Health Data Consent
Effective: April 3, 2026
CanBeWell is a research application developed by Emory University that uses Fitbit wearable health data to support cancer-related lifestyle intervention studies. Before connecting your Fitbit account, please review how your data will be accessed, used, and stored.
Data We Access
When you connect your Fitbit account, CanBeWell requests read-only access to the following health data through the Google Health API:
| Google Health Scope | Data Accessed |
|---|---|
googlehealth.activity_and_fitness.readonly |
Steps, calories burned, distance, and active minutes from your Fitbit device |
googlehealth.health_metrics_and_measurements.readonly |
Heart rate, body measurements, and other health metrics |
googlehealth.sleep.readonly |
Sleep duration, sleep stages, and sleep quality data |
googlehealth.profile.readonly |
Basic Fitbit profile information needed for data retrieval |
How Your Data Is Used
By connecting your Fitbit account, you consent to the following uses of your health data:
Data Storage
Your health data is stored securely in the following locations:
- Google Cloud Firestore — for real-time app functionality and data synchronization.
- Amazon Web Services (AWS) — for long-term research data storage and analysis.
All data is encrypted at rest and in transit using industry-standard protocols (HTTPS/TLS, AES-256). Access is restricted to authorized research personnel at Emory University.
Your Rights
- You may disconnect your Fitbit account at any time through the CanBeWell app, which will immediately stop future data collection.
- You may revoke Google Health API access at any time through your Google Account permissions.
- You may request deletion of your previously collected anonymized data by contacting the research team.
- You may withdraw from the study at any time without penalty.
What We Do NOT Do
- We do not sell, share, or distribute your health data to third parties for advertising or commercial purposes.
- We do not modify or write data to your Fitbit account.
- We do not access data beyond the specific scopes listed above.