Privacy Policy & Informed Consent

1. Research Study Information

You are being invited to participate in a research study. Before you decide whether to participate, please read this information carefully. You may ask questions about anything you do not understand.

Purpose of the Study

This research aims to explore whether stress levels can be accurately estimated using only consumer smartwatch data (heart rate) compared to traditional Heart Rate Variability (HRV) analysis that requires medical-grade ECG equipment. Your participation will help validate whether affordable, accessible wearable technology can be used for reliable stress detection.

What Will You Be Asked To Do?

1. Complete stress-inducing cognitive tasks (games including mental arithmetic, pattern recognition, and time-pressure challenges)
2. Wear a smartwatch during the session to record your heart rate
3. Optionally wear ECG sensors for comparison data (ground truth validation)
4. Complete brief questionnaires about your stress perception

The session typically takes 15-30 minutes.

2. Introduction to Privacy Policy

This Privacy Policy explains how we collect, use, store, and protect your personal data when you participate in this research study. We are committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR - EU 2016/679), the Portuguese Law No. 58/2019 on Personal Data Protection, and other applicable data protection laws.

3. Data Controller & Data Protection Officer

The data controller responsible for your personal data is the University of Aveiro. The research is conducted through IEETA.

4. Data We Collect

We collect and process the following categories of personal data:

5. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

• Explicit Consent (Article 6(1)(a) and Article 9(2)(a)): You have given explicit consent for us to process your personal data, including health data, for the specific research purposes outlined in this policy.
• Scientific Research (Article 89): Processing is necessary for scientific research purposes conducted in the public interest, subject to appropriate safeguards including data minimization and, where possible, pseudonymization.
• Legitimate Interest (Article 6(1)(f)): Processing is necessary for our legitimate interests in advancing scientific knowledge, provided these interests are not overridden by your fundamental rights.

6. Purpose of Data Processing

Your personal data is collected and processed for the following purposes:

1. To conduct scientific research on stress detection using wearable technology
2. To correlate cognitive task performance with physiological stress markers
3. To compare smartwatch-derived stress indicators with ECG-based HRV (ground truth)
4. To develop and validate algorithms for non-invasive stress detection
5. To generate anonymized statistical reports and research findings
6. To publish research results in academic journals and conferences (anonymized data only)
7. To complete the Master's thesis at University of Aveiro
8. To respond to your inquiries and data subject requests

7. Data Storage and Security

7.1 Storage Locations

• Local Browser Storage: Game performance data is initially stored locally in your browser using localStorage. This data remains on your device until exported.
• Research Database: Exported data and smartwatch recordings are stored on secure University of Aveiro / IEETA servers with access restricted to the research team.
• Backup Storage: Encrypted backups may be stored on secure cloud services within the European Economic Area (EEA).

7.2 Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Pseudonymization: Your data is assigned a participant code; identifying information is stored separately
• Encryption: Data is encrypted in transit (HTTPS) and at rest (AES-256)
• Access Control: Only authorized research team members can access identifiable data
• Secure Facilities: Physical servers are located in secured University facilities
• Audit Logs: All data access is logged for accountability

7.3 Data Retention

Your data will be retained according to the following schedule:

• Identifiable Data: Retained for up to 2 years after study completion or thesis defense, whichever is later, to allow for verification and follow-up analysis.
• Pseudonymized Research Data: Retained for up to 10 years to comply with academic research integrity requirements and enable future meta-analyses.
• Anonymized Data: May be retained indefinitely for research purposes, as it can no longer be linked to you.
• Local Browser Data: Remains until you clear your browser storage; you control this data.

After the retention period, identifiable data will be securely deleted or fully anonymized.

8. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights:

How to Exercise Your Rights

• Access & Portability: Use the "Download JSON" or "Download CSV" buttons in the application, or contact us
• Local Data Erasure: Clear your browser's localStorage using browser settings
• Research Data Erasure: Contact us at osolovei@ua.pt with your participant code
• Other Requests: Contact us at osolovei@ua.pt

We will respond to your request within 30 days as required by GDPR.

9. Right to Withdraw from Research

Your participation in this research is entirely voluntary. You have the right to:

• Decline to participate without any negative consequences
• Stop participating at any time during a session (press ESC or the "Surrender" button)
• Withdraw your data after participation by contacting the research team
• Request deletion of all your identifiable data

10. Data Sharing and Transfers

Your data may be shared in the following circumstances:

• Research Team: Supervisors and collaborators at University of Aveiro / IEETA
• Academic Publication: Anonymized, aggregated results in thesis, journals, and conferences
• Research Collaboration: Anonymized datasets may be shared with other researchers upon request, following data sharing agreements

Your identifiable data will never be sold or shared with commercial entities. Any data transfer outside the European Economic Area (EEA) will only occur with appropriate safeguards as required by GDPR Chapter V.

11. Publication of Results

Research results may be published in academic journals, conference proceedings, and the Master's thesis. Published results will only contain:

• Anonymized, aggregated statistical data
• Graphs and visualizations that cannot identify individuals
• General findings and conclusions

Your name or any identifying information will never appear in publications.

12. Cookies and Local Storage

This application uses browser storage technologies:

• localStorage: Stores your test session logs and consent record persistently until you clear your browser data. This is essential for maintaining your test history and proving consent was given.
• sessionStorage: Temporarily stores your name and email during your browser session for convenience. This data is automatically cleared when you close your browser.

No third-party tracking cookies or analytics are used. The storage is purely functional and necessary for the application to work correctly.

13. Risks and Benefits

Potential Risks

• Mild Stress: The games are designed to induce temporary, mild stress. This is comparable to everyday stressors like deadlines or puzzles.
• Frustration: Some tasks may be challenging and could cause temporary frustration.
• Skin Irritation: Wearing sensors for extended periods may cause minor skin irritation (rare).

If you experience any discomfort, you may stop immediately. There are no penalties for stopping early.

Potential Benefits

• Direct Benefits: You may learn about your stress responses and cognitive performance.
• Societal Benefits: Your participation contributes to research that may lead to more accessible stress monitoring tools for everyone.

14. Participants Under 18

This study is intended for participants aged 16 and over. Participants aged 16-17 may participate with parental or guardian consent. We do not knowingly collect data from children under 16. If you believe a child under 16 has participated, please contact us immediately.

15. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Portuguese National Data Protection Commission:

16. Changes to This Policy

We may update this Privacy Policy if required by changes in legislation or research procedures. Any significant changes will be communicated to participants via email if possible. The current version will always be available at this page with an updated revision date.

17. Contact Us

If you have any questions about this study, your participation, or your data, please contact: