Data Protection

1Our principles

• Lawfulness, fairness and transparency: we process data on a lawful basis and explain it in plain language.
• Purpose limitation: we use data for blood coordination and running the platform, not for unrelated purposes.
• Data minimization: if a field is not needed to provide, secure, administer, coordinate or legally support a feature, we do not collect it.
• Accuracy: you can correct your data, and verified data changes only through a new verification.
• Storage limitation: we delete data when it is no longer needed, and some periods are automatic.
• Security and confidentiality: we protect data with technical and organizational measures.
• Accountability: we keep records of important changes and review our practices.
• Privacy by design and by default: privacy is part of how features are built, and the most private setting is the default.

2How we classify data

3Access control

Access is based on permissions, not job titles. Platform staff only get the permissions their work needs. Organization roles never give access to platform administration, and every action is checked on the server for the exact organization involved. Sensitive actions are recorded in an audit trail that cannot be edited.

4Handling sensitive data

• Every consent, including the public donor profile, starts switched off.
• Donors choose a privacy mode that controls who can find them.
• Patient names are partly hidden in public, and patient details are limited to the request team.
• A donor’s mobile number is shared with a request team only after the donor accepts, and only if they allowed it.
• Search engines only receive what a signed-out visitor sees. A page is only indexed when it is on our explicit list, and single blood request pages and private account pages never are.
• Verification codes and passwords are stored only as hashes, and stored contact details used for delivery are encrypted.

5Retention

Retention periods, including the ones that run automatically, are listed in the Privacy Policy. When an account is closed, we delete or de-identify what we no longer need and keep only records we must keep, for as long as needed.

6Service providers and international processing

Service providers, such as hosting, email, text-message, push and map providers, process data only to provide their service to us. We choose providers that protect data, give them only what they need and, when data is processed outside the country where it was collected, follow the transfer rules of the law that applies. We do not use providers for advertising or analytics.

7Data requests

To see, correct, export or delete your data, withdraw consent or object to a use, write to support@socialbloodbank.com from the email address or mobile number on your account. We confirm it is you, answer within 30 days, and explain any part of a request we cannot complete and why.

8Security incidents

If we discover a security incident, we contain it, assess the risk, fix the cause and, when the law requires, notify the data protection authority and the people affected without undue delay. We do not publish details that would help attackers.

9Governance

We follow the Personal Data Protection Act of Bangladesh as our baseline and consider other laws where they apply to the people we serve. We review this page and the Privacy Policy when features or the law change. These policies are our own description and do not claim certification under any law.