where the Applicable Data Protection Law confers such a right.

Contact

Selby Labs Pty Ltd  ·  ABN 50 697 107 083

Suite 329/98-100 Elizabeth Street, Melbourne VIC 3000

Email: support@studyrun.org