Privacy Statement


MIT has developed the Covid Pass application to assist members of the MIT community in complying with the policies and requirements pertaining to accessing the MIT campus during the COVID-19 pandemic. This Privacy Statement explains how MIT handles and uses the personal information we collect as part of MIT's Covid Pass application.i

What Personal Information we collect

We collect, use, store and transfer different kinds of personal information about you, which we have grouped together as follows:

  • Biographic information – name, date of birth, email address, MIT affiliation, Kerberos ID
  • Contact information – phone numbers and email addresses
  • Travel information – the location, method of transportation, and days traveled for all travel occurring outside of the Commonwealth of Massachusetts
  • Non-specific health information – daily attestation of systems commonly associated with a COVID-19-related illness; the presence of one or more medical condition known to increase the risk of infection, hospitalization and/or death from a COVID-19 infection.

How we collect personal information about you

We collect information, including Personal Information, directly from you when you register for access to campus; enter travel information; sign up for COVID-19 testing; and/or submit eligibility screening for the MIT COVID-19 Vaccination Program. We also collect information, including Personal Information, indirectly through electronic access to MIT Student Records and MIT Human Resources files.

How we use your personal information

We collect, use and process your personal information (1) to determine your eligibility for access to the MIT campus; (2) to schedule COVID-19 testing and report results to you; (3) to determine your eligibility and priority order to receive the COVID-19 vaccine; (4) to support MIT Medical’s health care operations; (5) to monitor public health within MIT and the greater MIT community; (6) to prevent the spread of COVID-19; and (7) in limited circumstances to conduct scientific research.

When we share your personal information

We will share information we collect (including Personal Information) with third parties (defined as any entity outside of MIT Medical and MIT) only as follows:

  • Testing information – As provided in the authorization for disclosure of protected health information, MIT may share your personal information, including full name, date of birth, mailing address, and email address. Apart from testing providers, your PHI is not shared with any other third party outside of MIT, but individual test results may be shared with Institute officials with a need to know to protect the health and safety of the MIT campus or to support members of the MIT community (including you) who may be affected by a positive COVID-19 test.
  • Travel information – Travel information is not shared outside of MIT. This information is shared only with MIT Housing staff and members of the COVID testing team in order to (1) suspend access to MIT buildings during reported travel dates and (2) review and report on campus density based upon presence on campus.
  • Vaccine Information – As required by law for reporting vaccination administration to federal, state and local public health officials and agencies, including specifically the Massachusetts Immunization Information System (MIIS). Please also see MIT Medical’s Notice of Privacy Practices. Vaccine information may also be shared for purposes of scientific research, provided however, that such information will only be shared in de-identified and/or aggregated form and at no time will any personally identifiable information you be shared.

How your information is stored and secured

MIT is committed to protecting the Personal Information in its possession or control. This is done through a variety of privacy and security policies, processes, and procedures, including administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Personal Information that it receives, maintains, or transmits. Nonetheless, no method of transmission over the Internet or method of electronic storage is 100% secure, and therefore we do not guarantee its absolute security.

How long we keep your personal information

  • Your Personal Information and records related to COVID-19 testing will be retained for a period of one (1) year following the expiration of the Commonwealth of Massachusetts Emergency Covid-19 Declaration.
  • Your Personal Information and records related to your travel will be retained for a period of one (1) year from the date of submission.
  • Your Personal Information and records related to your participation in MIT’s COVID-19 Vaccination Program will be retained in accordance with the Commonwealth of Massachusetts record retention schedule for immunization records.

Additional Information

We may change this Privacy Statement from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on our website or by contacting you directly.

This policy was last updated in February 2021.

iThe Privacy Statement is intended to cover MIT’s Covid Pass system. For additional privacy practices with respect to MIT’s COVID-19 Vaccination Program, please see MIT Medical’s Notice of Privacy Practices available here. This policy applies specifically to the vaccination program and is in addition to the privacy practices detailed in this Privacy Statement.