Privacy Policy

Last Updated: 2026-06-30

1. Data Controller

Shimonoseki City University, Faculty of Nursing
Principal Investigator: Prof. Kohei KAJIWARA
Research Office (Contact: Eguchi)
Phone: 083-252-0289
Email: s-study@shimonoseki-cu.ac.jp

2. Ethics Approval

This study has been reviewed and approved by the Ethics Committee of Shimonoseki City University.
Approval No.: 2537-0319

3. Research Purpose

This preliminary study, titled "Usefulness of Biometric Data from Wearable Devices for Dementia Screening: A Preliminary Study" (the "Shimonoseki Study"), investigates the relationship between lifestyle factors measured by a wearable device (Fitbit) — including walking activity, physical activity, sleep, and circadian rhythms — and cognitive function in community residents. The aim is to explore the feasibility of novel screening indicators for early prediction and prevention of dementia, and to validate the measurement devices and system.

4. Data Collection Method and Frequency

Data is retrieved automatically once every morning by the university's research server via the Google Health API, covering the previous day's recorded data. Retrieval is performed server-side and does not require any action by the participant after the initial authorization. No data is collected in real time or during visits to this website. After the 14-day participation period ends, a research staff member will revoke the OAuth access grant for your Google account. Data collection ceases immediately upon revocation. To enable automatic server-side retrieval, the system stores an encrypted OAuth refresh token on the university's secure server. Participants complete the Google authorization screen once at the time of research registration, guided by a research staff member. After that, the server uses the stored refresh token to retrieve data automatically each day — no further action is required from the participant. The refresh token is retained until the end of the study period (May 31, 2027) or until the participant requests deletion — whichever comes first — and is then permanently deleted.

5. Personal Data Scope

The study accesses the following data via the OAuth scopes granted through Google Health at the time of registration:

OAuth Scope	Data Accessed	Purpose of Use
`openid`	Google-assigned unique user identifier (sub)	To link retrieved data to your participant record. No name, email address, or other Google profile data is retrieved.
`activity_and_fitness.readonly`	Step count, exercise sessions, distance, activity levels, sedentary time, total calories, activity calories, heart rate zone calories, altitude, floors, active zone minutes	To analyze the relationship between daily physical activity, walking speed, and activity stability with cognitive function. Prior research has shown that decreased walking speed and reduced physical activity are significantly associated with increased risk of dementia onset.
`sleep.readonly`	Sleep sessions (including sleep stages), daily sleep temperature deviation	To examine the relationship between sleep quality (efficiency, fragmentation, bedtime/wake time), circadian rhythms, and cognitive function. Evidence suggests that sleep fragmentation and circadian rhythm disruption begin in the pre-clinical stage of dementia, including Alzheimer's disease.
`health_metrics_and_measurements.readonly`	Heart rate, resting heart rate, heart rate variability, daily HRV, blood oxygen saturation (SpO2), daily SpO2, core body temperature, VO2 max, running VO2 max	To assess autonomic nervous system activity, physiological stress responses, and sleep stage quality in relation to cognitive function. Daily variations in HRV, skin temperature, and respiration rate serve as biomarkers for accurately capturing circadian rhythm disruption.
`ecg.readonly`	Electrocardiogram (ECG) readings	To assess cardiac electrical activity (heart rhythm) as an additional physiological indicator of autonomic nervous system function, complementing heart rate variability data in relation to cognitive function. ECG data are used solely for academic research purposes and are accessed only by research personnel authorized by the principal investigator. This system does not provide medical diagnosis or clinical interpretation of ECG data.

In addition to the data above, the following non-OAuth data is also collected directly from participants (by paper form, interview, or web questionnaire — not via the Google Health API) and processed for the same research purpose of examining the relationship between lifestyle and physiological factors and cognitive function:

Cognitive function test results (MMSE-J) — used as the reference measure of cognitive function against which the wearable-derived indicators are compared.
Web-based questionnaire responses — used to collect lifestyle and background information supplementary to the wearable sensor data.
Health checkup / specific health checkup blood test results — used to examine the relationship between physiological/blood markers and cognitive function alongside the wearable data.
Research-assigned participant identifier (Participant ID)
Study participation and withdrawal status

Fitbit/Google account credentials are never collected or stored.

6. Pseudonymization and Anonymization

Collected data are managed using pseudonymized participant IDs. Direct personal identifiers are not collected. For analysis and publication, data are aggregated and anonymized so individuals cannot be identified.

7. Data Storage and Security

System development and operation (including server maintenance) is commissioned to HarborGate AI Audit Inc., a venture company founded by Shimonoseki City University faculty members, under a system-use agreement with the university. HarborGate AI Audit Inc. acts solely as a data processor performing these tasks on the university's behalf and does not use participant data for any purpose of its own.

Data is stored across two systems:

The participant registration site, which handles Google OAuth authorization, runs on an external rental server independent from the university's on-campus infrastructure. OAuth access and refresh tokens are encrypted (AES-256-GCM) before being stored there, and records on this server are managed solely by participant ID — no name, address, or other directly identifying information is stored on it.
The data management server, located within a locked, camera-monitored room on the university campus and connected to a dedicated internal network segment, receives the encrypted tokens via a daily automated sync and stores the biometric data retrieved from the Google Health API for the duration of the study.

Access to both systems is restricted to authorized research personnel and to HarborGate AI Audit Inc. personnel performing contracted maintenance, via key-based authentication only. External transfer or removal of raw data outside these systems is prohibited.

8. Retention Period

Collected data will be retained for 10 years after study completion under the strict management of the principal investigator. After this period, all stored electronic data will be completely erased and destroyed. The study period runs from April 2026 to May 31, 2027.

9. Third-Party Disclosure

Personal data will not be shared with third parties for their own independent use. As described in Section 7, HarborGate AI Audit Inc. processes data solely as a system operator acting under contract on the university's behalf, and is not an independent recipient of the data. Only anonymized statistical results may be published in academic outputs.

10. Participant Rights

Participants have the right to:

Voluntary participation and withdrawal without penalty
Request deletion of their data
Request information about the study

11. Withdrawal Handling

Upon withdrawal, no further data will be collected. Previously collected data will as a rule be deleted from the research database within 30 days of identity verification and will not be used in any further analysis. However, deletion may not be technically or institutionally possible in the following cases:

Research results have already been published at academic conferences or in journals.
Data have been registered in UMIN-ICDS (a data-sharing system for research integrity) with all personal information completely excluded.

12. No Affiliation with Google or Fitbit

This research system is not affiliated with, endorsed by, or sponsored by Google or Fitbit.

13. Contact

For any questions about this study or data handling, please contact the research office.

Shimonoseki City University, Faculty of Nursing
Principal Investigator: Prof. Kohei KAJIWARA
Research Office (Contact: Eguchi)
Phone: 083-252-0289
Email: s-study@shimonoseki-cu.ac.jp