What you need to know if you signed up for Philly Fighting COVID’s pre-registration site before the city cut ties

The City of Philadelphia has ended its partnership with Philly Fighting COVID (PFC). Up until this week, PFC, a self-described “group of college kids,” was responsible for operating the city’s largest coronavirus mass vaccination site. PFC also manages an online portal for people to “pre-commit to getting vaccinated,” which the city once encouraged all Philadelphians to use.

The city cut ties after the group failed to disclose its recent switch to a for-profit business. The city also said the group’s privacy policy — which wasn’t added to PFC’s website until reporters started asking about it — outlined ways personal information they collected could be sold. An updated version of the privacy policy now includes that “the company will not sell data to any parties.”

Naturally, amid an already bumpy vaccine rollout process, if you registered through the site, you may be concerned. If you’re among the thousands who signed up, here’s what you should know.

Note: If you received the first of the two-shot vaccine through PFC, the city will contact you to schedule another vaccine appointment. If you have a future appointment scheduled with PFC for your first vaccine shot, you will need to set up a new appointment. You’re advised to sign up on phila.gov/vaccineinterest. The city will check your eligibility and contact you to set up a new appointment.

» READ MORE: Use our lookup tool to find out what's happening with the COVID-19 vaccine where you live

Andrei Doroshin, PFC’s CEO, insists that the group never intended to sell anyone’s personal information. PFC’s updated privacy policy states that “the company will not sell data to any parties.” However, it also says that personal information may be shared with PFC affiliates and business partners to “offer certain products, services or promotions.” So it’s possible your data could still be used to target you with advertising.

The city does not have control over the data that PFC collected through its precommitment vaccine portal, but says it’s investigating how to handle data concerns.

“To the extent data was improperly obtained by PFC, the city will consider any and all options, including but not limited to contacting relevant law enforcement authorities to try to prevent any of that data from being sold or shared with third parties,” said a city spokesperson.

» READ MORE: City Council wants answers as questions build over Philly Fighting COVID partnership, handling of vaccines

PFC’s preregistration portal is still live. However, the city “strongly recommends” that residents interested in receiving the vaccine register with the city’s own portal at covid-vaccine-interest.phila.gov. On its registration form, the city clearly states that all information entered “will be kept confidential with the Philadelphia Department of Public Health and will only be used to connect you with where you can register to receive a COVID-19 vaccine in the near future.”

The Health Department announced last week that it’s working on a way to integrate data from other preregistration websites into its own database. The city still plans to find a way to obtain a download of the data collected in PFC’s preregistration system.

No. There is currently no identifiable way to delete your account with PFC once you’ve registered. We’ve sent requests for further instruction to PFC and COVIDReadi, the platform PFC uses to run its preregistration portal, and will update this article as new information becomes available. In a press conference, Doroshin said the organization plans to provide the Philadelphia Health Department with all data that’s been collected, and then delete it from its servers.

The city doesn’t own or control any vaccine interest or preregistration websites outside of its own, and encourages people to use the Department of Public Health portal. However, the city says it will continue to work with partners who are “operating in good faith” to integrate their data into the city’s database. If you choose to sign up through an external vaccine preregistration/interest site, such as with Black Doctor’s COVID-19 Consortium or Acme, you’re advised to read through the organization’s entire privacy policy to ensure you are comfortable with the terms.

The Black Doctor’s COVID-19 Consortium lists its information sharing practices at the bottom of its registration form, and includes the following statement: “We do not give out, exchange, barter, rent, sell, lend, or disseminate any information about applicants or clients who apply for or actually receive our services that are considered patient confidential, restricted by law, or specifically restricted by a patient/client.” Read the full terms here.

Acme’s privacy policy is posted here. It includes a list of how your information might be shared, under the section “Sharing Personal Information.”

Anyone who believes they’ve been misled by Philly Fighting COVID can file a complaint with the Pennsylvania Office of Attorney General.

“Taking advantage of people and their privacy under the guise of serving as a nonprofit is not only unethical — it can also be against Pennsylvania law. We have been in touch with the City to obtain any information they can provide about these allegations,” Pennsylvania Attorney General Josh Shapiro wrote in a Tweet on Tuesday.

A spokesperson from the Pennsylvania Office of Attorney General confirmed that you’re welcome to file a complaint on its website, by email (charities@attorneygeneral.gov), or by calling the office’s consumer protection line (800-441-2555).

» READ MORE: Our best pandemic tips: Read our most useful stories about COVID-19

Inquirer staff writers Ellie Silverman, Ellie Rushing, and Oona Goodin-Smith contributed to this article.