JMIR Publications Combined Privacy & Cookie Policy

Effective Date Feb 04 2026

1. Introduction

We are JMIR Publications Inc (“JMIR Publications”, "JMIR," "we," "us"), a leading open-access publisher of digital health research. We are dedicated to protecting your personal information and will make every reasonable effort to handle collected information appropriately, in accordance with our standards for integrity and objectivity, and respect for your privacy.

This policy explains how JMIR and our third-party partners collect, use, share, and protect your personal information and describes your choices and rights regarding its use. It covers the types of personal information we collect, the purposes for which it is used, with whom it is shared, and how we use cookies and other tracking technologies on our websites, referred to as "Services." We endeavor to comply with all applicable laws and regulations, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the applicable provincial legislations, US privacy laws, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

Scope

This policy applies to the JMIR Publications Inc websites, domains, applications, services, and products.

This Policy does not apply to third-party applications, websites, products, services or platforms that may be accessed through (non-JMIR Publications Inc) links that we may provide to you. These sites are owned and operated independently from us, and they have their own separate privacy and data collection practices. Any Personal Data that you provide to these websites will be governed by the third-party’s own privacy policy. We cannot accept liability for the actions or policies of these independent sites, and we are not responsible for the content or privacy practices of such sites.

This Policy applies when you interact with us by doing any of the following:

• Make use of our application and services as an authorized user
• Visit any of our websites that link to this Privacy Statement
• Receive any communication from us including newsletters, emails , calls,  texts / SMS, and messages and content via social media and other online platforms

2. Information We Collect From You

In the course of your use of our Services, we obtain various types of information about you. We adopt a tiered data collection model, differentiating between anonymous visitors, registered users, and publishing-related roles, collecting only the data necessary for each specific purpose.

2.1. Direct Collection: Information you provide to us

This includes information voluntarily provided by users during account registration or while submitting a manuscript.

• Prior to Registration: Your email address if you provide it to us for updates or notifications.
• During Registration/Service Use: Information you provide when registering for services, including in connection with co-branded offers. This may include your name, company name, email address, phone number, billing address or credit card information, geographic location, and organization name.
• For Publishing Roles (Authors, Reviewers, Editors): To consider, process, and possibly publish your manuscript or to consider you as an editor or reviewer, we ask for: name, title, telephone number, email address, institution, department, and address. You may voluntarily provide additional information such as middle name, degree, preferred name, secondary phone number, fax number, position, ORCID iD, Web of Science ID, other platform IDs, state or province, and areas of interest or expertise. For corresponding authors, your ORCID iD is required to help identify you and connect your work to your ORCID record when an article is published.
• Public Comments: If you submit a public comment on our website, we ask for email, first name, and last name. Your display name, auto-generated to include your first initial, last name, and randomly selected number(s), will be made public along with your comment.
• Account Credentials: Username and password for sign-in and account administration.
• Payment Information: Billing address, phone number, credit card data or other payment information when purchasing products or services.
• Demographic Information: We may collect demographic information such as geographic location, age, gender, race, and ethnic origin for diversity, equity, and inclusion purposes and for analytic purposes. This is provided voluntarily, and we usually collect and use this information on an anonymized basis.
• Telephone Conversations: Your telephone conversations with us may be monitored and recorded for quality control, training, and protection.
• Conferences or Events: We may collect your name, email, address, and phone number at conferences or events.

2.2. Automated Collection: Technical Information & Tracking Technologies

When you visit or interact with the JMIR Services, we automatically collect data relating to your online activity on our websites. This technical information may include:

• Your IP address.
• Device type, name, and IDs.
• Date and time of your requests.
• Content of your requests.
• Browser type and version.
• Geographic location.
• Screen resolution.
• Operating system (including language settings).
• Pages you view.
• How you got to our Services and any links you click on to leave our Services.
• Metadata about your use and your contacts’ use of our Services and your emails you send (including clicks and opens).
• Your interactions with any static assets such as images, videos, or documents we offer.
• Issues you encounter requiring our support or assistance.
• Any device or other method of communication you use to interact with the Services.

We store this data we collect in a variety of places within our infrastructure, including system log files, back-end databases, and analytics systems.

What are Cookies and Other Tracking Technologies?

We and our third-party partners use cookies, web beacons, pixels, tags, scripts, and other similar technologies to collect information, distinguish you from other users, provide a good browsing experience, improve our site, analyze site usage, and deliver targeted advertising. A cookie is a small file of letters and numbers that are stored on your device (computer, tablet, or mobile phone) when you visit a website. We also use technologies that are similar to cookies, such as web beacons, pixels, tags, and scripts.

• Tags are small portions of code which we use on our websites to learn whether you have clicked on certain web content.
• Pixels are similar technologies used for purposes such as counting the number of views for published articles. Pixels are sent directly to our servers or to the third-party platform that provided the pixel. For the rest of this policy, "cookies" refers to both cookies and other tracking technologies.

Types of Cookies We Use

JMIR uses both first-party and third-party cookies.

• First-party cookies are served directly by us to your device.
• Third-party cookies are served by a third party on our behalf, such as analytics and advertising partners. Cookies can also be "persistent" or "session" based.
• Persistent cookies remain on your device after your browser is closed.
• Session cookies are deleted automatically once your browser is closed. JMIR uses both persistent and session cookies.

We categorize the cookies we use as follows, consistent with industry best practices:

• Strictly Necessary Functional Cookies: These cookies are essential for the operation of the JMIR websites and are necessary for us to operate certain features and maintain the security of our Services. Without these cookies, the Services may not function correctly.
• Preference Cookies: We use these  to help us remember the way you like to use our service.

Some cookies are used to personalize content and present you with a tailored experience. For example, location could be used to give you services and offers in your area.

• Optional Cookies for Performance and Analytics: These cookies analyze how the JMIR websites are accessed, used, or performing to improve your user experience and to maintain, operate, and continually improve the website. This includes collecting information about how visitors use our website, to compile reports and improve the website.
• Optional Cookies for Marketing: These cookies deliver contextual advertisements on the JMIR websites and other websites and help us and third parties serve you targeted advertisements based on your browsing history on our website and other websites, which may be tracked across different devices.

List of Cookies, Purpose, and Storage Periods

JMIR Publications aims to be transparent about the cookies used on its websites. Please visit the specific cookie policy for the website you are visiting for details about each cookie by following the link in the navigation or the url (the site/cookiepolicy) as an example: https://jmir.org/cookiepolicy 

 

2.3. Third-Party and Public Sourcing

• Social Media: Information from third-party social networking sites if you use your credentials to log into some of our Services (e.g., picture, name, email address to pre-populate sign-up forms). The information we access varies by social networking site and depends on your privacy settings.
• Other Public Sources: Information you consent to us receiving from third parties, or information that is publicly available, such as from academic databases, social media, and conference websites. JMIR may use this to identify potential authors, reviewers, and editors or to contact you about publishing with JMIR.
• Seminars or Partners: Information you provide to us at seminars or to our partners.
• Surveys: Information you provide to us in surveys.
• Account Information, Payment Data, and Financial Data from providers of technical, payment and delivery services.
• Device and Usage Data from third parties, including analytics providers such as Google.
• Contact information from another individual when they identify you as a co-author or reviewer.

If you provide us, or our service providers, with any Personal Data relating to other individuals, you represent that you have the authority to do so and acknowledge that it will be used in accordance with this Policy. If you believe that your Personal Data has been provided to us improperly, or to otherwise exercise your rights relating to your Personal Data, please contact us by using the information set out in the "Contact us" section below.

2.4 Karma Program Participation Data

When you voluntarily enroll in the JMIR Karma Program ("Program"), we collect data related to your peer review contributions. In the context of this Program we act as the Data Controller, determining the purpose and means of the processing. We partner with OpenLoyalty.io (Open Loyalty sp. z o.o.) who strictly act as a Data Processor on our behalf for this Program, processing data only according to our documented instructions and their obligations under our Data Processing Agreement (DPA). Enrollment in the Program occurs automatically upon your first qualifying activity, and participation acknowledges acceptance of the Terms of Use - Karma Reviewer Rewards and this Privacy Policy.

This data includes personal information generated by your engagement, such as:

• Karma Points and Credits: Records of points earned for completing a peer review. These may be redeemed toward eligible JMIR Publications Inc services as per the Terms of Use - Karma Reviewer Rewards.
• Activity and Performance Data: Detailed information regarding the qualifying actions you performed, including the type of activity, the date, and, for reviewers, the rating given to the review, subject to the Terms of Use - Karma Reviewer Rewards.
• Program Status: Your current balance of Karma Points and redeemable Karma Credits.
• Transaction History: Records detailing the accrual of Points and the redemption of Credits toward JMIR services.

3. How We Use Your Information

We have a legitimate interest in running a successful and efficient business and in providing you with Services and useful content. We use the information we collect, both on its own and combined with any other information we collect about you, for the following purposes:

• Service Delivery and Functioning: To ensure the proper functioning of our Services, to provide you with useful content, to facilitate your movement through our websites, and to identify you at sign-in. This includes processing, reviewing, communicating about, facilitating editorial review and peer review, for publishing, and facilitating payment of article publishing fees.
• Operational Efficiency & Improvement: To offer and improve our Services, to diagnose problems with our servers, to administer our websites, and for statistical analysis for website improvement and user behavior analysis for product and design decisions.
• Personalization: To assist us in offering you a personalized experience or otherwise tailoring our Services to you.
• Security & Compliance: In connection with our security and compliance programs, and to prevent fraud and other illegal activity, and for legal defense against potential liability claims, and to investigate and prevent security incidents.
• Communication: To communicate with you regarding your account, services, news, and developments.
• Marketing and Advertising:

1. To do a better job of advertising and marketing our Services.
2. To advertise and market third-party products and services (performed with your consent where required by applicable law).
3. To target prospective customers with our products or services (only performed with your permission where consent is required by applicable law).
4. This may involve displaying advertising tailored to your needs.
5. To send newsletters and alerts (with consent, or on an opt-out basis for existing subscribers where permitted).

• Peer Review System Improvement: To assist with improving the peer review system, editorial process, integrity investigations, and scientific communication, as part of JMIR's ongoing research program.
• Diversity, Equity, and Inclusion (DEI): If demographic information is provided, it is used for internal diversity tracking purposes, usually on an anonymized basis.
• Aggregated Data: We use information in aggregated and anonymized formats to produce reports on trends and statistics, such as mobile search trends, email open rates, and campaign best practices.
• Support: To provide you with requested information or technical support, and to address issues you encounter.
• Payment Facilitation: Payment information (including credit card data) will only be used to facilitate payment for our products and services.
• Authentication: To verify or authenticate your identity
• Access: Enable you to access JMIR’s services and set up accounts.
• Events: Organize events or register attendees and schedule meetings for events.

3.1. How We Use Your Information (Integration for Karma)

The information collected through your participation in the Karma Program is used for the following purposes, based on the legal grounds outlined in Section 4 (Legal Basis for Use of Your Information):

• Program Operation and Service Delivery: We use Karma Points/Credits data to administer the Program, calculate earned rewards, process the conversion of Points into Credits, and facilitate the redemption of Credits toward  toward eligible JMIR Publications Inc services as per the Terms of Use - Karma Reviewer Rewards. This includes enabling you to check your Karma balance and history on the JMIR platform.
• Recognition and Peer Review System Improvement: We process activity data, including reviewer performance ratings (where applicable), to evaluate and improve the peer review system, editorial process, and scientific communication, as part of JMIR's ongoing research program.
• Research Integrity and Auditing: Activity data, point accrual details, and reviewer ratings are processed to conduct regular internal audits and extraction of data trails to identify potential ethical misconduct, prevent fraud, and ensure alignment with publishing standards and integrity requirements.
• Operational Efficiency: We process Karma data to align with internal system improvements.

4. Legal Basis for Use of Your Information (for users in the EU/EEA and UK)

For users residing within the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases for processing your information via cookies and other means:

• JMIR’s Legitimate Interests (Art. 6 (1) (f) GDPR): We use strictly necessary cookies and process certain personal information based on our legitimate interests. This includes:

1. Enabling JMIR to provide our products and services to you, including website features.
2. Ensuring website security and preventing fraud and other illegal activity.
3. Gathering broad demographic information based on your IP address for anonymized, aggregated use to optimize our service and monitor the effectiveness of our cookie management.
4. Finding and contacting qualified reviewers to ensure the high level of articles published in JMIR journals.
5. Contacting authors and other academics to ensure they are aware when JMIR is calling for papers for relevant journals.
6. Ensuring compliance with publishing standards, ethical guidelines, and research integrity.
7. Marketing to individuals at businesses/corporate addresses and to our subscribers, market research, and business development.
8. For analytics, to gather metrics to better understand how users use the JMIR Sites, to evaluate and improve them.
9. To comply with legal obligations, as part of our general business operations, and for internal business administration.
10. If demographic information is collected in a non-anonymized format for diversity monitoring.

• Contractual Obligations (Art. 6 (1) (b) GDPR): For the performance of contractual obligations between you and JMIR. This also includes processing registration data for service performance, processing payments for orders, and managing manuscript submissions.
• Consent (Art. 6 (1) (a) GDPR): We place optional cookies (for functionality, performance and analytics, and marketing) and process personal information for marketing purposes based on your explicit consent. You may withdraw your consent at any time. For users in the EU: The US is assessed by the European Court of Justice as a country with an insufficient level of data protection. If you consent, you agree in accordance with Art. 49 (1) (a) (GDPR) that your data may be processed outside the EEA, including in the United States.
  
   

4.1 Legal Basis for Use of Your Information (for users in the EU/EEA and UK) (Integration for Karma)

For processing activities related to the Karma Program, we rely on the following legal bases:

• Contractual Obligations (Art. 6 (1) (b) GDPR): Processing Karma Points and Credits, and associated performance metrics, is necessary for the performance of contractual obligations arising from your enrollment in the Karma Program and acceptance of the Terms of Use - Karma Reviewer Rewards. This includes managing account functionality, validating eligibility for rewards, calculating redemption value against APFs or services, and transferring points.
• JMIR’s Legitimate Interests (Art. 6 (1) (f) GDPR): We process Karma data under our legitimate interests for several purposes:

1. Ensuring research integrity and preventing fraud or abuse within the Program.
2. Internal auditing and evaluation of the peer review system and operational effectiveness.
3. Internal business administration and streamlining processes with the new billing module and platforms like Orvium.

5. Sharing with Third Party Service Providers and Vendors

We share your personal information with third parties as reasonably necessary for the purposes described in this policy.

• Service Providers: We enter into contracts with carefully selected third parties to assist us in servicing you (e.g., customer service, fraud detection, advertising assets, IT and storage services) or in our marketing and advertising activities (e.g., analytic information, SEO services). Our contracts with such third parties prohibit them from using your personal information for any purpose beyond the purpose for which it was shared. These include editorial and production vendors, financial institutions, web and technical support providers, and third parties for syndication and preprints.
• Order Fulfillment: If you purchase a product or service from a third party through one of our brands, we will pass your personal information to that third party to fulfill your order.
• Published Content: If a paper is published or posted as a preprint, the following information appears as part of the paper and may be syndicated to third parties: author’s name, role, email address, affiliation, ORCID iD, any competing interests, and editor’s name,.
• Peer Review Data Handling:

1. We send the title, abstract, and author's name to potential external/volunteer editors and reviewers. If they agree, the full manuscript and revisions are shared.
2. Reviewer's name is disclosed only if they provide explicit consent as part of the published peer review history. To remove a name from peer review history after disclosure, contact privacy@jmir.org.
3. For reviewers who voluntarily provide a platform ID (such as an ORCID iD or Web Of Science ResearcherID) and participate in reviewer recognition, we share general information about your review with that platform (e.g., platform ID, year completed, type of review).

• Promotional Activities: Information about you, your manuscript, or other research content may be shared with journalists prior to publication for promotional purposes.
• Institutions or Consortia: To facilitate payment of publishing fees on the author’s behalf, or for contractual obligations between JMIR and institutions/consortia. Your name and contact details may be shared with an institution or funder with an open access agreement to verify coverage of article processing charges (APCs). Post-publication, data may be shared with your affiliated institution/funder to improve our open access program.
• Academic Research Groups: For improving or evaluating the peer review system, editorial process, scientific or research integrity investigations, and scientific communication.
• Integrity Investigations: Institutions, ethics committees, and other third parties as appropriate, where there are concerns about non-compliance with publishing standards/ethical guidelines, research integrity, or publication ethics.
• Feedback: Your name and email address provided when contacting us for support may be shared with 3rd party feedback solutions. This is so you can provide feedback about your support experience. You may choose to share additional information with such 3rd party solutions.
• Corporate Reorganizations: If we are involved in a merger, acquisition, or sale of assets, your information will be transferred as part of that transaction. We will notify you via email and/or prominent website notice.
• Authorized Users: All users authorized by you to have access to your account can view personal information stored in the account. A primary account holder can view personal information in subaccounts they have authorized.
• Legal Process: If legally required or if we have a good faith belief that disclosure is reasonably necessary, we may disclose personal information to courts, law enforcement, and other third parties (e.g., internet service providers) to conduct investigations, respond to subpoenas, bring legal action, prevent harm, or pursue relief when you or a third party may be violating our terms, causing harm, or violating applicable law. We will notify you if legally permitted when required to provide your data due to a subpoena.
• Non-Personal Information: We share non-personal information with certain third parties, including the media, industry observers, marketing and advertising partners, vendors, customers, potential customers, or partners (e.g., mobile search trends, email open rates, usage reports).
• No Sale or Leasing: Except as described in this policy, we will not sell or lease your personal information to any third party without your consent. We may disclose aggregate demographic and statistical information with our business partners; this information is not specific to the identification of you as an individual.
  
   

5.1 Sharing with Third Party Service Providers and Vendors (Integration for Karma)

In addition to the general third-party sharing noted in the policy (Section 5), Karma data may be shared:

• To operate our customer loyalty program and provide you with associated rewards, points, and benefits, we utilize a specialized third-party software platform. Open Loyalty is our data processor for managing this program.
• Academic Research Groups/Integrity Investigators: Aggregated, anonymized, or specific Karma data may be shared with academic research groups or institutions during integrity investigations or for the purpose of improving or evaluating the peer review system.

Subprocessors ( Integration for Karma)
As part of our Data Protection Agreement (DPA)  Open Loyalty will: 

1. Establish a written agreement with each Sub-processor that includes data protection obligations, ensuring that the level of protection for Personal Data is at least equivalent to the obligations stated in the DPA, as required by applicable Data Protection Laws and Regulations and in relation to the nature of the service provided by the Sub-processor; and 
2. Remain accountable for the Sub-processor’s compliance with the obligations outlined in the DPA, as well as for any actions or failures on the part of the Sub-processor that result in Open Loyalty breaching its obligations under this DPA.

6. How Long We Retain Your Information (Data Retention)

We retain your personal information for as long as necessary to provide services to you, to fulfill the transactions you have requested, and as otherwise necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and for archiving purposes.

• General Principle: Data is retained only for as long as needed for its intended purpose.
• Account Data: Registration data is generally kept until an account deletion request is made. If such a request is received, we will erase your data within 30 days. We may keep some information to recall your request not to be contacted in the future.
• Financial Data: We are required by statutory law to retain financial data related to transactions (including address, payment, and order information) for ten (10) years. After a certain period, processing of this data may be restricted to comply with statutory requirements.
• Published/Reviewed Content: If you are an author who submitted a manuscript, or an editor/reviewer, some of your personal data will be retained as necessary for JMIR to establish, exercise, or defend a legal claim; for archiving scientific research, peer review details, and correspondence about JMIR content; and for exercising the right of freedom of expression and information. This includes your name, institutional affiliation, title, and email address. If your article has been published or posted as a preprint, additional personal data such as author’s role, ORCID iD, Web of Science ID, other platform IDs, and any competing interests will be retained for archiving scientific research. Data shared with these third parties is no longer under JMIR control and subject to their own policies.
• Logged-in Session Data: Content and non email communications associated with submissions, reviews, or decisions are archived after a final decision 

6.1. How Long We Retain Your Information (Data Retention) (Integration for Karma)

We retain data associated with the Karma Reviewer Rewards Program for as long as your account remains active. If you stop using JMIR Publications Inc. services and wish to have this data removed, you may submit a deletion request to privacy@jmir.org . Please note that we may be required to retain certain information to comply with legal obligations or resolve disputes.

7. Protection of Personal Information (Security)

We use reasonable and appropriate physical, technical, and administrative safeguards to protect your information from unauthorized use, access, loss, misuse, alteration, or destruction. This includes password protection, firewalls, and other means. We require third-party service providers acting on our behalf to also provide appropriate security measures in accordance with industry standards. When we collect financial account information, such as credit card numbers, we protect its transmission through the use of encryption such as the Transport Layer Security (TLS) protocol.

However, transmissions over the internet, email, or text message are never entirely secure. While we do our best to protect your personal information, we cannot guarantee the security of your information transmitted through the Services or over email; any transmission is at your own risk.

7.1. Protection of Personal Information (Security) (Integration for Karma)

We ensure that Open Loyalty is bound by strict confidentiality and security measures, including a formal Data Processing Agreement. Open Loyalty is committed to maintaining security standards, including ISO 9001 and  27001 certification or similar successors, to protect your data for the duration of the agreement with JMIR Publications.

 

8. International Data Transfers

JMIR Publications is headquartered at 130 Queens Quay East, Unit 1100 Toronto, ON, M5A 0P6 Canada with personal information saved on private servers hosted in the U.S. and Canada. Your personal data may also be processed by staff operating outside the European Economic Area (EEA), such as in India and the U.S., who work for us or for one of our suppliers.

As such, JMIR and our service providers may transfer your personal information to, or access it in, jurisdictions that may not provide equivalent levels of data protection as your home jurisdiction. We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this policy and applicable law. When JMIR transfers information about individuals based in the EEA or UK outside of those countries, we will take appropriate measures to safeguard the transfer as required by applicable law, including by using European Commission-approved standard contractual data protection clauses (SCCs) or following an adequacy decision by the EU Commission and equivalent provisions under applicable UK law.

If you do not want your personal information transferred to the U.S. or other non-EEA countries, please do not submit any information to us or use our services.

8.1. International Data Transfers (Integration for Karma)
Open Loyalty may transfer and process Personal Data in the United States and other locations worldwide where Open Loyalty, its Affiliates, or its Sub-processors conduct data processing activities. Open Loyalty will always ensure that such transfers comply with the requirements of Data Protection Laws and Regulations and the Data Protection Agreement (DPA) between JMIR Publications Inc and Open Loyalty.

 

9. Your Rights

Depending on your geographical location and citizenship, your rights are subject to local data privacy regulations. 

These regulations may include:

• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the applicable provincial legislations
• Quebec Law 25
• the EU's General Data Protection Regulation (GDPR)
• Brazil’s Data Protection Legislation (LGPD)
• California's Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) and California Online Privacy Protection Act (CalOPPA)
• Colorado Privacy Act (CPA)
• Utah Consumer Privacy Act (UCPA)
• Connecticut Data Privacy Act (CTDPA)
• Virginia Consumer Data Protection Act (VCDPA)
• Texas Data Privacy and Security Act (TDPSA)
• Oregon Consumer Privacy Act (OCPA)
• Montana Consumer Data Privacy Act
• Delaware Personal Data Privacy Act
• Nebraska Data Privacy Law
• New Hampshire Data Privacy Act
• New Jersey Data Privacy Act
• Minnesota Consumer Data Privacy Act
• Maryland Online Consumer Protection Act
• South Africa’s Protection of Personal Information Act (POPIA)
• Switzerland's Federal Act on Data Protection (FADP)
• Saudi Arabia's Personal Data Protection Law (PDPL)

These rights may include:

• Right to Access (PIPEDA, GDPR Article 15, CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA, LGPD, POPIA)

You have the right to learn whether we are processing your Personal Data and to request a copy of the Personal Data we are processing about you.

• Right to Rectification (PIPEDA, GDPR Article 16, CPRA, CPA, VCDPA, CTDPA, LGPD, POPIA)

You have the right to have incomplete or inaccurate Personal Data that we process about you rectified.

• Right to be Forgotten (right to erasure) (GDPR Article 17, CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA, LGPD, POPIA)

You have the right to request that we delete Personal Data that we process about you, unless we need to retain such data in order to comply with a legal obligation or to establish, exercise or defend legal claims.

• Right to Restriction of Processing (GDPR Article 18, LGPD)

You have the right to restrict our processing of your Personal Data under certain circumstances. In this case, we will not process your Data for any purpose other than storing it.

• Right to Portability (PIPEDA, GDPR Article 20, LGPD)

You have the right to obtain Personal Data we hold about you, in a structured, electronic format, and to transmit such Personal Data to another data controller, where this is (a) Personal Data which you have provided to us, and (b) if we are processing that data on the basis of your consent or to perform a contract with you or the third party that subscribes to services.

• Right to Opt Out (CPRA, CPA, VCDPA, CTDPA, UCPA)

You have the right to opt out of the processing of your Personal Data for purposes of: (1) Targeted advertising; (2) The sale of Personal Data; and/or (3) Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. Under CPRA, you have the right to opt out of the sharing of your Personal Data to third parties and our use and disclosure of your Sensitive Personal Data to uses necessary to provide the products and services reasonably expected by you.

• Right to Objection (GDPR Article 21, LGPD, POPIA)

Where the legal justification for our processing of your Personal Data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have compelling legitimate grounds for processing which override your interests and rights, or if we need to continue to process the Personal Data for the establishment, exercise or defense of a legal claim.

• Nondiscrimination and nonretaliation (CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA)

You have the right not to be denied service or have an altered experience for exercising your rights.

• File an Appeal (CPA, VCDPA, CTDPA)

You have the right to file an appeal based on our response to you exercising any of these rights. In the event you disagree with how we resolved the appeal, you have the right to contact the attorney general located here:

If you are based in Colorado, please visit this website to file a complaint.

If you are based in Virginia, please visit this website to file a complaint.

If you are based in Connecticut, please visit this website to file a complaint.

• File a Complaint (GDPR Article 77, LGPD, POPIA) 

You also have the right to lodge a complaint before a supervisory data protection authority regarding our data processing.

1. For Europe, an up-to-date list of data protection authorities is available at https://edpb.europa.eu/about-edpb/board/members_en.
2. For the UK, the data protection authority is the UK Information Commissioner’s Office, available at https://ico.org.uk/.

Withdrawing Consent

If you have consented to our processing of your Personal Data, you have the right to withdraw your consent at any time, free of charge, such as where you wish to opt out from marketing messages that you receive from us. If you wish to withdraw your consent, please contact us using the information found at the bottom of this page.

How to Exercise Your Rights

You can make a request to exercise any of these rights in relation to your Personal Data by sending the request to our privacy team by using the contact information below.

For your own privacy and security, at our discretion, we may require you to prove your identity before providing the requested information.

10. How to Manage Cookies

You have control over the cookies and tracking technologies used on the JMIR websites.

10.1. Withdrawing Consent for Optional Cookies

If you do not wish to accept optional cookies in connection with your use of the JMIR websites or wish to withdraw your consent you may opt in or out of cookie use at any time. To alter the way in which we collect information from you, visit our Cookie Manager (the website/#manage_cookies) for example https://jmir.org/#manage_cookies  

10.2. Browser Settings

You can change your browser settings to stop accepting cookies or to prompt you before accepting cookies from websites you visit. You can delete cookies in your browser settings at any time. Please note that by not accepting strictly necessary cookies, some pages may not fully function, and you may not be able to access certain information or features on the JMIR websites.

10.3. Specific Third-Party Opt-Outs

You may also be able to opt-out of specific third-party analytics and advertising services:

• For information on how Google Analytics collects and processes data, visit www.google.com/policies/privacy/partners/. To opt-out of Google Analytics, visit Google’s "How you can control the information collected by Google on these sites and apps" article.
• For other third-party services that may use cookies for targeted advertising (e.g., Google Ads, Facebook Custom Audience), you may be able to opt-out through their respective platforms or privacy settings.

11. Sending You Email Communications

Except where prohibited by law, we may send you email communications regarding our business, products, or services in response to your use of the JMIR Sites.

• For UK and EEA recipients, our legal basis for sending email communications is our legitimate interests to run, grow, and develop our organization to expand the impact of science and medicine. These communications are sent on an opt-out basis to registered users who have not opted out.
• Where required by law, we process your personal information for marketing purposes based on your consent.
• You can opt out of receiving such communications at any time by using the unsubscribe link(s) in emails we send you or by emailing us at privacy@jmir.org.

12. Third-Party Websites and Social Media Plugins

Some of our Services provide links to other websites or include social media plugins (e.g., Facebook, X, LinkedIn, Bluesky). We are not responsible for the content and data collection practices of these third-party sites. You should review their privacy policies to learn how they collect and use personal information. Social media plugins enable direct communication between your device and the social media provider's servers, allowing the provider to collect information about your browsing activities on our website. This processing by third parties is typically based on their legitimate interest to improve their services. We do not control the extent of personal data collected by these providers, nor their processing purposes or retention periods.

13. Children’s Privacy

Our Services are not directed to persons under 18 years of age. We do not knowingly collect personal information from children under 18. If a parent or guardian becomes aware that their child has provided us with personal information without their consent, they should contact us. If we become aware that a child under 18 has provided us with personal information, we will delete such information from our files.

14. Changes to This Policy

JMIR may make changes to this policy from time to time. Changes will be posted on this page. Please visit this policy regularly to read the current version. If there are material changes to how we use your personal information through cookies, we will endeavor to provide you with reasonable notice of such changes, either by prominent notice on our websites or to your email address of record.

15. Contact Information

If you have any questions about this policy, or wish to exercise your rights, you may contact us at:

Email: privacy@jmir.org 

Mail:

JMIR Publications

Attn: Privacy Manager

130 Queens Quay East, Unit 1100

Toronto, ON, M5A 0P6 Canada

JMIR Publications Ltd. (Europe)

The Black Church, St Mary’s Place

Dublin 7, D07 P4AX Ireland

The information you provide when contacting us will be processed to handle your request and will be erased when your request is completed, or restricted in accordance with statutory retention requirements.