On the whole, does this project take steps to ensure that it anticipates, prevents and does no harm by design?

Yes

Is there any additional information you would like to share about the mechanisms, processes or policies that this project uses to avoid doing harm by design?

openIMIS will retain any, including personal, data entered into the openIMIS demo server for a maximum period of one week.

Does this project collect or store personally identifiable information (PII) data and/or content?

Yes

If yes - please list the types of data and/or content collected and/or stored by the project:

• The openIMIS initiative as a ‘project’ only collects data through user approved sign-ups for our newsletter and our collaboration platform (Atlassian Confluence). The data collected through both the platforms are mainly email addresses and user provided names (could also be aliases). This data is not shared with any third parties and the data is collected using third party platforms (Atlassian for our collaboration platform and Mailchimp for the newsletter), and they are governed by the GDPR.
• The openIMIS product does have the functionality to collect various data of users, including names, date of birth, ID number, phone number and also a (limited) medical treatment history. However the product is not hosted by the initiative, and thus anyone wanting to implement it would need to ensure that the data protection regulations of the area of jurisdiction are met. For example, the Health Insurance Board of Nepal uses openIMIS to manage the National Health Insurance of the country – so they deploy openIMIS as their own system and ensure that data confidentiality and data privacy regulations from the Government of Nepal are met. That being said, openIMIS does offer various levels of data security functionality for the implementers of the tool to use – particularly centered around role based access (read only, write only, none, or both) to data within the openIMIS system. Additionally, the openIMIS initiative provides security guidance on deploying openIMIS: Infrastructure security - openIMIS - openIMIS Wiki (atlassian.net), and also a template to do security assessments of implementations: Security assessment template - openIMIS - openIMIS Wiki (atlassian.net)

If yes - does this project share this data and/or content with third parties?

No

Please describe the circumstances with which this project shares data and/or content with third parties. Please add links as relevant.

Not Applicable

If yes - does the project ensure the privacy, security and integrity of this data and/or content collection and has it taken steps to prevent adverse impacts resulting from its collection, storage and distribution.

Yes

If yes - please describe the steps, and include a link to the privacy policy and/or terms of service:

When you submit data using the Apps or the web interface, the data collected from you will be stored the Web-embed server. If collected via the app, they will be:
-stored on the IMIS folder in your root directory for the photos and connection tokens
- in the application database located in the application folder for the other information (not accessible for non-root user).

Those data are erased after synchronisation with the service of generation of an export archive (encrypted via password, stored in the IMIS folder). Sensitive information exchanged between your browser and our website is transmitted in encrypted form using Transport Layer Security (TLS)

Does this project collect, store or distribute content?

No

If yes - what kinds of content does this project, collect, store or distribute? (i.e. childrens books)

Not Applicable

If yes - does this project have policies that describe what is considered innappropriate content? (i.e. child sexual abuse materials)

Not Applicable

If yes - please link to the relevant policy/guidelines/documentation.

Not Applicable

If yes - does this project have policies and processes for detecting and moderating innappropriate/illegal content?

Not Applicable

If yes - please describe the policies and processes for detecting, reporting and removing innapropriate/illegal content (Please include the average response time for assessment and/or action. Link to any policies or descriptions of how inappropriate content is handled):

Not Applicable

Does this project facilitate interactions with or between users or contributors?

Yes

If yes - does the project take steps to address the safety and security of underage users?

Yes

If yes - please describe the steps this project takes to address risk or prevent access by underage users:

• As an open source community, the openIMIS initiative encourages interactions between various users and contributors within the initiative. In such interactions, the openIMIS community is guided by our Contributor Covenant Code of Conduct: Contributor Covenant Code of Conduct - openIMIS - Confluence (atlassian.net). The openIMIS coordination desk monitors the activities in the various forums and platforms, which can only be accessed after a registration and is committed to ensuring the safety and security of all our users and contributors.

If yes - does the project help users and contributors protect themselves against grief, abuse, and harassment?

Yes

If yes - please describe the steps taken to help users protect themselves.

• While there are no formal procedures in place, we believe in respectful, open communication between the community members and strive ensure this through constant engagement with the community.