Data Access and Privacy

Ours Privacy is built with privacy-forward principles, so your data is securely handled and configurable to meet your privacy requirements. You control what data is shared with each destination.

---

Key Privacy Features

Ours Privacy provides several privacy-focused features that help you handle data securely and support HIPAA programs:

1. Data Redaction and Hashing:
   • Configure each destination mapping to hash, redact, or omit the fields it receives.
2. Customizable Privacy Rules:
   • You can configure how data is handled for each destination, including which fields to redact, hash, or omit.
3. Exportable Mappings:
   • Export default or custom data mappings from the Destinations Data Mapper page. This allows you to share configurations with your team for review or compliance validation.
4. Access Transparency:
   • View and audit data being sent to destinations through the Recent Events Dashboard.
5. Signed Compliance Agreements:
   • Ours Privacy signs Business Associate Agreements (BAAs) with healthcare organizations.

---

Viewing and Configuring Data Access

Ours Privacy provides tools to review how your data is shared with destinations and customize it as needed.

Viewing Default Destination Mappers

To see how data is mapped and sent to destinations:

1. Go to the Destinations section in your dashboard.
2. Select a destination and navigate to the Mappings tab.
3. View the default mappings for each field, including any modifications (e.g., Hash, Redacted).

This view is useful for compliance teams to verify:

• Which data is shared: Ensure no unnecessary Personally Identifiable Information (PII) or Protected Health Information (PHI) is included.
• How data is handled: Confirm hashing or redaction rules for sensitive data.

Exporting Mappings

You can export your mappings (default or customized) directly from the Mappings tab for any destination:

1. Go to the Mappings tab in your destination configuration.
2. Click the Export button to download the mappings in a shareable format (e.g., CSV or JSON).
3. Share the exported file with your team or compliance department for review.

---

Privacy Configurations for Destinations

Each destination in Ours Privacy allows you to configure privacy settings for data properties. These settings include:

Hashing

• Transforms a value into a hash.
• Use it when a destination expects a hashed identifier, such as an email address or phone number.

Redaction

• Replaces sensitive data with "REDACTED", ensuring no sensitive information is shared with the destination.

Exclusion

• Omits specific fields entirely from being sent to destinations. Use the $ignore directive in the mapping configuration.

Custom Transformations

• Apply advanced rules to modify data before it’s sent. For example:
  • Extract only the domain from a URL (DomainOnly).
  • Remove URL parameters (FullUrl).

---

Accessing Data in Ours Privacy

Recent Events Dashboard

The Recent Events Dashboard provides a detailed view of every event tracked in Ours Privacy. You can inspect:

• Event properties.
• Visitor properties (hashed or redacted as configured).
• Destination-specific data.

Use this dashboard to:

• Debug data flows and mappings.
• Confirm privacy rules are applied correctly.
• Audit what data is being shared with destinations.

---

Compliance and Security

Ours Privacy protects your data with the following:

HIPAA Compliance

Ours Privacy offers signed BAAs for healthcare organizations. Configure and validate each destination mapping before data is dispatched.

Secure Data Storage

All data in Ours Privacy is encrypted at rest and in transit, ensuring it remains secure throughout its lifecycle.

---

Sensitive Data in URLs

The Web SDK captures current_url and referrer as standard event properties. You are responsible for ensuring authentication tokens, session identifiers, password reset codes, and other secrets are not placed in your URLs, including in query strings (?access_token=...) and hash fragments (#access_token=..., #/path?token=...), which OAuth and single-page-app routing commonly use.

If your application places sensitive values in URL query parameters or query-like hash fragments, the Web SDK accepts a url_query_params_blocklist option that strips configured parameter names from captured current_url and referrer values in both the query string and the hash fragment before events are sent. See url_query_params_blocklist in the Web SDK reference.

---

Best Practices for Privacy Management

1. Audit Destination Mappers:
   • Regularly review destination mappings to ensure sensitive data is handled appropriately.
2. Limit Sensitive Data:
   • Only send necessary data to destinations. Use $ignore or redaction where possible.
3. Use Hashing When Required:
   • Select Hash when a destination expects a hashed identifier.
4. Test Your Configuration:
   • Verify data privacy rules in the Recent Events Dashboard.
5. Share Mappings with Teams:
   • Export mappings and share them with your compliance team for validation.
6. Align with Compliance Teams:
   • Share the default mapper configuration with your compliance team for validation.

---

Next Steps

• Review your destination configurations in the Destinations Overview.
• Explore Data Mapping to customize property handling.
• Use the Recent Events Dashboard to audit your data flows.