ACS NSQIP-IBD Collaborative — nsqipibd.org
Last updated: April 30, 2026
This page explains how the ACS NSQIP-IBD Collaborative website (nsqipibd.org) handles information, what the site is and is not, and what rights you have if you visit from the European Union or European Economic Area.
This site is intended for clinicians, researchers, surgical-quality program staff, and members of the Collaborative. It is publicly accessible, but the audience and tone are professional rather than patient-facing.
The Collaborative is co-led by the institutions and individuals listed below. For matters relating to this website and any communications channel routed through nsqipibd.org, both controllers may be contacted.
"Joint controllers" means the two institutions/persons named above jointly determine the purposes and means of any personal data processing performed via this website. The Collaborative itself is not a separate legal entity.
The content on this site — including data summaries, benchmarking visualizations, publications, and any communication generated through the site — is provided for research, professional education, and surgical quality improvement purposes only. It is not medical advice and is not a substitute for clinical judgment, patient evaluation, or treatment decisions made by a qualified clinician. No content on this site should be used to diagnose, treat, or manage an individual patient.
Portions of this website were created with the assistance of artificial intelligence, and any future communications routed through site addresses (e.g. ai@nsqipibd.org) may be drafted by AI before being reviewed and approved by a human administrator. AI output can contain errors, omissions, and outdated references. Always verify against primary sources before relying on any specific claim, statistic, or recommendation.
Information on this site is provided as is, without warranty of any kind, express or implied, including warranties of accuracy, completeness, fitness for a particular purpose, or non-infringement. Site availability, dashboard data, and any communication services may change or be discontinued at any time.
To the fullest extent permitted by law, the joint controllers, their institutions, and the Collaborative are not liable for any direct, indirect, incidental, consequential, or punitive damages arising from your use of this site, the dashboard, or any communication channel associated with nsqipibd.org.
This site is operated from the United States. Any dispute arising from use of the site is governed by the laws of the State of Ohio (where Cleveland Clinic Foundation is headquartered) for matters relating to site infrastructure, and by the laws of the State of California (where UC San Diego is located) for matters relating to Collaborative governance, in each case without regard to conflict-of-laws principles.
The public site at nsqipibd.org is built to minimize personal-data collection. Specifically:
The benchmarking dashboard at nsqip_ibd_benchmarking_dashboard.html is gated by a 6-character site access code distributed to participating Collaborative sites. The access code is verified entirely in your browser by comparing a hash of the code against a built-in lookup table. Your access code is not transmitted to any server, not stored, not logged, and not associated with any identifier on our side. Once unlocked, the dashboard reveals your site-specific view of de-identified, aggregated benchmarking data; no individual-patient data is shown anywhere on the site.
The site is hosted on Cloudflare Pages. Cloudflare retains short-term edge logs (request URL, IP address, user-agent) for security, fraud prevention, and platform reliability purposes. We do not query or analyze these logs except in response to a security incident. See Cloudflare's privacy policy for details.
members@nsqipibd.org, ai@nsqipibd.org, and info@nsqipibd.org. The system runs in admin-approval-required mode — every AI-drafted reply is queued for human review and explicit approval before any outbound message is sent.
The mailing list operates as follows:
nsqipibd-mail) located in the United States.nsqipibd.org. Inbound messages are scanned for common PHI patterns (names, dates of birth, MRNs, etc.); patterns identified are redacted before any content is shown to AI or human reviewers, and messages flagged as containing PHI are quarantined and may be deleted without reply.nsqipibd.org. PHI includes, but is not limited to, patient names, dates of birth, medical record numbers, addresses, phone numbers, and any combination of data points that could reasonably identify an individual patient. Messages flagged as containing PHI may be quarantined or deleted, and the sender may be removed from the mailing list.
If you need to discuss a specific patient case for educational or quality-improvement purposes, do so only through the appropriate institutional channels at your home site (HIPAA-compliant secure messaging, IRB-approved research communications, etc.). This site is not a HIPAA-covered communication channel.
If you reside in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) grants you the following rights regarding any personal data we hold about you (which, for visitors to the public site, will typically be none beyond short-term Cloudflare edge logs):
To exercise any of these rights, email the controllers above with the subject line "GDPR Request". We will respond within 30 days.
Our infrastructure (Cloudflare Pages, Cloudflare D1, transactional email) is operated from the United States. If you access this site or send mail to an nsqipibd.org address from the EU/EEA, your data will be transferred to the US. Cloudflare participates in the EU-US Data Privacy Framework and provides GDPR-aligned Standard Contractual Clauses as the transfer safeguard.
If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (GDPR Articles 33 and 34). If the breach is likely to result in a high risk, we will also notify affected individuals directly via the email address on file. The internal procedure backing this 72-hour commitment is documented in an incident-response runbook maintained by the joint controllers.
You may request deletion of any personal data we hold (mailing-list membership, message content, etc.) at any time:
Request Data DeletionWe will confirm receipt within 7 days and complete deletion within 30 days, per GDPR Article 17. Some data may be retained longer if required for legal compliance, audit, or to defend against legal claims, in which case we will explain the basis at the time of your request.
If you discover a vulnerability in this site or its infrastructure, please report it via our security.txt contact (sholubar@gmail.com). We do not threaten or pursue legal action against good-faith security researchers who follow coordinated disclosure norms.
For questions about these terms, GDPR requests, deletion requests, or any other privacy matter, contact either of the joint controllers above. For Collaborative governance and PI-level questions, route to Dr. Eisenstein. For website infrastructure, mailing-list operations, or hosting questions, route to Dr. Holubar.