How Ethos EM handles personal information

Information we collect

We collect information you provide when you create or maintain an account, submit work, participate in editorial correspondence, or contact the journal.

• Account information: name, email address, password authentication record, optional ORCID iD, credentials, affiliation, country, and profile details.
• Corresponding-author information: a private mailing address and contact information used for editorial administration.
• Submission information: manuscripts and other files, author and contributor details, declarations, suggested reviewers, metadata, revision history, and the final-confirmation record.
• Editorial information: communications, reviews, decisions, conflict disclosures, audit events, and records needed to administer the publication process.
• Technical information: security, access, and diagnostic data generated when the service is used, such as request time, browser or device information, and network address.

Do not upload consent forms, medical records, government identifiers, or other sensitive documents unless the editorial office specifically requests them through an appropriate secure channel.

How we use information

We use personal information to authenticate users; prefill and administer submissions; communicate with authors, reviewers, and editors; conduct editorial review; protect confidentiality and system security; investigate integrity concerns; maintain an accurate publication record; and comply with applicable obligations.

When a submitting author enters a co-author’s exact email address, the submission service may use a verified account match to fill publication-facing name, credentials, institution, department, country, and verified ORCID information. It does not disclose the matched account’s postal address, telephone number, security information, or other private contact details. Each named co-author receives an individual transactional message after submission and may use their own account to follow author-visible progress, correct article-specific details, provide a competing-interest declaration, or report an authorship concern.

Journal editors can use a private reviewer directory to find registered editors, reviewers, and people who voluntarily offer to review. It shows names, email addresses, credentials, review preferences, and counts of invitations sent and accepted within the last three months. You can change your availability and preferences in Account settings. Choosing “Not currently available” removes you from the directory without cancelling existing assignments or deleting the journal’s review history.

We do not sell personal information. We do not use author or reviewer information for targeted advertising, and the site does not carry third-party advertising.

Where information is processed

The public site and secure journal application are hosted on Vercel. Authentication, profiles, submissions, prepublication workflow records, and primary private file storage use Supabase. The secure Ethos EM application is the journal’s working prepublication record for submissions, reviewer activity, editorial decisions, and author revisions. The editorial office records corresponding actions in the Texas Digital Library’s Open Journal Systems service and verifies them against sealed sidecar records. Open Journal Systems supports production, publication, issue placement, and the public archive; a work is not published until its required reconciliation is complete.

The submission record transferred or reconciled to Open Journal Systems can include manuscript metadata and files; author names, email addresses, credentials, affiliations, countries, and ORCID iDs; declarations; and suggested-reviewer names, email addresses, affiliations, and expertise. The corresponding author’s mailing address and telephone number may be included in an editor-only OJS note for editorial administration. A reviewer identity record can include the reviewer’s sidecar identifier, confirmed email address, name, credentials, institution or affiliation, country, verified ORCID iD when present, and a linked Open Journal Systems identifier when one is known.

Uploaded files remain private while Ethos EM checks their size, format, integrity, and potentially active document content. These checks are tied to the exact file checksum and recorded in the submission audit trail. They do not constitute antivirus scanning or guarantee that a file is free of malware. Submitted file bytes are not sent to a third-party malware-screening provider.

After a submission or revision is finalized, submitted original files, confirmed combined PDFs, submitted revision files, and revision proofs are encrypted with AES-256-GCM before they are copied to a separate private recovery destination. Backup object paths do not contain contributor identities or manuscript filenames, and the encryption key is kept separately. A restore requires restricted operator access, a recorded purpose, an audit entry, and checksum verification.

If you choose ORCID, ORCID participates in the identity-linking or sign-in request. Resend delivers transactional account and journal email. It processes each recipient’s email address and the content needed for that message. A co-author or status notice may identify a submission by author name, title, category, reference, and author-visible stage. A reviewer invitation may include the submitted title and a screened abstract or work type, but not an author identity or manuscript file. A private alert to the editorial office may contain an author’s article-specific correction, competing-interest declaration, or authorship concern. Manuscript files and reviewer reports are not attached or supplied to Resend for this purpose.

These services may process information in the United States or in another location where the provider operates, subject to their agreements and safeguards. Access within the journal is limited according to editorial role and operational need.

Cookies and browser storage

Ethos EM uses essential authentication cookies to keep a signed-in session secure. A co-author invitation is held temporarily in the current tab's session storage after it is removed from the address bar. A valid invitation may also set a secure, browser-inaccessible resume cookie for no more than 24 hours so account confirmation or sign-in can continue in another tab; it is limited to the invitation service and cleared after the invitation is used or becomes unavailable. Draft content is saved to the authenticated account and is not kept in persistent browser storage. While a file is uploading, the current tab may retain limited resumable-upload information in session storage; it is cleared on sign-out and disappears when the tab closes.

We do not use advertising cookies. If audience measurement is introduced, this notice will identify the service and the information it collects before that use begins.

Sharing and disclosure

Submission information is shared only as needed with editors, editorial staff, reviewers, service providers, and other participants responsible for handling the work. A verified co-author account can see an author-safe status record for a manuscript on which that account was named, but cannot edit the submitting author’s draft, upload files, view reviewer identities or internal notes, or retrieve private corresponding-author contact details. Reviewers receive only the editor-approved protected materials authorized for their own accepted assignment. Reviewer identities are withheld from authors. Lead editors retain author identity access and prepare blinded materials for non-lead handling editors and reviewers. Other handling editors receive author identity access after a final acceptance or decline is released; reviewers are not automatically given that access. Recognition from the work or prior exposure may still occur. Patient, participant, and other private identifying information remains subject to the journal’s privacy and consent requirements.

We may disclose limited information when required by law, to protect a person or the service, to investigate suspected publication misconduct, or to consult an appropriate institution or authority about a serious integrity concern. We do not disclose more information than the purpose reasonably requires.

Retention and deletion

Account and draft information is retained while it is needed to provide the service and administer the account. Submission and editorial records are retained for the publication process, auditability, dispute resolution, research-integrity obligations, and the scholarly record. Published metadata, authorship, licenses, corrections, and retraction notices may need to remain available even if an account is later closed.

A withdrawal, rejection, or account-deletion request does not automatically erase the editorial audit record or information the journal must retain. Deleting an unfinished draft starts removal of its private files; submitted and published records remain subject to the journal’s scholarly-record and integrity obligations.

There is no single fixed retention period for every journal record. Encrypted recovery copies may remain after a primary file is removed and do not necessarily follow the same deletion schedule. When responding to a deletion request, the journal will explain what can be removed, what must be retained, and why. Ethos EM does not promise immediate deletion from backups or a service provider’s operational records.

Your choices and requests

You can update most profile information from the account page. You may ask to access, correct, export, or delete personal information by writing to the editorial office. We will verify the request and explain any information that must remain in an editorial or published record.

ORCID use is optional. You may use email and password authentication without linking an ORCID iD. Selecting an external link takes you to that service under its own privacy terms.

Security and incident response

We use access controls, private storage, encrypted network transport, role-based database rules, file-format and active-content checks, and encrypted off-project recovery copies to protect account and submission information. No online service can eliminate all risk. If we determine that an incident affects personal information, we will investigate, contain the issue, and provide notice when required.

Contact

Questions and privacy requests may be sent to editors@ethosemjournal.org or mailed to Ethos EM Editorial Office, Department of Emergency Medicine, 5323 Harry Hines Blvd, E4.300, Dallas, TX 75390-8579, United States.