SSA - 0920-XXXX_ 30-day_Traveler Risk Assessment & Management Gen-ICR_09.16.25
SSA - 0920-XXXX_ 30-day_Traveler Risk Assessment & Management Gen-ICR_09.16.25.docx
[NCZEID] Traveler Risk Assessment and Management Activities During Disease Outbreaks
OMB:
Traveler Risk Assessment and Management Activities During Disease Outbreaks
Request for OMB approval of a New Information Collection
August 26, 2025
Supporting Statement A
Contact:
Rudith Vice
National Center for Emerging and Zoonotic Infectious Diseases
Centers for Disease Control and Prevention
1600 Clifton Road, NE
Atlanta, Georgia 30333
Phone: (404) 718-7292
Email: nhr9@cdc.gov
Table of Contents
1. Circumstances Making the Collection of Information Necessary 3
2. Purpose and Use of Information Collection 5
3. Use of Improved Information Technology and Burden Reduction 6
4. Efforts to Identify Duplication and Use of Similar Information 7
5. Impact on Small Businesses or Other Small Entities 7
6. Consequences of Collecting the Information Less Frequently 7
7. Special Circumstances Relating to the Guidelines of 5 CFR 1320.5 7
8. Comments in Response to the Federal Register Notice and Efforts to Consult Outside the Agency 7
9. Explanation of Any Payment or Gift to Respondents 8
10. Protection of the Privacy and Confidentiality of Information Provided by Respondents 8
11. Institutional Review Board (IRB) and Justification for Sensitive Questions 9
12. Estimates of Annualized Burden Hours and Costs 9
13. Estimates of Other Total Annual Cost Burden to Respondents or Record Keepers 13
14. Annualized Cost to the Government 13
15. Explanation for Program Changes or Adjustments 14
16. Plans for Tabulation and Publication and Project Time Schedule 14
17. Reason(s) Display of OMB Expiration Date is Inappropriate 14
18. Exceptions to Certification for Paperwork Reduction Act Submissions 14
Goal of the study: The
purpose of this gen-ICR is to aid in CDC’s responsibility to
ensure the successful implementation of traveler management in an
efficient and timely manner during disease outbreaks. Intended use of the
resulting data: CDC intends use this gen-ICR in the event of a
disease outbreak that would necessitate the public health
assessment and/or monitoring of travelers arriving in the U.S. The
information collected will be used to inform CDC, other USG
agencies, and state/local/territorial health departments response
to disease outbreak necessitating a public health emergency
response.
Methods to be used to
collect: CDC will conduct public health entry screening and
risk assessment by asking travelers coming from outbreak areas a
series of questions. Entry screening and risk assessment may be
completed in person or virtually. Additionally, CDC will utilize
text messages and web surveys for traveler symptom monitoring.
State and local health officials will complete web surveys
developed by CDC. The subpopulation to be
studied: The respondent universe for this information
collection request is travelers coming from areas overseas affected
by disease outbreaks and health departments conducting traveler
follow-up and monitoring activities. How data will be analyzed:
No statistical methods will be used but CDC will report
aggregate totals of number of travelers screened, contacted, etc.
as appropriate.
The Centers for Disease Control and Prevention (CDC), National Center for Emerging and Zoonotic Infectious Diseases (NCEZID), Division of Global Migration Health (DGMH) requests approval for a 3-year period of a new Generic Information Collection Request (ICR) that will have the quick turn-around necessary for conducting traveler risk assessment and management activities in response to acute public health emergencies resulting from disease outbreaks in other countries with risk of case importation through international travel.
Section 361 of the Public Health Service (PHS) Act (42 USC 264) (Attachment A1) authorizes the Secretary of Health and Human Services to make and enforce regulations necessary to prevent the introduction, transmission, or spread of communicable diseases from foreign countries into and within the United States. Under its delegated authority, the Division of Global Migration Health (DGMH) works to fulfill this responsibility through a variety of activities, including the operation of port health stations at U.S. ports of entry and administration of foreign quarantine regulations; 42 Code of Federal Regulation part 71 (Attachment A2), specifically 42 CFR 71.20 Public health prevention measures to detect communicable disease.
Additionally, on February 21, 2020, CDC issued an interim final rule (IFR)1 to amend its Foreign Quarantine regulations, to enable CDC to require airlines to collect, and provide to CDC, certain data regarding passengers and crew arriving from foreign countries, for the purposes of health education, treatment, prophylaxis, or other appropriate public health interventions, including travel restrictions. CDC’s authority for collecting such data is contained in 42 CFR 71.4.
Under this IFR, airlines must transmit these data to CDC within 24 hours of an order. The order Requirement for Airlines and Operators to Collect and Transmit Designated Information for Passengers and Crew Arriving Into the United States; Requirement for Passengers to Provide Designated Information2 requiring the collection of this information was issued on October 25, 2021 and went into effect on November 8, 2021. Under this Order, airlines may transmit the required information using existing data-sharing infrastructure in place between the airlines and the U.S. Department of Homeland Security (DHS) or they must retain the information for 30 days and transmit it to CDC within 24 hours upon request. This information collection for contact information is already approved under OMB Control 0920-1354.
During a disease outbreak overseas with risk of case importation to the United States, CDC may screen airline passengers who have recently been in the outbreak area for signs, symptoms, or exposures to the outbreak disease. In such situations, CDC relies on its federal partners in the DHS to assist in the risk assessment and entry screening process because of their presence at the ports of entry. As needed, DHS will refer travelers into public health entry screening and risk assessment process. The public health entry screening typically consists of an initial health and exposure questionnaire to determine if a more in-depth public health risk assessment of a traveler is necessary. CDC develops the tools and training to facilitate this public health entry screening and works to ensure that any individual who is identified by DHS as being from the outbreak area is screened and further evaluated if compatible symptoms or potential exposures are identified. For those who are symptomatic or potentially exposed, additional public health measures may involve transport to a healthcare facility for medical evaluation if a traveler is identified as being ill; quarantine for those with high-risk exposures but with no evidence of illness or infection; and/or communication with CDC or health departments facilitate timely detection and management if potentially exposed travelers develop symptoms after arrival.
This information collection concerns CDC’s statutory and regulatory authority related to conducting public health screening of travelers upon arrival to the United States and assessing individual travelers for public health risk following a report of illness from a conveyance or other notification at a U.S. port of entry. As part of this responsibility, DGMH has implemented traveler management activities that collect contact information and share the information with health departments so that the travelers can be assessed for exposure risk, monitored for signs or symptoms of disease, and isolated and medically examined if needed. CDC anticipates the future need for these activities to prevent the introduction or spread of communicable diseases into the United States that threaten the public’s health.
Disease outbreaks do not occur at regular intervals, which makes it difficult to estimate how often information collection will be necessary. The purpose of this gen-ICR is to aid in CDC’s responsibility to ensure the successful implementation of public health entry screening, risk assessment, and traveler management in an efficient and timely manner during a disease outbreak.
DGMH intends use this gen-ICR in the event of a disease outbreak overseas that would necessitate the public health assessment and/or monitoring of travelers arriving in the U.S. Although it’s possible to anticipate some broad categories of information that would need to be collected, (e.g., potential exposures, symptoms, contact information, etc.), each response is unique and requires flexibility in terms of the specific information collection tool in each instance. Data collection instruments and methods must be rapidly created and implemented to direct appropriate public health action. Often specific questions will change, or new questions will evolve with each disease outbreak.
DGMH anticipates that this gen-ICR would encompass data collection related to:
Entry screening of travelers and (if indicated) public health risk assessment conducted either in person or virtually.
Post-arrival management of travelers as specified in CDC recommendations for travelers arriving from outbreak areas.
Health department of jurisdiction follow-up of indicated travelers.
Surveys of travelers to determine most efficient channels for reaching travelers and refine public health messaging for travelers coming from the outbreak area.
Evaluation of entry screening, post-arrival management, and health department follow-up.
DGMH has developed template forms (included with this submission) and anticipates template forms will meet most data collection needs during a disease outbreak. However, some modifications to template forms may be necessary depending on the outbreak. Template forms have been developed based on data collection instruments used during previous disease outbreaks that necessitated the public health assessment and/or monitoring of travelers arriving in the U.S. In the event of a disease outbreak, DGMH will submit a gen-IC for each outbreak and indicate any changes from template forms if necessary. Given the intent to utilize this information collection mechanism during a disease outbreak, DGMH anticipates that a fast turnaround (1-3 days) for approval of data collection instruments would be necessary.
To date, DGMH has created and submitted emergency packages during public health responses when data collection is necessary and needs to begin quickly. Since January 2020, DGMH submitted 17 full emergency packages. Through this gen-ICR encompassing traveler management activities, DGMH intends to create a framework for information collection from travelers during a disease outbreak which will allow DGMH to consolidate traveler management information collection activities under one package and streamline the review and approval process for these data collection instruments.
The purpose of this information collection is to determine the public health risk that travelers arriving in the U.S. from an outbreak area may pose and to improve the efficiency and effectiveness of CDC’s public health interventions. The information collected will be used to
determine if travelers have symptoms consistent with an outbreak disease and should be isolated and medically evaluated upon arrival in the US;
assist state and local health departments with understanding which travelers from the region may be at higher risk of becoming ill and should be prioritized for taking certain public health protection measures, such as quarantine;
conduct post-arrival symptom monitoring of travelers with certain exposure risks in accordance with CDC recommendations;
gather feedback from state and local health department partners on CDC’s recommendations and post-arrival management of travelers;
assess the quality of traveler contact information provided to health departments of jurisdiction for follow-up;
inform the development of future guidance and recommendations for post-arrival traveler management during disease outbreaks;
update public health messaging to more efficiently reach travelers and provide information about disease outbreaks;
and evaluate the effectiveness and efficiency of entry screening and post-arrival symptom monitoring and reduce burden for travelers where feasible.
CDC collects international travelers’ contact information under authorities in the Interim Final Rule: Control of Communicable Diseases: Foreign Quarantine and CDC’s Order: Requirement for Airlines and Operators to Collect and Transmit Designated Information for Passengers and Crew Arriving Into the United States; Requirement for Passengers to Provide Designated Information. Traveler contact information is typically sent to CDC though an existing data-sharing infrastructure in place between the United States Department of Homeland Security (DHS) and HHS/CDC and approved in OMB Control Number 0920-1354. Contact information for travelers who have been to an area affected by a disease outbreak during a specified time period prior to arrival in the U.S. will be confirmed at the port of entry. CDC will share traveler contact information for whom post-arrival monitoring is recommended with state and local health departments so that they can ensure public health follow-up is conducted, including but not limited to monitoring for disease symptoms, traveler education, and medical evaluation (if necessary).
Initial public health screening will consist of a script of questions that a CDC staff member will ask the traveler [CDC Initial Screening – SAMPLE VHF (Attachment C)]. If the traveler answers “Yes” to questions indicating they have symptoms or potential exposures, the traveler will undergo a more detailed public health risk assessment by CDC at the airport using the hard copy or an electronic version of the POE Public Health Risk Assessment Form - SAMPLE VHF (Attachment D).
When indicated, CDC may conduct symptom monitoring of travelers electronically. Consistent with CDC’s Order: Requirement for Airlines and Operators to Collect and Transmit Designated Information for Passengers and Crew Arriving Into the United States; Requirement for Passengers to Provide Designated Information3, airlines transmit traveler contact information to DHS. DHS then transmits traveler contact information to CDC using the existing data-sharing infrastructure in place between the agencies. CDC will then confirm traveler contact information during public health entry screening of travelers to ensure that a current working phone number is provided and the destination address is correctly listed.
Traveler phone numbers are then electronically uploaded to 1CDP (1 CDC Data Platform). 1CDP is a web-based data integration and management platform for use across CDC programs to collate, link, manage, analyze, visualize, and share data from multiple sources to inform public health responses. All 1CDP users must authenticate via CDC’s Digital Support Office – Secure Access Management System (SAMS). Text messages will be sent to travelers using a module within 1CDP. Depending on whether self-monitoring or intermittent monitoring by public health officials is recommended, travelers will receive either static (one-directional) health messages or interactive symptom monitoring messages (Attachment E1 & Attachment E2).
If travelers respond to text messages indicating they are experiencing symptoms, they will be directed to a webform where they will be asked for additional details regarding their symptoms (Attachment E3). This webform will be hosted on 1CDP. Travelers will be able to access the webform on mobile devices.
To obtain information on jurisdiction follow up of travelers, CDC will ask state and local health officials to submit data electronically twice weekly to CDC via REDCap4 or RREDI (both CDC-approved secure web applications). CDC has consulted with health departments to streamline and minimize the data collected to reduce burden to participating health departments.
Depending on the length of the outbreak, the use of information technology may be considered for other forms if a timely and accurate method of providing information to CDC can be identified and determined to be feasible and cost effective.
CDC has the regulatory authority for performing quarantine-related public health risk assessment and evaluation activities at U.S. ports of entry (42 Part 71). As a result, CDC is the only agency collecting illness or death reports or performing traveler assessments related to the introduction and transmission of communicable diseases at ports of entry. CDC works in collaboration with its international, federal, state, and local partners at ports of entry and through multi-state contact investigations to ensure all illness responses and public health follow-up and travel restrictions are done in a coordinated manner.
This data collection will not involve small businesses.
Failure to collect this information from travelers and health departments could lead to an increased risk of ill travelers coming in contact with the general public.
This request fully complies with the regulation 5 CFR 1320.5.
A. A 60-day Federal Register Notice was published in the Federal Register on June 16, 2025, vol. 90, No. 114, pp. 25302 (Attachment B). CDC did not receive public comments related to this notice.
B. CDC consulted on numerous occasions with state and local health departments on the development of information collection instruments and workflows and their feedback was incorporated.
No monetary incentives or gifts are provided to respondents.
This information collection request is being reviewed by the National Center for Emerging and Zoonotic Infectious Diseases and it has been determined that the Privacy Act does apply to some aspects of this information collection request (Attachment I). The applicable System of Records Notice is 09-20-0171, Quarantine- and Traveler-Related Activities, including Records for Contact Tracing Investigation and Notification under 42 CFR Parts 70 and 71 (Attachment J).
Information about travelers with illness investigations or public health risk assessments will be entered into a computer system for analysis and later retrieved if necessary. Data containing personal identifiers and source documents will be retained until the event prompting the collection of data has concluded in accordance with DGMH’s records retention schedule. Data not containing personal identifiers will be retained indefinitely for statistical and historical documentation purposes. Electronic media will be protected by adequate physical, administrative, and procedural safeguards to ensure the security of the data. Access will be restricted to agency employees with a bona fide “need to know” in order to carry out the duties of their positions or to accomplish the purposes for which the data were collected. When information is deleted, a special “certified” process will be used to completely overwrite tapes on the mainframe or overwriting (not merely deleting) microcomputer files. Source documents, printouts and thumb drives will be safeguarded by storing them in locked cabinets in locked offices when not in use.
Information collection tools in this request ask for personally identifiable information, to include name, contact information, and travel related information, to ensure accurate identification of travelers. The presence of symptoms is also collected to assist CDC in making a risk assessment and determine if further public health measures are needed. Individuals may make a request for their available information collected through a Privacy Act request (https://www.hhs.gov/foia/privacy/how-make-privacy-act-request.html).
Information is being collected that may have an impact on an individual if the information was disclosed. CDC will only share the information without the consent of the traveler as outlined in System of Records Notice is 09-20-0171, Quarantine- and Traveler-Related Activities, including Records for Contact Tracing Investigation and Notification under 42 CFR Parts 70 and 71. These purposes are primarily to ensure appropriate follow-up in the event medical care or additional public health response activities are necessary and recipients of the information will generally be public health departments and medical providers.
Data will be kept private to the extent allowed by law.
Institutional Review Board (IRB)
NCEZID’s Human Subjects Advisor has determined that information collection is not research involving human subjects (Attachment K). IRB approval is not required.
Justification for Sensitive Questions
No sensitive questions are included in this information collection.
A. Estimated Annualized Burden Hours
The total annual burden requested for this collection is 54,757 respondents (54,750 travelers arriving on commercial flights and 70 health departments) with approximately 10,559 burden hours.
This estimate is based on the following assumptions:
Based on previous viral hemorrhagic fever (VHF) out breaks, there have been a daily average of 150 international air passengers arriving in the U.S. daily from outbreak areas.
Using the daily average estimate, an annual estimate of 54,750 travelers from affected areas may be required to answer questions on the Initial Screening (Attachment C) about whether they are from a high-risk area or whether they have symptoms and may be asked additional travel and exposure questions info if they are not immediately referred for further evaluation. CDC estimates these questions will take approximately 5 minutes.
CDC anticipates approximately 4,563 hours of respondent burden will be incurred as a result of this portion of the entry risk assessment program.
CDC estimates approximately 10% of the travelers from affected areas (5,475) may be required to answer the more specific contact, travel history, and symptom questions on the POE Public Health Risk Assessment Form (Attachment D). Enhanced entry screening conducted in 2014 following an imported Ebola case in the U.S. indicated that 10% of travelers required further screening by CDC.5
CDC anticipates approximately 1,825 hours of respondent burden will be incurred as a result of this portion of the entry risk assessment program. CDC estimates these questions will take approximately 20 minutes.
CDC further estimates that approximately 10% of travelers with symptoms or high-risk exposures (548) will require daily symptom monitoring (Attachment E1). CDC estimates that responding to text messages will take approximately 1 minute.
CDC estimates completing the Web Survey for Symptomatic Travelers (Attachment E3) will take an additional 5 minutes.
CDC further estimates the remaining 90% of travelers with lower risk exposures (4,928) will require weekly symptom monitoring (Attachment E2). CDC estimates that responding to text messages will take approximately 1 minute.
CDC estimates completing the Web Survey for Symptomatic Travelers (Attachment E3) will take an additional 5 minutes.
After travelers have completed daily or weekly symptom monitoring, CDC will send an optional survey to assess how travelers received information about public health entry screening (Attachment F). A text message containing a link to the survey webform will be sent to approximately 5,475 travelers.
When indicated, CDC shares contact information and public health risk assessment of travelers with state/local health departments for additional follow up and public health monitoring.
An estimate of 1 staff member from 70 state and local health departments may be required to answer questions on the CDC SAMPLE VHF Jurisdiction Traveler Monitoring form (Attachment G) regarding traveler monitoring activities. State and local health departments will be asked to answer questions twice a week. CDC estimates these questions will take approximately 5 minutes.
An estimate of 1 staff member from 70 state and local health departments may be required to answer questions on the CDC SAMPLE VHF Jurisdiction Final Survey (Attachment H) regarding traveler monitoring activities. State and local health departments will be asked to answer questions once at the end of this response. CDC estimates these questions will take approximately 20 minutes.
Type of Respondents |
Form Name |
No. of Respondents |
No. of Responses per Respondent |
Average Burden per Response (in hours) |
Total Burden Hours |
Traveler |
CDC Initial Screening – SAMPLE VHF
(Attachment C) |
54,750 |
1 |
5/60 |
4,563 |
Traveler |
POE Public Health Risk Assessment Form - SAMPLE VHF
(Attachment D) |
5,475 |
1 |
20/60 |
1,825 |
Traveler |
SAMPLE VHF Symptom Monitoring Daily Group Symptomatic Travelers
(Attachment E1) |
548 |
21 |
1/60 |
192 |
Traveler |
SAMPLE VHF Symptom Monitoring Web Survey
(Attachment E3) |
548 |
21 |
5/60 |
958 |
Traveler |
Sample VHF Symptom Monitoring Weekly Group
(Attachment E2) |
4,928 |
3 |
1/60 |
246
|
Traveler |
SAMPLE VHF Symptom Monitoring Web Survey
(Attachment E3) |
4,928 |
3 |
5/60 |
1,232 |
Traveler |
SAMPLE VHF Response Survey of Travelers
(Attachment F) |
5,475 |
1 |
10/60 |
913 |
State/Local Health Department |
CDC SAMPLE VHF Jurisdiction Traveler Monitoring
(Attachment G) |
70 |
104 |
5/60 |
607 |
State/Local Health Department |
CDC SAMPLE VHF Jurisdiction Final Survey
(Attachment H) |
70 |
1 |
20/60 |
23 |
Total |
|
|
|
|
10,559 |
B. Estimated Annualized Burden Costs
There will be no anticipated costs to respondents other than time. Wages for travelers were gathered from BLS category 00-0000 “All Occupations” (http://www.bls.gov/oes/current/oes_nat.htm#00-0000). The estimated total cost is $332,395.
Respondent |
Information Collection Tool |
Total Burden Hours |
Hourly Wage Rate |
Total Respondent Costs |
Traveler |
CDC Initial Screening – SAMPLE VHF (Attachment C |
4,563 |
$31.48 |
$143,643 |
Traveler |
POE Public Health Risk Assessment Form - SAMPLE VHF (Attachment D) |
1,825 |
$31.48 |
$57,451 |
Traveler |
SAMPLE VHF Symptom Monitoring Daily Group Symptomatic Travelers (Attachment E1) |
192 |
$31.48 |
$6,044 |
Traveler |
SAMPLE VHF Symptom Monitoring Daily Group – Web Survey for Symptomatic Travelers (Attachment E3) |
958 |
$31.48 |
$30,157 |
Traveler |
Sample VHF Symptom Monitoring Weekly Group (Attachment E2) |
246
|
$31.48 |
$7,744 |
Traveler |
Sample VHF Symptom Monitoring Weekly Group - Web Survey for Symptomatic Travelers (Attachment E3) |
1,232 |
$31.48 |
$38,783 |
Traveler |
SAMPLE VHF Response Survey of Travelers (Attachment F) |
913 |
$31.48 |
$28,741 |
State/Local Health Department |
CDC SAMPLE VHF Jurisdiction Traveler Monitoring (Attachment G) |
607 |
$31.48 |
$19,108 |
State/Local Health Department |
CDC SAMPLE VHF Jurisdiction Final Survey (Attachment H) |
23 |
$31.48 |
$724 |
Total |
|
|
|
$332,395 |
There are no costs to respondents other than their time to participate.
The total estimated annual cost for these activities to the federal government is approximately $11,580,757.
The estimated cost of public health entry screening and risk assessment is $8,871,147 ($5,598,902 for CDC staff at three airports and $3,272,245 for supplies). This cost may change depending on the volume of travelers, location of CDC public health risk assessments, and volume of contact investigations initiated in response to confirmed cases.
The estimated annual cost to the federal government for daily/weekly symptom monitoring is approximately $1,469,000 for CDC staff to create, develop, and deliver a traveler symptom monitoring tool and send symptom monitoring notifications to travelers from outbreak affected areas. These costs reflect $1,400,000 for staffing and development resources and $69,000 for supplies. This cost may change depending on the volume of data submitted to CDC from state and local health departments.
The estimated annual cost to the federal government for health department reporting is approximately $1,240,610 for CDC staff to create and electronically distribute the traveler monitoring evaluation tool and perform analyses of the data. This cost may change depending on the volume of data submitted to CDC from state and local health departments.
This is a new information collection.
CDC may report aggregate numbers of travelers undergoing entry screening, referred for public health assessment, and contacted for monitoring.
CDC may publish lessons learned to inform future public health interventions and to contribute to the body of knowledge concerning public health monitoring and risk communication. No personally identifiable information will be published.
The display of the OMB Expiration date is not inappropriate.
There are no exceptions to the certification.
Attachments
Attachment A1 - 42 USC 264
Attachment A2 - 42 CFR part 71
Attachment B – Published 60-day FRN
Attachment C - CDC Initial Screening Form_SAMPLE VHF
Attachment D - POE Public Health Risk Assessment Form_SAMPLE VHF
Attachment E1 - SAMPLE VHF Symptom Monitoring Daily Group
Attachment E2 - SAMPLE VHF Symptom Monitoring Weekly Group
Attachment E3 - SAMPLE VHF Symptom Monitoring Web Survey
Attachment F - SAMPLE VHF Response Survey of Travelers
Attachment G - CDC SAMPLE VHF Jurisdiction Traveler Monitoring
Attachment H - CDC SAMPLE VHF Jurisdiction Final Survey
Attachment I - PHARS PIA
Attachment J - QARS SORN 09-20-0171
Attachment K – Non-research determination
1 https://www.federalregister.gov/documents/2020/02/12/2020-02731/control-of-communicable-diseases-foreign-quarantine
2 https://www.cdc.gov/port-health/legal-authorities/order-collect-contact-info.html?CDC_AAref_Val=https://www.cdc.gov/quarantine/order-collect-contact-info.html
3 https://www.cdc.gov/port-health/legal-authorities/order-collect-contact-info.html?CDC_AAref_Val=https://www.cdc.gov/quarantine/order-collect-contact-info.html
| File Type | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| Author | Samuel, Lee (CDC/OID/NCEZID) |
| File Modified | 0000-00-00 |
| File Created | 2025-12-13 |
© 2025 OMB.report | Privacy Policy