Commitment to Privacy
SUNY Upstate Medical University (Upstate) is committed to protecting your privacy and making it easier and more efficient for individuals and businesses to interact with Upstate. Upstate recognizes that individuals and businesses need to be confident that their privacy is protected when visiting Upstate's Web sites. Most Web sites can be visited without providing any information about your visit, however sometimes Upstate needs information to provide services requested. This policy explains Upstate's practices.
SUNY Upstate Medical University does not collect any personal information about a visit unless that information is provided voluntarily by sending an e-mail, responding to a survey, or completing an on-line transaction.
Information Collected Automatically When Visiting Upstate's Web Sites
Upstate is able to collect the following information:
- The Internet Protocol address of the computer that accessed Upstate's Web sites;
- The type of browser, its version and the operating system on which that browser is running;
- The Web page from which the user accessed the current Web page;
- The date and time of the user's request; and
- The pages that were visited and the amount of time spent at each page
Information Collected When E-mailing or Completing a Transaction
During a visit to Upstate's Web sites, there may be a need to send an e-mail to Upstate. The e-mail address and contents of a message will be collected. The information collected is not limited to text characters and may include audio, video, and graphic information formats included in the message. The e-mail address and the information included in a message may be used to respond to a request, to address issues identified, to improve Upstate's Web sites, or to forward a message to another department or State agency for appropriate action. An e-mail address is not collected for commercial purposes and Upstate is not authorized to sell or otherwise disclose e-mail addresses for commercial purposes.
During a visit to Upstate's Web sites a transaction may also be completed, such as a survey, registration, or order form. The information, including personal information, volunteered in completing a transaction is used to operate Institutional programs, which include the provision of goods, services, and information. The information collected may be disclosed by Upstate for those purposes that may be reasonably ascertained from the nature and terms of the transaction in which the information was submitted.
Upstate does not knowingly collect personal information from children or create profiles of children through Upstate's Web sites. Users are cautioned, however, that the collection of personal information submitted in an e-mail will be treated as though it was submitted by an adult, and may, unless exempted from access by Federal or State law, be subject to public access. Upstate strongly encourages parents and teachers to be involved in children's Internet activities and to provide guidance whenever children are asked to provide personal information on-line.
Information and Choice
As noted above, Upstate does not collect any personal information about you unless you provide that information voluntarily by sending an e-mail, responding to a survey, or completing an on-line form. You may choose not to send Upstate an e-mail, respond to a survey, or complete an on-line form. While your choice not to participate in these activities may limit your ability to receive specific services or products through this Web site, it will not normally have an impact on your ability to take advantage of other features of the Web site, including browsing or downloading information.
Disclosure of Information Collected Through This Web Site
The collection of information through Upstate's Web sites and the disclosure of that information are subject to the provisions of the New York State Internet Privacy and Security Act. Upstate will only collect personal information through Upstate's Web sites or disclose personal information collected through Upstate's Web sites if the user has consented to the collection or disclosure of such personal information. The voluntary disclosure of personal information to Upstate by the user, constitutes consent to the collection and disclosure of the information by Upstate for the purposes for which the user disclosed the information to Upstate.
However, Upstate may collect or disclose personal information without consent if the collection or disclosure is: (1) necessary to perform the statutory duties of Upstate, or necessary for Upstate to operate a program authorized by law, or authorized by state or federal statute or regulation; (2) made pursuant to a court order or by law; (3) for the purpose of validating the identity of the user; or (4) of information to be used solely for statistical purposes that is in a form that cannot be used to identify any particular person.
Further, the disclosure of information, including personal information, collected through Upstate's Web sites is subject to the provisions of the New York State Freedom of Information Law and the Personal Privacy Protection Law.
Upstate may disclose personal information to federal or state law enforcement authorities to enforce its rights against unauthorized access or attempted unauthorized access to Upstate's information technology assets.
Retention of Information Collected Through this Web Site
Access to and Correction of Personal Information Maintained by Upstate
Any user may submit a request to Upstate's Privacy Administrator to determine whether personal information pertaining to that user has been collected and maintained through Upstate's Web sites. Any such request shall be made in writing and must be accompanied by reasonable proof of identity of the user. Reasonable proof of identity may include verification of a signature, inclusion of an identifier requested or assigned by Upstate, or similar appropriate identification. The address of the Privacy Administrator is:
Upstate Medical University
750 East Adams Street
Syracuse, New York 13210
The Privacy Administrator shall, within five (5) business days of the receipt of a proper request, provide access to the personal information; deny access in writing, explaining the reasons therefore; or acknowledge the receipt of the request in writing, stating the approximate date when the request will be granted or denied, which date shall not be more than thirty (30) days from the date of the acknowledgment.
In the event that Upstate has collected and maintained personal information pertaining to a user through Upstate's Web sites, the information is to be provided to the user pursuant to the user's request. The Privacy Administrator shall inform the user of his or her right to request that the personal information be amended or corrected under the procedures set forth in section 95 of the Public Officers Law.
Confidentiality and Integrity of Personal Information Collected Through upstate.edu
Upstate is strongly committed to protecting personal information collected through Upstate's Web sites against unauthorized access, use, or disclosure. Consequently, Upstate limits employee access to personal information collected through Upstate's Web sites to only those employees who need access to the information in the performance of their official duties. Employees who have access to this information follow appropriate procedures in connection with any disclosures of personal information.
In addition, Upstate has implemented procedures to safeguard the integrity of its information technology assets, including, but not limited to, authentication, authorization, monitoring, auditing, and encryption. These security procedures have been integrated into the design, implementation, and day-to-day operations of Upstate's Web sites as part of Upstate's continuing commitment to the security of electronic content as well as the electronic transmission of information.
For Web site security purposes and to maintain the availability of Upstate's Web sites for all users, Upstate employs software to monitor traffic to identify unauthorized attempts to upload or change information or otherwise damage Upstate's Web sites.
Upstate Medical University
750 East Adams Street
Syracuse, New York 13210
Modifications to Upstate's Policy
Upstate Medical University will perform a review and revise this policy as necessary. users will be notified about significant changes to this policy by a prominent notice placed on Upstate's Web site regarding the changes and how they affect your privacy.
The following definitions apply to, and appear in italics, in this policy:
Personal information: For purposes of this policy, "personal information" means any information concerning a natural person which, because of name, number, symbol, mark, or other identifier, can be used to identify that natural person.
State agency Web Sites shall have the meaning set forth in subdivision 7 of section 202 of the New York State Technology Law
User shall have the meaning set forth in subdivision 8 of section 202 of the New York State Technology Law.