City drops Philly Fighting COVID as vaccination partner after it failed to disclose for-profit arm

The Philadelphia Department of Public Health on Monday abruptly ended its partnership with Philly Fighting COVID, a group overseeing the city’s largest coronavirus vaccination site, after it said the organization failed to disclose that the personal information residents entered into the group’s preregistration portal could be sold.

A Health Department spokesperson said the city was unaware that Philly Fighting COVID recently established a for-profit arm, called Vax Populi. It was also unaware that the website — where the city once instructed Philadelphians to preregister for the coronavirus vaccine — updated its privacy policy last week to outline the ways registrants’ personal information could be used.

Philly Fighting COVID launched its vaccine preregistration website in the beginning of January, encouraging people to “Pre-Commit to Getting Vaccinated.” Once on the site, users were asked to fill out a form with their date of birth, cell phone number, occupation, race, ethnicity, number of people in their household, and medical conditions that may increase the severity of the virus. The site said it would contact them once they were eligible for a vaccine.

“The City has not been notified of any of these data having been sold. But for PFC to have made these changes without discussion with the City is extremely troubling,” James Garrow, the Health Department’s spokesperson, said in a statement to the Inquirer. “As a result of these concerns, along with PFC’s unexpected stoppage of testing operations, the Health Department has decided to stop providing vaccine to PFC.”

The end of the partnership came after The Inquirer asked questions about Vax Populi, its privacy policy, and scrutiny from WHYY about the organization’s closing of testing sites.

Andrei Doroshin, Philly Fighting COVID’s CEO, said the wording of the privacy policy was a mistake, and alleged the city knew about the organization’s for-profit change. He insisted the group never intended to sell anyone’s data.

“I will undergo an audit to show I never shared the data. I will do whatever I have to do,” Doroshin said in an interview Monday night. “We’re just a bunch of, like, college kids trying to help out and we’re getting kneecapped right now.”

Doroshin, a Drexel University graduate student who started Philly Fighting COVID by using 3D printers to create face shields before expanding into testing, said the website did not have its own privacy policy. Once reporters started asking questions about the policy, Doroshin said they added one.

“We were scrambling,” he said. “I think it was a mistake in that we didn’t have specifically the verbiage that we wouldn’t sell the data, even though we never had the intention to begin with to sell the data.”

The organization created a privacy policy tab on its website Monday night and updated the policy to include that “the company will not sell data to any parties.”

Garrow said Monday that Doroshin only told one health official the organization was making a for-profit change a month after the company filed paperwork with the state establishing itself as a business.

Garrow said the group maintained it was a nonprofit on its site this month, even after establishing the for-profit arm, “speaks to how they were not notifying people of this change.”

The city “strongly recommends” that any Philadelphia resident interested in receiving the vaccine register with the city’s portal.

The department is aware who was vaccinated through Philly Fighting COVID’s site at the Pennsylvania Convention Center and will be in touch to set up their second vaccine appointment, according to their original schedules, Garrow said.

“The Health Department will fill that gap,” Garrow said.

With Mayor Jim Kenney and other city officials attended the opening of the Philly Fighting COVID mass vaccination site at the Pennsylvania Convention Center on Jan. 8, and city logos plastered throughout the venue, many Philadelphians thought the site was a city-run endeavor.

Doroshin had even landed a spot on the city’s Vaccine Advisory Committee, as one of the 40 people tasked with advising the city on an equitable vaccine distribution. (Garrow said Doroshin will be removed from the committee.)

“It all felt very city-sponsored,” said Michael Whitney, 36, who received his first shot of the Moderna vaccine at the Convention Center last week. He added that the organization’s sign-up and vaccination process were “very efficient” and “felt very well-organized.”

But the Convention Center site and preregistration website were just a partnership with the city, and not run by the city.

The Philadelphia City Council seal was also originally included on the Philly Fighting COVID website. However, the group “was never authorized” to use the seal, said City Council President Darrell L. Clarke’s spokesperson Joe Grace. It was removed last week at their request, Grace said.

Philly Fighting COVID’s website privacy policy, which was not publicly available until last Friday, shows the page is owned by Vax Populi, a privately held corporation established in December by Doroshin. That connection was not clear to the general public when city officials encouraged all Philadelphians to pre-commit to a vaccine through the organization.

Vax Populi, according to the site’s original privacy policy, is able to share or transfer personal information in connection with any merger or sale of the company. It is also permitted to disclose this personal data with other service providers, affiliates, and businesses.

“The Health Department was unaware of this company, nor its relationship to Philly Fighting COVID,” Garrow said. The organization, he said, “is not receiving any vaccine at this point.”

However, Doroshin said the organization identified itself as Vax Populi when it submitted a proposal to the city last week to officially run vaccination clinics for the city. In the month leading up to the proposal, Doroshin said he spoke with city officials about becoming for profit and was assured the switch was fine. So far, Doroshin said, the group has given the first dose of the vaccine to nearly 7,000 people.

”Vax Populi, Inc., a newly-formed LLC., (formerly Philly Fighting COVID) is pleased to present the following proposal for the construction and operation of COVID-19 vaccination clinics within the City of Philadelphia,” the proposal reviewed by The Inquirer said.

The city posted a request for proposals for vaccine providers at the end of December and Garrow confirmed the organization submitted an application. But, Garrow said, officials haven’t reviewed applications yet because they have not secured funding.

While the health department has said it will fill the gap left by the end of this partnership, the change will likely disrupt an already chaotic vaccine roll out process, and further fray residents’ trust in the system.

Experts said people have different expectations regarding privacy when using a sign-up on a site that seems to be run by the government as opposed to a private corporation. Although the information residents provided while registering seems similar to data collected by “any other app we use,” Scott Burris, Temple University law professor and the director of the Center for Public Health Law Research said he understands why people may have felt deceived when reading the original privacy policy.

”It is clearly taking advantage of people’s huge desire to get the vaccine and fear of COVID,” Burris said of the original policy. “When you represent yourself as a public body or somehow affiliated with a public agency, but in fact you’re a private organization, that is problematic just in terms of honesty.”

Inquirer staff writer Juliana Feliciano Reyes contributed to this article.