StudyRun is operated by Selby Labs Pty Ltd (ABN 50 697 107 083), a company incorporated in Victoria, Australia, with its registered office at Suite 329/98-100 Elizabeth Street, Melbourne VIC 3000.
Selby Labs provides the StudyRun digital phenotyping research platform, which enables researchers at universities and other institutions to design, deploy, and manage mobile sensing studies.
Selby Labs is committed to protecting personal information and complying with all applicable privacy laws. We are governed by:
In the event of any inconsistency, the more protective provision applies.
Any emails or support requests you send to us.
| Purpose | Examples |
|---|---|
| Providing the service | Creating your account, provisioning your server, providing support |
| Billing | Issuing invoices, processing payments, managing subscriptions |
| Communications | Responding to enquiries, sending service notifications and renewal reminders |
| Compliance | Maintaining agreement records, meeting legal obligations |
| Security | Detecting misuse, maintaining audit logs, preventing unauthorised access |
| Platform improvement | Analysing aggregated, de-identified usage patterns |
We do not sell your personal information. We do not use your information for advertising.
Selby Labs acts as a data processor (not a data collector) for research participant data. This means:
The researcher who runs the study is responsible for: obtaining participants' informed consent, providing participants with a privacy notice, complying with ethics requirements, and fulfilling any data rights requests from participants.
The StudyRun mobile application is capable of collecting the categories below. Each category is opt-in per study: no category is collected unless the Researcher has enabled it in their study configuration. The Researcher is responsible for disclosing to Participants the specific categories enabled in their study and obtaining any required consent.
Before any sensor data collection begins, the StudyRun mobile application shows each Participant an informed-consent dialog listing the study name and study description supplied by the Researcher. The Participant must explicitly tap "I agree to be part of this study" to proceed; dismissing the dialog without tapping Agree exits the enrolment flow. On agreement, the Platform writes a timestamped consent record (bound to the Participant's pseudonymous identifier, the study identifier, and the device identifier) which is uploaded with the next batch of Study Data and is available to the Researcher through the Platform export tools. This in-app record supplements, but does not replace, the informed-consent process the Researcher runs under their ethics approval. Selby Labs does not capture the Participant's signature, a verification of their identity, or the exact rendered text of the dialog at the moment of agreement.
We use the following third-party service providers who may process personal information on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | EC2 compute and EBS storage provisioned per paid Customer as an isolated EC2 virtual machine instance with its own EBS volumes on AWS's standard shared-tenancy infrastructure, and for the shared demo environment | Australia (ap-southeast-2) for AU customers and the demo server; EU (eu-west-1 Ireland or eu-central-1 Frankfurt) for EU customers at their selection |
| Wise | Invoicing and payment processing (billing contact and invoice line items only; no Study Data) | Belgium / United Kingdom |
| OpenWeather Ltd | Ambient-weather lookup by coordinates when a study enables the Weather sensor (Participant GPS only at time of query) | United Kingdom |
| Cloudflare, Inc. | Authoritative DNS for *.studyrun.org customer subdomains and ACME DNS-01 challenge for TLS certificate issuance. Not used as a reverse proxy | United States |
| Internet Security Research Group (Let's Encrypt) | Issuance of TLS certificates via the ACME protocol (subdomain names only) | United States |
| Transactional email provider | Service-related notifications (order confirmation, export reminders, breach notifications). Current provider identified on request at support@studyrun.org | Per provider; disclosed on request |
The StudyRun mobile app also reads from APIs provided by the Participant's own device operating system: Apple HealthKit and Apple Core Motion on iOS; Google Health Connect, Google Play Services Location Services, and Google ML Kit on-device barcode scanning on Android. Data read through these APIs is read from the Participant's device, not from Apple or Google. Use of Google Play Services Location on Android may cause a limited amount of telemetry to be transmitted to Google in the course of normal Android system operation. These relationships are disclosed here for transparency and are not treated as sub-processor engagements.
We may disclose personal information where required by law, court order, or a request from a government authority with lawful power to require disclosure.
If Selby Labs is involved in a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity subject to (a) privacy protections no less protective than those described in this Privacy Policy; and (b) the Customer's rights under the Data Processing Agreement, including the Article 28 GDPR requirement that the processor act only on the Customer's documented instructions, the right to be notified of a material change affecting sub-processors, and the right to terminate the subscription on legitimate data-protection grounds.
If the acquiring entity is established in, or controlled from, a jurisdiction whose surveillance-law and government-access regime is materially different from that covered by Selby Labs's Transfer Impact Assessment in Section 11.1B of the EU DPA (for example, a US-based acquirer), EU/EEA/UK Customers may terminate their subscription on 60 days written notice with a pro-rata refund of prepaid fees for the unexpired portion of the subscription. Selby Labs will provide the updated Transfer Impact Assessment at least 60 days before the acquisition completes so affected Customers have time to evaluate.
Researchers may include links to external websites within their study surveys. This Privacy Policy does not apply to those external websites. Selby Labs is not responsible for the privacy practices or content of any external websites linked within a study. Participants should review the privacy policies of any external websites they visit through a study.
Selby Labs is an Australian company. Researcher account information (name, email, password hash, IP address at registration, billing details) is stored in Australia regardless of your region. Research participant data collected during a paid subscription is stored in the AWS region you select at the time of ordering, either Australia (Sydney) or the European Union (Ireland or Frankfurt). Where the researcher is located in the EU, EEA, or UK, the transfer of researcher account information from the EU/EEA/UK to Australia is made under the Standard Contractual Clauses incorporated in our EU Data Processing Agreement, which you accept on registration.
Demo environment: The demo server is hosted in Australia (AWS ap-southeast-2, Sydney). The demo environment is intended solely for testing and evaluating the platform by researchers. It must not be used to collect data from real research participants. The demo environment is a shared, multi-tenant environment; the per-Customer instance-isolation commitments described elsewhere in this Privacy Policy apply only to paid subscription servers. Any data entered into the demo environment, including researcher account information, is stored in Australia. EU/EEA researchers should be aware of this before registering for a demo account. The Standard Contractual Clauses in the EU Data Processing Agreement govern any transfer of EU personal data to the Australian demo server. The demo server is provided on a best-efforts basis only and may be suspended, reset, or permanently deleted at any time without prior notice. Selby Labs is not liable for any loss of data stored in the demo environment. You may request immediate deletion of your demo account and associated data at any time by contacting support@studyrun.org.
Where data is transferred outside Australia, Selby Labs takes reasonable steps to ensure the recipient handles the data in a manner consistent with the Australian Privacy Principles. The Data Processing Agreement that applies to your account depends on where your institution is based: the Australian DPA for Australian institutions, the EU DPA (with Standard Contractual Clauses) for institutions in the EU, EEA, or UK, and the International DPA for institutions anywhere else (including the United States, Canada, Brazil, Switzerland, and Asia-Pacific jurisdictions other than Australia). If your jurisdiction requires specific transfer safeguards (for example Switzerland's FADP, Quebec Law 25, or Brazil's LGPD), Selby Labs will execute the applicable model clauses as an appendix to the International DPA on request.
For EU/EEA customers, Selby Labs has appointed an EU Representative in accordance with Article 27 GDPR:
Chrysanthi Mella
PO Box 1049, Marathonas 19007, Greece
Email: eu-representative@studyrun.org
We implement appropriate technical and organisational security measures including:
We retain researcher account information for as long as your account is active and for a reasonable period thereafter for legal and business purposes, typically 7 years for financial records.
Research participant data is retained for the duration of your subscription. You may export your data at any time through the platform. A countdown and export reminder are shown in the Platform dashboard throughout your subscription, with prominent notice as your subscription end date approaches. At subscription end you have a 7-day export grace period during which you retain read and export access to your server instance. At the end of that 7-day period your server is terminated, the primary database is deleted, and your Study Data is purged from backups on the next rotation of the 7-day backup cycle (no later than 14 days after subscription end). Written confirmation of deletion is provided on request.
Archival responsibility. The StudyRun Platform is not an archival service. Researchers are responsible for exporting and retaining their own copies of Study Data and consent records to meet institutional, regulatory, ethics-committee, funder, or professional-code retention requirements (including, where applicable, the Australian Code for the Responsible Conduct of Research, NHMRC guidelines, US HIPAA retention rules, or EU research-integrity codes). Selby Labs does not retain Study Data beyond the periods described above on any researcher's behalf.
Under the Australian Privacy Act 1988, you have the right to request access to and correction of the personal information we hold about you. To make a request, contact us at support@studyrun.org. We will respond within 30 days.
For customers in the EU/EEA, you also have rights under GDPR including rights of erasure, restriction, portability, and objection. Requests may be directed to our EU Representative (Chrysanthi Mella, eu-representative@studyrun.org) or to support@studyrun.org.
Where the collection of your personal information is based on your consent, you have the right to withdraw that consent at any time by contacting us at support@studyrun.org. However, withdrawal of consent will not affect the lawfulness of any processing that took place before you withdrew your consent.
If you are a study participant seeking to access, correct, or delete your data, please contact the research team that ran your study. They control that data, not Selby Labs. If you experience difficulties, you may also contact us at support@studyrun.org.
Selby Labs complies with the Notifiable Data Breaches scheme under the Australian Privacy Act 1988. If we become aware of a data breach affecting your Study Data, we will notify you without undue delay and in any event within 48 hours of becoming aware. This 48-hour commitment applies to all customers, to enable Australian customers to meet their obligations under the Notifiable Data Breaches scheme and EU/EEA/UK customers to meet the 72-hour notification obligation under Article 33 GDPR. Where the breach is notifiable under the Privacy Act 1988 and the Customer is unreachable, Selby Labs may also notify the Office of the Australian Information Commissioner and affected individuals directly to the extent required by law.
Selby Labs will contact you by email — at the address registered to your account, or for invoices at the billing email you nominate during the upgrade flow — only in the operational and legal-compliance circumstances listed below. These are transactional communications: they are necessary for the operation of your account, the security of your data, or compliance with our obligations under applicable law, and they cannot be unsubscribed from while your account remains active.
Selby Labs does not send commercial marketing electronic messages within the meaning of the Spam Act 2003 (Cth), the CAN-SPAM Act, or comparable laws in other jurisdictions. We do not maintain a mailing list, newsletter, or product-marketing programme; we will not contact you for promotional purposes; and we will not share your email address with any third party for marketing purposes. If we ever introduce optional product-update or research-community communications, they will be opt-in only, with a one-click unsubscribe mechanism, and announced at least 30 days in advance through the channels described above.
EU/EEA/UK data subjects may direct rights requests either to support@studyrun.org or to our EU Representative at eu-representative@studyrun.org. To verify your identity before we respond, we will normally rely on the email address registered to your account; where a request originates from a different address or from a research participant who is not a registered account holder, we may request additional identity verification before responding.
The StudyRun website uses minimal cookies necessary for the platform to function. We do not use advertising or tracking cookies. We may use aggregated, anonymised analytics to understand how the website is used.
We may update this Privacy Policy from time to time. We will notify active customers of material changes by email at least 30 days before they take effect. The current version is always available at studyrun.org/privacy.
Selby Labs Pty Ltd · ABN 50 697 107 083
Suite 329/98-100 Elizabeth Street, Melbourne VIC 3000
Email: support@studyrun.org
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.