Privacy Notice

What this platform collects

Nothing on this platform is collected passively. Every item below is something you typed, checked, or confirmed.

• Account details. The email address and password you use to sign in, and whether that email address has been verified. Passwords are handled by the authentication service and are never visible to the investigators.
• The consent record. The full text of the consent document exactly as it was shown to you, the confirmations you checked, your typed signature, the date and time you signed, and the IP address and browser identification recorded at the moment of signing. That audit trail is what makes the consent record verifiable; it is never used to study you.
• Participant Background and Ministry Context Form. Your answers to the six sections of that form, including the administrative identification and contact details in Section 1.
• HSFRT Form A. Your written answers to the fifteen questions and three synthesis prompts.
• DDA completion. Your confirmation that you completed the Discipleship Dynamics Assessment, with the date. The DDA is administered outside this platform and this platform never receives, stores, or displays your DDA results.
• Ministry leader contact details. If you identified a ministry leader and gave permission for that person to be contacted, the name, email address, and any phone number you provided for them.
• HSFRT Form B. If your ministry leader participates, their answers about your formation, together with their role, how long they have known you, and how often they observe you.
• Operational records. A log of significant actions taken in the platform — a consent signed, a form submitted, an invitation sent — and delivery events for study email. These record that something happened and to which participant code. They never contain your answers.

How identifiers are kept apart from responses

Each participant is assigned a participant code. Identifying information — your name, email address, phone number, your ministry leader's name and contact details, and the consent record and signature — is stored in one place. Research responses are stored in another. The two are joined by the participant code, not by your name.

Your Background Form, Form A, DDA confirmation, and your ministry leader's Form B are linked to one another for analysis using that code. The list that maps codes back to names is held separately; reaching it inside the application requires a separate privilege held by the investigators, and every access to identifying information is written to an audit log.

Participant codes are assigned so that the code itself does not reveal which study group you are in.

This reduces how much can be learned from any single view of the data. It is not a guarantee of anonymity, and it is not presented as one.

Who can see what

• The investigators. Dr. Mike Cuckler and Juan S. Cruz can access the research records, including identifiable records where access is required to conduct the study.
• The Northplace Research Team. Members of the Northplace Research Team assisting with this study can access the research responses and study data. Their access is granted to named accounts, is limited to what the study requires, and every access to identifying information is written to an audit log.
• Authorized Southeastern University research-oversight personnel. They may access identifiable research records if access is required for oversight of the research.
• You. You can see your own account, your own consent record, your own Background Form and Form A, and — once your ministry leader submits it — the Form B written about you. You cannot see any other participant's materials.
• Your ministry leader. A ministry leader reaches this platform through a single-use link, not an account. Their access is limited to the consent document and the one Form B they are writing. They cannot see your Background Form, your Form A, your DDA confirmation, or anything belonging to any other participant.
• The research team does not provide your individual responses or reports to NSOM supervisors, SEU faculty, employers, Resident Advisors, or other ministry leaders for evaluation purposes.

Platform administration

This platform is hosted on an account administered by Northplace Church. Two people hold administrative access to that account: the platform's developer and a pastoral oversight administrator. They hold it in order to build, maintain, and operate the platform.

That access is technical and operational. Administrators do not review participant responses, ministry leader assessments, or DDA information as part of that role. Research analysis is performed by the investigators and the Northplace Research Team.

Inside the application, reaching identifying information — names, email addresses, phone numbers, signatures — requires a separate privilege that is granted to specific accounts rather than to anyone who can administer the hosting account. Every access to identifying information is written to an audit log, which records who looked, at what, and when.

Service providers

Three third parties handle data on the investigators' instruction. Each handles it only to operate the service and is not permitted to use it for its own purposes.

Study email deliberately carries no research content. A message may tell you that something is ready, that an invitation was sent, or that a form is available, and it links you back here to sign in. It does not contain your answers, another participant's answers, or your participant code.

This platform loads no advertising, no analytics, and no third-party tracking of any kind.

• Lovable — application hosting. Runs the website itself and serves every page you see.
• Supabase — database, authentication, and backups. Stores the identifying information, the consent records, and the research responses, and handles sign-in and password storage.
• Resend — email delivery. Sends study email and reports whether a message was delivered, bounced, or was marked as spam. Study email carries no research content.

How long records are kept

Research records are retained for five (5) years after the study has been completed. At the end of the retention period, electronic research records are securely deleted and any paper research records are cross-shredded or otherwise securely destroyed.

Deletion at the end of that period is carried out deliberately by an investigator, and the platform records that it happened — how many records were removed from each table, and when. That record contains no research content.

Your choices

• You may skip any research question. No question in the Background Form, Form A, or Form B is required. Only the account fields, the consent confirmations, the attestation that you are 18 or older, and your signature must be completed.
• You may withdraw at any time, without penalty and without affecting your academic standing, residency status, ministry assignments, or employment. Contact either investigator to withdraw.
• You may ask what has been recorded about you and request a copy of your own materials.
• You may decline to identify a ministry leader, or identify one and withhold permission to contact them. Either choice is honored and no invitation is sent.
• A ministry leader may decline the invitation, and may stop at any point before submitting.

Reporting a security concern

If you believe you have found a vulnerability in this platform, or you have seen something that looks like a data exposure, please report it to security@hsfrt.com. Please include what you saw and how to reproduce it, and please do not attempt to access another person's records in order to demonstrate the issue.

Who to contact

• Dr. Mike Cuckler, DMin, DMiss — Faculty Principal Investigator/Advisor, Southeastern University — jmcuckler@seu.edu — (863) 667-5000
• Juan S. Cruz, M.A. — Student Investigator, Doctor of Ministry Student, Southeastern University — jscruz@seu.edu — (972) 495-1116
• Questions about your rights as a research participant, or a research-related concern: Southeastern University Institutional Review Board (IRB) — IRB@seu.edu