This Privacy Policy explains how BeatSUD Foundation ("BeatSUD," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information through the BeatSUD research study mobile application (the "App"). It applies to App users and prospective participants. It should be read with the IRB- or ethics-committee-approved informed consent form for the applicable study.

​​

1. Important distinction: privacy policy and informed consent

This policy provides general transparency about the App and its supporting systems. It is not informed consent to participate in research and does not replace the study's consent form. The informed consent form explains the particular study, research procedures, risks, benefits, choices, and participant rights. If the documents conflict on a research-specific issue, the IRB- or ethics-committee-approved participant materials control, subject to applicable law.

​

2. Who is responsible for the information

BeatSUD is responsible for the App and will act as a sponsor and/or organization responsible for personal information to the extent specified in the study documents and applicable law. Research sites, investigators, institutions, and service providers may have separate or shared responsibilities.

​

Study title and protocol number: A Double-blind, Pragmatic Randomized Controlled Clinical Trial of the Effects of Listening to Test vs CONtrol Music on Opioid UsE Disorder OutcomeS, Adjunctive to Conventional Treatment (TONES), No. 25-0201-v5.0

Sponsor/data controller or responsible organization: BeatSUD Foundation, Inc.

Privacy contact or privacy officer: privacy@beatsud.org

​​

3. Information we collect:

Account, identity, and contact information

• Mobile phone number used to create, locate, and secure your account and as an account-level unique identifier.

• Account identifiers, study participant code, authentication status, enrollment status, and account settings.

• Records showing that you reviewed and completed required account, consent, and study steps, including timestamps and the version of documents presented.

• Information you provide when contacting technical support or the study team.

​

Eligibility, questionnaire, and research information

• Screening and eligibility responses.

• Questionnaire responses and other study information described in the informed consent form, which may include sensitive health and substance-use information.

• Study assignments, participation status, reminders, completion status, and protocol-related records.

​

Music-listening metadata

The App records information about assigned music-listening activities, such as the session date and time, assigned or selected content, duration, progress, interruptions, and whether a session was completed. The App does not use the device microphone to record your voice, conversations, or ambient audio as part of the current study.

​

Device and technical information

• Device type, operating-system and App version, language, time zone, IP address, network and carrier information, and device or installation identifiers where enabled.

• Security, authentication, crash, diagnostic, audit, and activity logs needed to operate, troubleshoot, secure, and validate the App and study data.

​

The final production data inventory and App-store privacy disclosures must match the information actually collected by the App and its software development kits.

​

4. SMS and one-time passcodes

We use your mobile phone number to send one-time passcodes (OTPs) for account creation, identity verification, login, and multi-factor authentication. These messages are transactional security communications. BeatSUD will not use your phone number for advertising or marketing text messages and will not sell it.

​

Message frequency varies based on your login and verification activity. Message and data rates may apply. Mobile carriers are not responsible for delayed or undelivered messages. SMS is not available through every carrier or in every country. An SMS/OTP provider and participating carriers will process your phone number, message-routing information, delivery status, and limited technical records to deliver and protect the service.

 

You may stop authentication texts by using any supported opt-out method or by contacting the study team. Doing so may prevent account creation or App access. If your phone number changes or is reassigned, contact the study team promptly so the old number can be removed from active authentication use. Never send an OTP to the study team or another person.

​

5. Why we use the information

We use personal information to:

• create, identify, authenticate, and protect participant accounts;

• determine preliminary eligibility and administer the informed-consent and enrollment workflow;

• deliver music-listening sessions, questionnaires, reminders, and other study procedures;

• monitor participation, protocol adherence, data completeness, safety, and study quality;

• support participants and troubleshoot, secure, audit, and improve the reliability of the App;

• conduct the research described in the informed consent form and protocol;

• create coded research datasets and aggregated or de-identified analyses, reports, presentations, and publications; and

• meet ethical, scientific, contractual, financial, regulatory, record keeping, and legal obligations.

 

6. Consent and other legal grounds

The applicable basis for processing depends on the country, the responsible organization, and the activity. BeatSUD and participating institutions may rely on your research consent and privacy consent where required, performance of study-related arrangements, compliance with legal obligations, legitimate interests in secure and scientifically valid research operations, and legal provisions permitting scientific research with appropriate safeguards. Processing of sensitive health information requires an additional lawful condition where applicable.

​

Consent to receive OTP messages is limited to account and security functions and is not consent to marketing. Withdrawing from the study stops new research collection as described below, but it may not require deletion of data already collected where retention is necessary for research integrity or legal and ethical obligations.

​

7. Identifiers, coding, aggregation, and de-identification

A phone number is personal information and remains identifying while linked to an account. During study operations, BeatSUD or the study team will assign a participant or study code. Direct identifiers, including phone numbers, should be stored separately from the main research dataset where technically and operationally feasible, with access limited to authorized personnel who need them for account administration, participant contact, or approved re-identification.

 

Research analyses will use coded, aggregated, and/or de-identified information as appropriate. Coded or pseudonymized information is not necessarily anonymous if an authorized key can reconnect it to a participant. Information is de-identified only when identifiers and reasonably available links have been removed or altered so that the person is not reasonably identifiable under the applicable standard. BeatSUD will not attempt to re-identify properly de-identified data except as required to test or protect the effectiveness of de-identification safeguards and as permitted by law and the protocol.

​

8. When we disclose information

We may disclose information only as appropriate for the study and App operations, including to:

• authorized BeatSUD personnel, investigators, study staff, research sites, and participating institutions;

• cloud-hosting, database, app-development, SMS/OTP, technical-support, security, music-delivery, and other contracted providers;

• the reviewing IRB or ethics committee, research monitors, auditors, regulators, funders, or other oversight bodies when authorized or required;

• emergency services or appropriate persons when permitted or required to address a serious and imminent safety concern; and

• law-enforcement, courts, government authorities, or other parties when required by law or necessary to protect legal rights and security.

​

BeatSUD does not sell participant information or use it for targeted advertising. We do not disclose identifiable research information to advertisers or data brokers.

​

9. International access and transfers

Participants must be located in the United States. BeatSUD, participating research institutions, and providers may process information in the United States or other countries where they operate. 

​

Where required, BeatSUD and participating institutions will use an approved transfer mechanism and contractual, technical, and organizational safeguards. Country- or site-specific privacy notices or consent language may supplement this policy.

​

10. Retention

We keep identifiable account, consent, research, audit, and security records only as long as needed for the study and for scientific, ethical, contractual, regulatory, tax, security, and legal requirements. Different categories may have different retention periods. Direct identifiers should be deleted or separated when they are no longer needed, while coded or de-identified research data may be retained longer for verification, publication support, and approved future research.

​

11. Withdrawal and deletion requests

You may withdraw from the study by contacting the study team as explained in the informed consent form. After withdrawal, BeatSUD and the study team will stop collecting new research information through the App, except for limited information needed to document and administer the withdrawal, secure the systems, respond to safety concerns, or meet legal obligations.

 

Information collected before withdrawal may continue to be retained and used to preserve the integrity of the study and satisfy scientific, ethical, regulatory, and legal requirements. Information already included in aggregated analyses or properly de-identified generally cannot be linked back to you and removed. An account-deletion request will be honored to the extent legally and operationally permitted, but deleting the App from a device does not delete the account, withdraw you from the study, or erase study records.

​​

12. Future research

Coded or de-identified data may be retained for future research only as described in the informed consent form and approved by the appropriate IRB, ethics committee, or other oversight process. If the study offers an optional future-use choice, declining that choice will not affect participation in the primary study. BeatSUD will seek additional consent when required by the consent form or applicable law.

​

13. Your privacy rights

Depending on where you live and which organization controls your information, you may have rights to request access, correction, deletion, restriction, portability, or information about disclosures; to object to certain processing; or to withdraw consent. These rights may be limited where retaining or using information is necessary for scientific validity, participant safety, legal compliance, or properly safeguarded research. You may also have the right to complain to a privacy regulator.

​

Contact the privacy contact or study team listed below. We may need to verify your identity, and the responsible research institution may need to handle the request. BeatSUD will not retaliate against you for making a privacy request or complaint.

​

14. Security and incident response

BeatSUD uses administrative, technical, and physical safeguards designed for the sensitivity of the information, including access controls, authentication, encryption in transit and at rest where appropriate, logging, vendor oversight, secure development and change practices, backups, and incident-response procedures. No system can be guaranteed completely secure.

 

If a privacy or security incident occurs, BeatSUD and participating institutions will investigate and provide notifications to participants, regulators, IRBs or ethics committees, and other parties when required by applicable law or research obligations.

​

15. Adults only

The current study and App are intended only for adults age 18 or older. We do not knowingly enroll children or collect their study information through the App. Contact us if you believe a child has created an account.

​

16. Changes to this policy

We may update this policy as the App, study, providers, or legal requirements change. Material research-related changes will be reviewed by the IRB or ethics committee when required. We will provide notice in the App or through another appropriate method and obtain renewed consent when required. The effective date identifies the current version.

​

17. Contact information

Study-team contact: TONES@BeatSUD.org

Privacy contact or privacy officer: privacy@BeatSUD.org

Participant-rights/IRB contact:vclientcare@wcgclinical.com

​

BeatSUD Foundation
4030 Wake Forest Road, Suite 349
Raleigh, NC 27609
Email: info@BeatSUD.org

​

Effective date: 18 August 2026