Privacy Policy

The Stiff Person Syndrome Research Foundation ("The SPSRF," "we," "us," or "our") is a U.S.-based research nonprofit serving people affected by Stiff Person Syndrome (SPS) — patients, caregivers, clinicians, researchers, donors, and the broader SPS community. We know that many people who visit our website are dealing with a rare and difficult diagnosis, and we take the privacy of the information you share with us seriously.

This Privacy Policy explains what information we collect through www.stiffperson.org and related SPSRF forms and programs (together, the "Site"), how we use and share it, the choices available to you, and how to reach us with questions. It applies to the Site and to information you submit directly to SPSRF through it. It does not apply to third-party websites we link to, or to information you provide to unaffiliated organizations, even ones referenced on our Site.

By using the Site, you agree to the practices described in this Policy. If you do not agree, please do not use the Site or submit information to us.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you choose to give us, including:

Contact and general inquiries: your name, email address, phone number, and the content of your message when you contact us through a form or by email.
Newsletter and email sign-up: your name and email address.
Donations: your name, billing address, and payment information. Payment details are collected and processed by our payment processor; SPSRF does not store full card or bank account numbers on our own servers.
Patient story submissions: the story you share, your name or preferred attribution, contact information, and any photos you choose to include, submitted through our patient story form.
Physician directory listings: professional name, credentials, practice location, and contact information for clinicians who request or maintain a listing in our physician directory.
Event and symposium registration: your name, contact information, and organizational affiliation when you register for an SPSRF event.
Other voluntary submissions: information you provide through surveys, volunteer or partnership inquiries, or similar optional forms.

2.2 SPSD Global Patient Registry and Other Health-Related Information

The SPSD Global Patient Registry (the "Registry") invites people living with or caring for someone with SPS to voluntarily share health-related information — for example, diagnosis history, symptoms, treatments, and related test results — to help advance SPS research. Because this is more sensitive than ordinary contact information, we handle it with additional care:

Voluntary and consent-based: participation is entirely voluntary. We ask for your explicit consent before collecting health-related information, and you may withdraw at any time by contacting spsdglobalregistry@stiffperson.org.
Limited access: Registry information is accessible only to authorized SPSRF staff and vetted research partners who are bound by confidentiality obligations, and is used in de-identified or aggregate form for research purposes wherever possible.
Not for marketing: we do not use Registry health information for advertising or marketing purposes, and we do not sell it.
Not medical care: The SPSRF is not a healthcare provider. Registry participation does not create a doctor-patient relationship, is not a substitute for medical advice or care, and does not guarantee that you will be contacted by a researcher or enrolled in a clinical trial.

The SPSRF is not a HIPAA-covered entity or business associate, and this Registry is not a medical record.

2.3 Information Collected Automatically

Like most websites, our Site automatically collects certain information as you browse:

Log and usage data: IP address, browser and device type, pages viewed, referring and exit pages, and date and time of visit.
Cookies and similar technologies: see Section 3 below.
Analytics: aggregated usage statistics from our web analytics provider, which help us understand how the Site is used.

3. Cookies and Tracking Technologies

Cookies are small pieces of data that a website stores on your browser so it can recognize your device on a return visit. We use the following categories of cookies:

Essential cookies: required for the Site to function (e.g., completing a donation transaction or a form submission).
Analytics cookies: help us understand aggregate visitor behavior so we can improve the Site. These do not identify you individually.
Functional cookies: remember preferences to make your visit easier (e.g., a previously answered cookie banner).

You can control or delete cookies through your browser settings, and you can opt out of Google Analytics tracking using the Google Analytics opt-out browser add-on. Where required by law, we will also honor an opt-out preference signal (such as Global Privacy Control) as a valid CCPA opt-out request. Turning off cookies may affect how parts of the Site function, such as completing a donation.

4. How We Use Your Information

We use the information we collect to:

Operate, maintain, and improve the Site and respond to your questions or requests;
Process donations and send donation acknowledgments and tax receipts;
Send newsletters, program updates, and event information to people who have opted in, and let you opt out at any time;
Maintain and publish our physician directory;
Operate the SPS Global Patient Registry to support research, as described in Section 2.2;
Review and, with your consent, publish patient story submissions;
Maintain the security and integrity of the Site;
Comply with legal, financial, and regulatory obligations (e.g., nonprofit recordkeeping for donations).

5. How We Share Your Information

We do not sell your personal information for money. We share information only as follows:

Service providers: vendors who perform services on our behalf — for example, our donation processor, email platform, analytics provider, and website host — under obligations to protect your information and use it only to provide services to us.
Research collaborators: de-identified or aggregate Registry data may be shared with vetted research partners to advance SPS research. Identifiable Registry information is shared only where you have given separate, specific consent.
Legal and safety reasons: when we believe in good faith that disclosure is required by law (such as a subpoena or court order), or is necessary to protect the rights, property, or safety of SPSRF, our users, or the public.
Business transfers: if SPSRF is ever involved in a merger, reorganization, or similar transaction, information may be transferred as part of that transaction, subject to this Policy or a successor policy of which you will be notified.
Aggregate or de-identified data: we may share aggregate or de-identified information (for example, overall website traffic statistics) that does not identify you.

6. Your Privacy Choices and Rights

6.1 All Visitors

Email preferences: you can unsubscribe from our newsletter or marketing emails at any time using the link in any email, or by contacting us.
Access or correction: you can ask us to access, correct, or delete personal information we hold about you by contacting us (see Section 13).
Cookie controls: see Section 3 above.

6.2 California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you the following rights with respect to the personal information we collect about you:

Right to know: the categories and specific pieces of personal information we have collected, the categories of sources, our purposes for collecting it, and the categories of third parties with whom we share it.
Right to delete: request deletion of personal information we have collected from you, subject to certain legal exceptions (for example, information we must keep for tax or recordkeeping purposes).
Right to correct: request correction of inaccurate personal information.
Right to opt out of sale or sharing: we do not sell personal information for monetary consideration, and — as drafted — do not "share" it for cross-context behavioral advertising as defined by the CPRA.
Right to limit use of sensitive personal information: health-related information you share through the Registry is "sensitive personal information" under the CPRA. We use it only for the purposes described in Section 2.2 and do not use it to infer characteristics about you for marketing.
Right to non-discrimination: we will not discriminate against you for exercising any of these rights.
Right to appeal: if we deny a request, you may appeal by replying to our denial notice.

Categories of personal information we collect generally fall into: identifiers (name, email, IP address); commercial information (donation history); internet/network activity (Site usage data); professional information (physician directory listings); and, for Registry participants, health information. We collect this information directly from you and automatically through the Site, for the purposes described in Section 4.

To exercise these rights, contact us at info@stiffperson.org. We will need to verify your identity before responding, and will respond within 45 days as required by law (with a possible 45-day extension). You may also designate an authorized agent to submit a request on your behalf.

Separately, under California's "Shine the Light" law, SPSRF does not share your personal information with third parties for those third parties' own direct marketing purposes.

6.3 European Economic Area, UK, and Swiss Residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation ("GDPR") and equivalent UK/Swiss laws give you additional rights. For these purposes, The Stiff Person Syndrome Research Foundation is the data controller.

We process your personal information on the following legal bases, depending on context:

Consent: for Registry participation, newsletter sign-up, and patient story publication — which you may withdraw at any time.
Legitimate interests: for Site analytics, security, and improving our services, balanced against your rights.
Contract: to process a donation transaction you initiate.
Legal obligation: where processing is required by applicable law.

Subject to applicable conditions and exceptions, you have the right to:

Access the personal information we hold about you;
Request correction (rectification) of inaccurate information;
Request erasure of your information;
Request restriction of, or object to, our processing of your information;
Receive your information in a portable format;
Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
Lodge a complaint with your local data protection supervisory authority.

The Site is operated from the United States, so your information may be transferred to and processed in the United States. To exercise any of the rights above, contact us at the address in Section 13; we will respond within one month as required by GDPR.

7. How We Protect Your Information

Information security: we use encryption and other security safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or loss. Donation transactions are processed through an encrypted connection.
Practice review: we periodically review our data-handling practices for compliance with this Policy and applicable law.
Limited employee access: access to personal information is limited to staff and authorized processors who need it to do their work, and is governed by confidentiality obligations.
Breach notification: if we become aware of a security incident affecting your personal information, we will notify affected individuals and any required regulators in accordance with applicable law.

No method of transmission or storage is completely secure. Email you send us that is not through a secure form may not be encrypted in transit; please avoid sending sensitive information such as Social Security or full payment card numbers by ordinary email.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, or as required by law. Donation and financial records are retained in accordance with nonprofit recordkeeping and tax requirements. Registry information is retained in accordance with our research protocol and your consent, until you withdraw or as otherwise described at the point of collection.

9. Children's Privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent, consistent with the Children's Online Privacy Protection Act (COPPA). If we learn that we have inadvertently collected personal information from a child under 13, we will delete it. Parents or guardians who believe their child has provided us with personal information may contact us using the details in Section 13.

10. Third-Party Links and Resources

The Site may link to third-party resources — for example, clinical trial listings, physician practice websites, research partner sites, or social media pages. This Policy does not apply to those third-party sites, and we encourage you to review their privacy practices separately. Unaffiliated patient support groups or organizations we may mention are not part of The SPSRF, and their privacy practices are their own.

11. Use of Site Materials

Materials on the Site may be downloaded or printed for your personal, non-commercial use only, and may not be reproduced in edited form. Any other reproduction, distribution, transmission, or display of Site materials without our express written permission is prohibited. If you would like permission to reprint or reproduce material from the Site, please contact us.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. If we make a material change, we will provide notice on the Site. We encourage you to review this Policy periodically.

13. Contact Us

If you have questions about this Privacy Policy, would like to exercise a privacy right described above, or want to update or remove your information, please contact us:

Privacy questions and requests: info@stiffperson.org
SPS Global Patient Registry: spsglobalregistry@stiffperson.org
General inquiries: www.stiffperson.org
Mailing address: 8621 Burdette Road, Bethesda, MD 20817