PRIVACY POLICY

This privacy policy explains how the VALID Project (a collaboration between Thai Binh University of Medicine and Pharmacy, University of Copenhagen, and University of Southern Denmark, funded by Danida — Ministry of Foreign Affairs of Denmark) collects, uses, and protects your personal data when you use our website and free online course system.

This policy complies with Vietnam's Decree 13/2023/ND-CP on Personal Data Protection.

Account information: When you create an account, we collect: email address (required for authentication), full name (optional), user type — healthcare professional or pregnant/planning pregnancy (optional).

Authentication data: We use Supabase for authentication, including: encrypted (hashed) passwords, OAuth tokens (Google — if you choose to sign in with Google), session cookies to maintain login state.

Course usage data: Lesson progress (which lessons viewed, in progress), video events (started, completed), PDF download history.

Automatically collected data: When you visit our website, we may automatically collect: device information (browser, operating system), IP address (for security purposes), pages visited and viewing time.

Our website only uses essential cookies required for system operation:

• sb-* — Supabase session management (user authentication)

We currently do not use analytics or advertising cookies. You can manage cookies through your browser settings.

• Provide services — Account authentication, granting access to free courses and materials

• Track progress — Recording your learning journey to support the experience

• Communication — Sending account verification emails, password resets, and important course notifications

• Improve services — Analyzing aggregate usage patterns to optimize content

• Legal compliance — Maintaining records as required by Vietnamese law

Under Vietnam's Decree 13/2023/ND-CP:

• Consent — Primary basis: when you create an account and use our services

• Contract performance — Providing courses and materials you registered for

• Legal obligation — Record keeping as required by law

Note: Unlike GDPR, Vietnamese law does not recognize "legitimate interest" as an independent legal basis. We primarily rely on your explicit consent.

We share data with the following technical service providers:

• Supabase (supabase.com) — Authentication, database, file storage. Data: email, profile, learning progress.

• Vercel (vercel.com) — Website hosting. Data: IP address, access requests.

• Mux (mux.com) — Video lesson streaming. Data: video session information.

What we do NOT do:

• Sell your personal data to third parties

• Share data with advertisers

• Use data for targeted advertising

We implement the following security measures:

• HTTPS encryption for all data transmission

• Supabase Row Level Security (RLS) for database access control

• Passwords are hashed — never stored in plain text

• Restricted access controls for personal data

• JWT tokens for API authentication

• Account data — Until you request deletion

• Learning progress data — Until you request deletion or delete your account

• Session data — Until logout or 7-day expiry

You have the following rights regarding your personal data:

• Right of access — View your personal information on the Profile page

• Right to erasure — Request account and data deletion ("Delete Account" is available on the Profile page)

• Right to withdraw consent — Withdraw consent at any time by deleting your account

To exercise other rights, please contact: kiennd@tbump.edu.vn. Response time: within 30 days.

Your data may be stored in:

• Singapore — Supabase data center

• United States — Vercel CDN nodes, Mux video streaming servers

We ensure adequate protection through data processing agreements with all service providers and compliance with international security standards.

Our services are designed for pregnant women, families, and healthcare professionals. The service is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe a person under 16 has provided data, please contact us immediately for removal.

Under Decree 13/2023, in the event of a data breach:

• Notification to authorities within 72 hours

• Immediate email notification to affected users

• Incident report published on our website if severe

• We will announce significant changes on our website

• 30 days notice before major changes take effect

• Continued use after changes constitutes acceptance

• You may delete your account if you disagree with changes

For privacy questions, data requests, or concerns:

Email: kiennd@tbump.edu.vn

Organization: Thai Binh University of Medicine and Pharmacy, Vietnam

By using the VALID Project website, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and processing of your personal data as described herein.