Privacy Policy

Overview

This Privacy Policy describes how the University of Colorado Anschutz Medical Campus (“CU Anschutz,” “we,” “us,” or “our”) collects, uses, processes, stores, and shares information from participants in the CardioHeartConnect research program, including information collected through connected wearable devices such as Garmin smartwatches.

This policy applies to visitors to this webpage and to individuals enrolled as participants in the CardioHeartConnect study (COMIRB Protocol #24-0628). It supplements, and does not replace, the informed consent form each participant signs prior to enrollment. Where this policy and a participant’s signed consent form differ, the signed consent form governs that participant’s specific rights and disclosures.

Information We Collect

The study team may collect:

• Contact information — name, email address, and phone number, used to send you study communications and platform notifications.
• Health survey responses — your answers to study health surveys administered through the REDCap platform.
• Wearable device data — passively collected activity data from your Garmin smartwatch (see Garmin Data below).
• Module completion data — for participants enrolled in the CardioHeartConnect intervention group, records of which educational modules you have completed.
• Study identifiers — a study ID number used in place of your name in most study records.

Garmin Data

What Garmin data we collect

Through your Garmin smartwatch, connected via the Garmin Connect API, we collect the following passively generated data:

• Steps (daily activity/step count)
• Heart rate
• VO2Max
• Stress level
• Sleep score

This data is collected passively — it is not monitored in real time by the research team, and is not used to make any immediate clinical decisions about your care.

How we use Garmin data

Garmin data is used exclusively for research purposes related to the CardioHeartConnect study: to evaluate physical activity, heart rate patterns, and sleep as outcomes related to cardiac recovery following a TAVR (transcatheter aortic valve replacement) procedure. Garmin data is reviewed by the study research team on a periodic basis, not continuously, and is not used for any purpose outside the approved research protocol.

How we process and store Garmin data

Garmin data collected via the Garmin Connect API is received and processed by the CardioHeartConnect portal, the study’s platform for survey administration and smartwatch data collection, which is developed and maintained by the mHealth Impact Lab at the University of Colorado Anschutz Medical Campus. From there, study data, including Garmin-derived activity data, is transferred into REDCap, a secure, CU Anschutz–hosted data capture system used for research data management, for storage and analysis by the study team.

Access to identifiable Garmin data is limited to authorized CardioHeartConnect study personnel. Data stored in REDCap is protected in accordance with CU Anschutz data security standards and applicable federal and state law, including the Health Insurance Portability and Accountability Act (HIPAA).

Garmin data is not sold, and is not shared with any party for marketing, advertising, or commercial purposes.

How We Protect Your Information

CU Anschutz and the health systems it works with maintain administrative, technical, and physical safeguards designed to protect the confidentiality of your information, consistent with HIPAA and other applicable federal and state privacy laws.

Platform Security

The CardioHeartConnect platform runs on University of Colorado–managed servers located in university datacenters; study data is not stored on third-party commercial cloud infrastructure. All connections to the platform are encrypted in transit, and the databases, cache, and file storage holding study data sit on private, internally segmented networks that cannot be reached from the internet — the study application itself is the only system permitted to connect to them. Access is limited to authorized study personnel through University of Colorado single sign-on with role-based permissions, and Garmin access credentials are additionally encrypted at rest with a dedicated encryption key.

Your Choices

Participation in CardioHeartConnect, including the use of a Garmin smartwatch, is voluntary. You may withdraw from the study at any time without penalty or loss of benefits to which you are otherwise entitled. Withdrawing will not affect your medical care at UCHealth or the VA.

To withdraw, or with questions about your data, contact the study team at CardioHeartConnect@cuanschutz.edu or 303-724-6170.

If you have questions about your rights as a research participant, you may contact the Colorado Multiple Institutional Review Board (COMIRB) at 303-724-1055.

Contact Us