Privacy Policy

1Who we are and how to contact us

Social Blood Bank operates this website and its services. We decide why and how the personal information described here is processed, so we are responsible for it.

For any privacy question, request or complaint, write to support@socialbloodbank.com. You can also use Help and Support while signed in.

Organizations, hospitals and blood centers that you deal with through the platform are independent. When they use information for their own work, such as screening donors or treating patients, they are responsible for that use under their own policies and the law.

2Information you give us

• Account information: first and last name, country, preferred language, password (stored only in hashed form) and, if you choose one, a public username. Usernames are set once and an old username keeps pointing to your profile.
• Contact information: your email address and/or mobile number, and whether each has been verified with a code.
• Profile information: an optional profile photo, and addresses you save (current, permanent or temporary) with their area, locality and postcode. If you type map coordinates, paste a map link or use your device location in the address form, the coordinates are saved with that address.
• Donor information, if you register as a donor: blood group and how it was confirmed, availability, last donation date, donation preferences, privacy mode, and optionally your date of birth and weight. Authorized facility staff may add a deferral date, a laboratory-verified blood group or rare blood group details.
• Donation records: dates, outcomes and how each donation was confirmed, and the facility, organization, request or campaign it relates to.
• Blood request information: the patient name, hospital, ward and hospital registration number, blood group, component, quantity, the time blood is needed, urgency and notes, plus the history of changes to the request.
• Responses and messages: your responses to blood requests, expected arrival times and in-app messages with a request team.
• Organization information: organizations you create or join, your role and title, invitations you send (including the email address or mobile number you invite), and organization content such as notices, campaigns and programs.
• Facility information and claims: details you add about hospitals and blood centers, and the evidence you upload to claim the management of a facility.
• Campaign and program participation: registrations, appointments, attendance and outcomes.
• Referrals: your referral code and the referral records created when someone joins through your link.
• Reports and support: reports you make about content or accounts, and support tickets with their messages and attachments.
• Your choices: consents, notification preferences, email preferences and blocked people.

3Information collected automatically

• Cookies and similar storage needed to sign you in, keep you signed in, protect verification steps and remember your language. The Cookie Policy lists each one.
• Your IP address and browser details, used to protect sign-in and registration from abuse (rate limits) and to recognize a new device so we can alert you. In our logs the IP address is stored only as a keyed hash, not as a readable address.
• For referrals, salted hashes of the IP address and browser signals, used only to review suspicious referral patterns.
• An approximate country, when your hosting or network provider supplies it, to show blood requests near you. It is not stored.
• If you allow it, your device location on the home page. It is matched to an area once and the coordinates are not kept.
• Records of security events and changes made through the platform (an audit log), and delivery records for emails and text messages.

We do not use analytics services, advertising networks, social-media pixels or cross-site tracking.

4Sensitive information

Some of the information on Social Blood Bank is sensitive: blood group, donor and donation details, health-related details such as deferrals or rare blood groups, patient details in blood requests, precise location and contact details. We collect it only for blood coordination, protect it with stricter access rules and, where the law requires, ask for your explicit consent.

Please do not add more health information than a blood request needs. Never put diagnoses, test results or identity documents in request notes or messages.

5How we use information

We also use information to run and support your account, send the notifications you have chosen, answer support requests, moderate reports, keep the service secure, meet legal obligations and improve the service. We do not use your information for advertising and we do not sell it.

Your settings include consent switches for research statistics and marketing communication. We do not currently send marketing messages or use personal information for research. If that changes, we will only include people who switched them on.

6Legal grounds

The legal ground depends on the information and the purpose, and on the law that applies to you. We rely on:

• Your consent, for example to show a public donor profile, to be found for emergency or organization matching, to use your location, or to share your mobile number with a request team when you accept a request. You can withdraw consent at any time in Settings.
• Providing the service you asked for, such as your account, blood requests you create and organizations you join.
• Legal obligations, such as keeping records or answering lawful requests from authorities.
• Our legitimate interest in keeping the platform safe and working, where the law allows it.
• Protecting someone’s life or health in an emergency, only where the law allows it.

7What other people can see

Public information can be seen by anyone, including people who are not signed in, can be shared by others and may be copied by search engines. Today that includes:

• Your profile page: your name, username, profile photo, public ID and referral badge. If you switch on a public donor profile, it also shows your blood group and how it was confirmed, your general area (for example district and country) and verification badges, and, if you also allow it, your verified donation count. Your main profile page can appear in search engines, which only receive what a signed-out visitor sees, and it is listed in our sitemap only if you switched on a public donor profile. Pages under it, such as your notifications and referrals, are never indexed.
• Blood requests: blood group, component, quantity, timing, urgency, status, hospital and area, a partly hidden patient name (such as the first name and an initial), and the name and username of the person who created the request and of anyone who verified it. The public list of blood requests can appear in search engines. Single request pages ask search engines not to index them.
• Organization pages, facility pages and campaigns, which are public. An organization’s main page can appear in search engines. Its other sections, and facility and campaign pages, ask search engines not to index them. Lists of an organization’s donors only include donors who chose a public donor profile and a privacy mode that allows it.

Everything else is restricted. Patient registration numbers, wards and request notes are shown only to the request team and authorized verifiers. Your email address, mobile number, addresses, date of birth, weight and donation history are never shown publicly. A request team sees your mobile number only after you accept their request and only if you allowed contact sharing.

8Who we share information with

• Other users, as described above and when you act, for example when you respond to a request or join an organization.
• Organizations, hospitals and blood centers you deal with, for coordination, verification and recording donations. Their authorized staff only see what their role allows.
• Service providers that run parts of the service for us, under our instructions: our hosting provider, the email service we configure, text-message gateways (we have integrated sms.net.bd, MiMSMS, Twilio and a general HTTPS gateway, used depending on the recipient’s country), Google Firebase Cloud Messaging for push notifications where enabled, and Twilio for WhatsApp or voice alerts where enabled.
• OpenStreetMap, which provides the maps on facility and campaign pages. When such a map loads, your browser contacts OpenStreetMap directly.
• Authorities, courts or others when the law requires it, or when it is necessary to protect someone’s life or safety, prevent fraud or defend legal claims.
• A successor, if Social Blood Bank is ever reorganized or transferred, under this policy.

9International processing

Some of our service providers, such as email, messaging and hosting providers, may process information outside your country, including outside Bangladesh. When that happens we use providers that protect information appropriately and follow the transfer rules of the law that applies, including any requirement to keep a copy of certain data in Bangladesh.

10How long we keep information

We keep information only as long as it is needed for the purposes above, for safety and accountability, and to meet legal obligations. Some periods are fixed by the platform today:

11Your rights and choices

Depending on the law that applies to you, including the Personal Data Protection Act of Bangladesh, you can:

• See your information. Most of it is in your profile and Settings. You can also ask us for a copy.
• Correct your information in Settings. Information that has been verified, such as a laboratory-verified blood group, changes through a new verification.
• Withdraw a consent at any time with the switches in Privacy and Consents. This does not affect what was done before.
• Object to or ask us to restrict a use of your information.
• Ask for your information in a portable format.
• Ask us to delete your information, as explained below.
• Complain to us at support@socialbloodbank.com, and to the data protection authority that applies to you.

Send requests to support@socialbloodbank.com from the email address or mobile number on your account so we can confirm it is you. We answer within 30 days, or sooner if the law requires.

12Closing your account and deletion

There is not yet a self-service delete button. To close your account, write to support@socialbloodbank.com. When we close an account, your profile is no longer shown, you can no longer sign in and all your sessions end.

We then delete or de-identify the information we no longer need. Some records must be kept, for example blood requests that involved other people, verified donation records, verification history, safety reports and audit records. We keep them only as long as needed and tell you what we kept and why.

13Children

You must be at least 18 years old to create an account. Social Blood Bank is not directed at children. A patient under 18 can appear in a blood request only when a parent, guardian or other authorized person creates the request. We do not profile children or use their information for advertising.

14Security

We use technical and organizational measures to protect information. These include hashed passwords and verification codes, encryption of stored service credentials and contact details used for delivery, role-based access controls, limits on repeated attempts, protected storage for uploaded evidence and attachments, and an audit trail of important changes. No system is completely secure, so please keep your password private and tell us at support@socialbloodbank.com if you notice anything suspicious.

If a security incident is likely to harm you, we will act to contain it and notify the authority and the people affected as the law requires.

15Changes to this policy

We update this policy when the platform or the law changes. The version and date at the top show the current version, and the revision history below lists the changes. When a change is significant, we will tell you on the site or by email before it takes effect.