Duke University is committed to fairly and appropriately managing and safeguarding the information collected, used and maintained in support of its academic, research and clinical missions and to transparency regarding our data management practices. Duke respects the integrity of all its stakeholders, including as represented by personally identifying information about each stakeholder, and takes seriously its responsibility to protect individuals’ privacy in balance with meeting its legal, policy and administrative obligations. We seek to minimize the information we collect, limit access to that information and apply appropriate security measures to protect against loss, improper modification or disclosure.
The Duke University Privacy Statement applies to activities conducted by Duke University and its direct affiliates and is intended to provide an overview of University privacy practices, including but not limited to categories of personal data processed, collection practices and transfer of personal data. [Some individual Duke websites may have their own privacy notices or additional privacy statements that supplement this Privacy Statement.] Additionally, some Duke websites may contain links to external websites not owned or controlled by Duke. Duke is not responsible for the privacy practices or content of such websites.
By using this website or submitting information to Duke, you are consenting to our collection and use of information in accordance with Duke policies for Duke’s legitimate business purposes or as needed to provide services you request from Duke. For more information on cookies and website analytics use on Duke websites, please see Duke’s Privacy Statement.
To Unsubscribe
Should you wish to unsubscribe from receiving emails from a particular Duke department or a Duke.edu domain, you may do so by unsubscribing through the unsubscribe feature included in specific emails, or by requesting this at privacy@duke.edu(link sends e-mail). Please note that Duke will not unsubscribe you from emails about your account or your transactions with us.
Contact Information
If you have questions about Duke’s privacy practices, please contact privacy@duke.edu (link sends e-mail).
If you are looking for information related to HIPAA (Health Insurance Portability and Accountability Act) or Protected Health Information (PHI) privacy issues, please contact the DUHS Compliance Office at 919-668-2573 or email MCAdmin Compliance: compliance@dm.duke.edu (link sends e-mail).
Privacy Statement - Updated May 24, 2023
This Privacy Statement describes how Duke University and its schools, centers, institutes, and other units and controlled affiliates (collectively, “we” or “Duke”) collect and process Personal Information that we gather in any hard copy or electronic manner that is owned and operated by, or in the possession or control of, Duke and that links to or references this Privacy Statement (collectively, the “Activities”).
Some individual Duke websites may have their own privacy notices or additional privacy statements that may supersede or supplement this Privacy Statement when appropriate.
Please read this Privacy Statement carefully. By engaging with our Activities, you consent to the information practices and other terms set forth in this Privacy Statement.
“Personal Information” means information that can be used to identify you as a person. We collect several categories of Personal Information through our Activities, including information you provide, information collected automatically, and information obtained from third-party sources. We generally use the Personal Information that we collect to operate the various functions of this institution and provide Activities that may be available to you.
We rely on separate and overlapping bases to collect and process your Personal Information lawfully as more fully described in the Privacy Statement sub-sections below.
The ways in which we collect and process your information vary depending on the relationship between you and Duke, as well as the specific Duke function with which you interact. The Privacy Statement sub-sections contained herein are intended to describe in more detail our collection and use practices for a number of these relationships and functions.
We process all Personal Information consistent with your rights, and in each case to the extent required by and in accordance with applicable law.
European Economic Area (EEA)-specific rights, or as otherwise deemed applicable by Duke
Upon request, if you are an individual located in the EEA, you have the right to:
- Access details of your Personal Information that we hold.
- Rectify any of your Personal Information that is inaccurate.
- Restrict or limit the ways in which we use your Personal Information.
- Object to the processing of your Personal Information.
- Request the deletion of your Personal Information.
- Obtain a copy of your Personal Information in an easily accessible format.
- Withdraw your consent to our collecting, using, and sharing your Personal Information.
Please note that, in certain cases, we may have a lawful basis to continue to process your Personal Information after you have withdrawn consent, including when necessary to protect your health and safety. In addition, withdrawing your consent will not affect the lawfulness of our collecting, using, and sharing of your Personal Information up to the point in time that you withdrew your consent.
To submit a request to exercise these or other rights, please contact us as set forth in the Contact Us section below. We will respond to your request within a reasonable time and in accordance with any deadlines imposed by law.
If you have any complaints regarding our privacy practices, we ask that you contact Duke Privacy, as set forth in the Contact Us section below. You also have the right to lodge a complaint with your national data protection authority (i.e., supervisory authority).
It is our policy that we do not intend to collect and we will not knowingly collect or solicit Personal Information online from children under the age of 13 or as defined by local legal requirements, except on Activities specifically directed to children. For those Activities, we follow applicable data protection laws with respect to children’s privacy, as set forth in the additional disclosures posted within the relevant Activity.
In addition to the uses described herein, including, but not limited to, under “Purposes of Processing” and “Information We Obtain from Third-Party Sources,” we may use your Personal Information for the following purposes in order to serve our legitimate interests, comply with legal obligations, perform a contract, or in some cases, in accordance with your consent.
Uses of Personal Information
- Conducting our operations, administering the Activities and managing your accounts;
- Contacting you to respond to your requests or inquiries;
- Processing and completing your transactions including, as applicable, course registration, order confirmation, enrollment in academic groups or other programs, processing payments for online purchases and course registration, and delivering products or Activities;
- Providing you with newsletters, articles, service alerts or announcements, event invitations, and other information that we believe may be of interest to you;
- Providing you with promotional information, offers, and other information that are personally tailored to your interests;
- Conducting market research, surveys, and similar inquiries to help us understand trends and needs of our users;
- Providing for your health, safety, and security;
- Preventing, investigating, or providing notice of fraud, unlawful or criminal activity, or unauthorized access to or use of Personal Information, our website or data systems; or to meet legal obligations;
- Enforcing our Terms of Use and other agreements; and
- Sending you text messages or push notifications when you sign up for one of our messaging programs. These messages may be sent by automated means. You may opt out of a text message program by contacting us.
Additional categories of personal information collected in our Activities and purposes of processing the information is available at “Additional Categories of Personal Information Collected”.
We rely on several legitimate interests in processing your Personal Information. These interests include:
- Improving and customizing the Activities for you
- Understanding how the Activities are being used
- Obtaining insights into usage patterns of the Activities
- Exploring ways to develop and grow our operations
- Ensuring the safety and security of the Activities
- Conducting research and improving understanding in fields of public interest and health
- Enhancing protection against fraud, spam, harassment, intellectual property infringement, crime and security risks
Duke collects Personal Information that you provide to us, such as when you enter information into form fields on our Activities. In addition, as is true of most digital platforms, Duke gathers certain of your information automatically through various Internet technologies when you use our Activities. Specific information collected through website use may include:
Device Information
We may collect information about the computer, mobile device, or other device you use to access Duke’s Activities, such as your computer’s unique IP address, geolocation information, unique device identifiers, browser type, browser language and other transactional information.
Cookies, Beacons, Pixels, Local Storage and Other Similar Technologies
Duke uses “cookies,” Web beacons, HTML5 local storage, and other similar technologies. These technologies allow us to manage access to and use of our Activities, recognize users and provide personalization, track user interactions of our Activities, and help us to understand how users engage with Duke Activities. You will not be able to access certain areas of our websites if your computer does not accept cookies from us. We do not respond to browser-based “do not track” signals.
Analytics Technologies
We use a third-party service such as Google Analytics to provide us information, reports, and analysis about the usage and user browsing patterns on our web pages. Google Analytics tracks and analyzes non-personally identifiable usage and volume statistical information from our visitors and customers on our websites. All data collected by Google Analytics on our behalf is owned and used by us.
Location Information
If you enable the location-based feature on our Activities, your current location will be stored locally on your device, which will then be used by the application. If you elect to have a location-based search saved to your history, we will store that information on our servers.
Email Tracking Pixels
Certain Duke Activities may use a function in HTML emails to track which users open emails and which links they click.
Ads Within Our Applications
The ads you see may be targeted to you based on your current GPS location, proximity of your device to an active beacon or low-energy blue-tooth transmitter, your device’s IP address or ZIP code, and user-provided Personal Information and location data.
We may share your Personal Information, consistent with this Privacy Statement, within our family of schools, centers, institutes, and other Duke entities and affiliates, with service providers and partners, and to comply with the law, protect health and safety and enforce our legal rights. We share your Personal Information with third parties only in the ways described in this Privacy Statement.
Service Providers and Professional Advisors
We share your Personal Information with third-party service providers and professional advisors who complete transactions or perform or administer Activities on our behalf or for your benefit, such as:
- Educational Activities, including admissions, registration, evaluation, and alumni engagement
- Analytics and insights, including for marketing and research
- Employment Activities, including human resources
- Payment and donation processing
Partners
We may share your Personal Information with our partners for the purposes of administering programs and Activities, including but not limited to:
- Cross-registration for courses with other universities
- Study abroad at foreign universities
- Online education offerings through online platforms
- Joint research arrangements with sponsors, other hospitals and universities
- Events with clubs and special interest groups
Third-Party Mobile Application Providers
With your knowledge and consent, the Activities may gather and transfer your Personal Information, including location information, from and to other applications, functions and tools within your mobile device.
Social Media Platforms
We may also use Activities provided by third parties (such as social media platforms) to serve targeted ads to you on third-party platforms. We may do this by providing a hashed version of your Personal Information to the third party for matching purposes.
Legal Process, Safety and Terms Enforcement
We may disclose your Personal Information to legal or government regulatory authorities as required by applicable law. We may also disclose your Personal Information to third parties as required by applicable law including in connection with claims, disputes or litigation or if we determine its disclosure is necessary to protect the health, safety, and security of you or us, or to enforce our legal rights or contractual commitments that you have made.
We may collect certain Personal Information about you from third-party sources in order to administer our Activities. Third-party sources include partners and service providers, such as payment processors, application aggregators, analytics providers, third-party platforms through use of single sign-on, and other third-party sources such as credit reference agencies and public databases.
The Activities may include links to websites and digital Activities operated by third parties, as well as “like” buttons and widgets hosted by other companies, that allow us to better understand website usage and communicate information to our users across multiple online platforms. Duke is not responsible for the content, privacy policies or data practices of third parties that collect your information. We encourage you to review the privacy policies for those third parties to learn about their information practices.
Duke may transfer your Personal Information within our family of schools, centers, institutes, and other Duke entities and affiliates and/or to the third parties discussed above. In addition, your Personal Information may be transferred to, stored, and processed in a country other than the one in which it was collected, in which case, we rely on appropriate and reasonable safeguards to protect your information in accordance with applicable data protection laws.
If your Personal Information was collected or stored in another country, we may transfer your Personal Information outside of that country, and when we do so, we rely on appropriate or suitable safeguards recognized under data protection laws, including, but not limited to, adequacy decisions, standard contractual clauses, your consent, or by contract.
We will retain your Personal Information only for as long as is necessary for our purposes set out in this Privacy Statement, subject to certain rights you may have that are described in this Statement (see Your Rights below), unless a longer period is required under applicable law or is needed to resolve disputes or protect our legal rights.
This Privacy Statement is subject to occasional revision. If we make any material changes in the way we use your Personal Information, we will notify you by sending you an email to the last email address you provided to us and/or by prominently posting notice of the changes on the Activities and updating the effective date above.
Contact Us
If you have any questions, comments, requests or concerns about this Privacy statement or other privacy-related matters, you may contact us in the following ways:
Email: privacy@duke.edu
Phone: 919-684-2144
Address: Duke Privacy
Office of Audit, Risk & Compliance
Box 90436
705 Broad Street, Suite 210
Durham, NC 27708
For all inquiries related to the European Union General Data Protection Regulation (“GDPR”), you may direct these to the Duke University Data Protection at privacy@duke.edu.
Data Protection Officer: Leigh P. Goller, Chief Audit, Risk and Compliance Officer
You may also direct GDPR inquiries to Duke University’s Article 27 Representative:
Irene Lau, Executive Assistant
Duke Corporate Education Limited
165 Fleet Street
London EC4A2DY
United Kingdom
To exercise data subject privacy rights that may be available to you, please use this form. Instructions for submission are included on the form.
We and our vendors may collect the following Personal Information through your website use:
- Contact information
- Log files (including IP addresses, browser type, internet service provider, referring/exit pages, operating system, date/time stamp, and/or clickstream data)
- Location information (we may use your IP address to identify the general geographic area from which you are accessing duke.edu)
The purposes of processing by each category of Personal Information include to respond to requests for information, to maintain the security of our Activities, to conduct analytics to improve the Activities, and with our consent, if applicable.
Information collected by us, or on our behalf, during the admissions process and throughout any subsequent enrollment as a student at Duke is collected for the primary purpose of considering your application for admission to Duke, evaluating your eligibility for financial aid and, if you are admitted, facilitating your education. Aggregated data derived from this information may be utilized for statistical reporting. Personal Information collected for Admissions and Financial Aid includes:
- Contact Information
- Demographic Information
- Education, Testing, Personal, and Employment History
- Criminal Record
- Personal Financial Information
- Family Financial Information
The purposes of processing by each category of Personal Information include to respond to requests for information, communicate with you, and to evaluate your eligibility for admission and financial aid.
The primary way Duke collects and maintains Personal Information about alumni is when you provide it to us, for example, when you update your alumni profile, connect with us on social media, or register to attend alumni events. We may also collect Personal Information from publicly available sources or third-party sources that support Duke or with whom Duke engages.
The main purpose for Duke’s collection of alumni Personal Information is to connect you with Duke, other alumni, Duke students and potential students. Personal Information collected about alumni includes:
- Contact Information
- Demographic Information
- Employment Information
- Duke Affiliations
- Personal Information
- Family Information
The purposes of processing by each category of Personal Information include to respond to requests for information, communicate relevant information, and connect you with alumni and students.
Duke collects and maintains donor Personal Information to process donations and respond to comments and questions. We may also use donor information to keep you informed about Duke events and initiatives that may interest you.
The main way we collect donor Personal Information is when you provide it to us, for example, when you complete a donation form or request information regarding donations. We may also collect Personal Information from publicly available sources or third-party sources that support Duke or with whom Duke engages. Personal Information collected about donors include:
- Contact Information
- Donation Information
- Payment Information
The purposes of processing by each category of Personal Information include to communicate with and provide information to you regarding donations and to process and confirm your donations.
Duke collects your Personal Information when you apply for employment. Further Personal Information collection occurs at the commencement and throughout your employment at Duke.
Personal Information collected by Duke, or on our behalf, is collected for the primary purpose of providing employment or enabling authorized persons to utilize Duke’s Services and facilities. Personal Information collected by Human Resources includes:
- Contact Information
- Demographic Information
- Payment Information
- Tax Information
- Employment History
- Education History
- Criminal Records
- Background Records
The purposes of processing by each category of Personal Information include to provide you with employment-related notices, forms, and payments, and to evaluate your application for employment.
Duke collects your Personal Information when you apply for online education offerings. Further Personal Information collection occurs at the commencement of and throughout your online education interactions.
Personal Information collected by Duke, or on our behalf, is collected for the primary purpose of providing online education courses and, if applicable, evaluating qualification for online education certificates and credit. Personal Information collected through Online Education includes:
- Contact Information
- Payment Information
- Tax Information
- Employment History
- Education History
- Criminal Records
- Learner Interaction Data
- Course Assessment Data
- Log Files
- Location Information
- Biometric Data
The purposes of processing by each category of Personal Information include to communicate with you regarding your program, respond to requests, process payments, evaluate your application for online education, evaluate your success and engagement in Online Education, provide you with location-based services, and provide secure, remote online testing platforms.
Duke collects your Personal Information when you are involved in non-credit, executive education and personal enrichment courses offered in person and online by Duke and our affiliates. Further Personal Information collection occurs at enrollment and throughout your non-credit education interactions.
Personal Information collected by Duke and our affiliates, or on our behalf, is collected for the primary purpose of providing non-credit education and ongoing communication. Personal Information collected through Non-credit Education includes:
- Contact Information
- Education History
- Assignment and Testing History
- Disability Information
- Dietary Information
- Residential Information
- Personal History
- Employment History
- Personal Financial Information
- Family Financial Information
- Payment Information
- Location Information
- Biometric Data
The purposes of processing by each category of Personal Information include to respond to requests for information, provide academic guidance and experiences, evaluate your eligibility for financial aid and courses, and provide secure online testing platforms.
Duke researchers and affiliates may collect, use and share your Personal Information as part of a research study in which you have consented to participate as a research subject or researcher, or in which your existing personal data are used. Often, when personal data are collected for research purposes, you will be provided a consent and/or authorization form that explains the types of data collected and the purposes for which such data are processed and shared. In such case, the description of the collection and use of your Personal Information provided in the consent and/or authorization form will replace the information provided here.
Examples of data that may be collected for research purposes are listed below. These data categories are provided as examples only; not every research study will collect each of these categories of data. If you have questions about the processing of your data in connection with a research study, you should contact the Duke personnel who are conducting the research or the contact persons named in any informed consent form you signed when you joined the study. Examples of Personal Information collected through Research include:
- Contact Information
- Tax Information
- Family Information
- Employment History
- Education History
- Criminal Records
- Demographic Information
- Health Records
- Biometric Data
- Genetic Data
- Log Files
The purposes of processing by each category of Personal Information include to enroll you in a research study, conduct research, and maintain the security of our systems.
The information collected by us, or on our behalf, throughout your enrollment as a student at Duke is collected for the primary purpose of facilitating your education at Duke and providing the programs for which you are enrolled. Personal Information may also be utilized for quality improvement research and analysis to evaluate program utilization and performance to improve education quality. Personal Information collected as a result of your enrollment as a Student includes:
- Contact Information
- Demographic Information
- Education History
- Assignment and Testing History
- Health Records
- Disability Information
- Dietary Information
- Residential Information
- Personal History
- Employment History
- Criminal Record
- Personal Financial Information
- Family Financial Information
The purposes of processing by each category of Personal Information include to respond to requests for information, provide academic guidance, evaluate your eligibility as a student and for financial aid, and to provide a safe and secure experience as a student.
Duke Health and its affiliates may collect certain information to facilitate the process of your becoming a patient for treatment at Duke Health. When you first present for care at a Duke Health facility, you will generally be provided a separate notice of privacy practices that explains in more detail the types of data collected and the purposes for which such data are processed and shared by Duke Health. That notice will be controlling regarding the data collected during the course of your treatment at Duke Health. If you have additional questions about the processing of your data in connection with your becoming a patient at Duke Health, you should contact the Data Protection Officer using the contact methods provided below in the Contact Us section. Examples of Personal Information that may be collected as a Patient include:
- Contact Information
- Health Records
- Family Information
- Insurance History
- Demographic Information
- Financial Information
- Log Files
The purposes of processing by each category of Personal Information include to provide you with medical care, process insurance and payment, and communicate with you regarding your healthcare.
Duke University Press collects and maintains Personal Information about purchasers of items to facilitate purchases and respond to your comments and questions. We may also use your information to keep you informed about Duke University Press products that may interest you. Personal Information that may be collected as a Duke University Press Customer includes:
- Contact Information
- Payment Information
The purposes of processing by each category of Personal Information include to provide you with transaction information and to process your transactions.