UniCDM App Privacy Policy

1. About this policy

This Privacy Policy applies to the UniCDM mobile application for Android and iOS (the "App"), developed by OKAXI TECHNOLOGY SOLUTIONS CO., LTD. ("OKAXI", "we", "us"). It explains what information the App collects, how it is used and shared, and the choices you have.

The App is a professional tool for clinical research staff (such as investigators, study coordinators, monitors and data managers) working for organisations that use the UniCDM platform, for example sponsors, contract research organisations (CROs), hospitals and research centres. It is not intended for the general public. User accounts are created by your organisation; the App does not offer public sign-up.

By using the App you agree to the practices described in this policy. This policy covers the mobile App only. The UniCDM website is covered by a separate Privacy Policy.

2. Who is responsible for your data

Study data entered in the App belongs to the organisation running the clinical study (your employer or the study sponsor), which acts as the data controller. Depending on how UniCDM is deployed for that organisation, study data is stored either on servers operated by OKAXI on the organisation's behalf (OKAXI then acts as a data processor under its agreement with the organisation) or on servers operated by the organisation itself, in which case OKAXI does not receive that data.

OKAXI is the data controller for the App's diagnostic and usage data described in section 3.6 and for requests you send to us directly.

Contact: OKAXI TECHNOLOGY SOLUTIONS CO., LTD., Vietnam. Email: info@okaxi.com. Website: https://okaxi.com/

3. Information the App collects

The App only collects information needed to provide its functions:

• 3.1 Account information: your name, work email address, role, organisation and the studies and sites you are assigned to. This is set up by your organisation's administrator. If you sign in with Google or Microsoft, the App receives your basic profile (name and email address) from that provider to identify your account. If two-factor authentication is enabled, a one-time code is verified at sign-in.
• 3.2 Study data you enter: electronic case report form (eCRF) data, queries, source data verification (SDV), adverse event and serious adverse event (AE/SAE) reports, electronic signatures and visit schedules. Research participants are identified by a study code and initials only; the App does not ask for participants' full names.
• 3.3 Photos: only when a study form contains a photo field and you choose to take a photo with the camera or attach one from your device. You must confirm that the photo has been de-identified before it is saved.
• 3.4 Location: only when a study form contains a GPS field and you choose to capture it. The coordinates are rounded before they are stored. The App does not collect location in the background and does not use location to track you.
• 3.5 Activity records (audit trail): actions that create or change study data are recorded with your user identity, date and time, and the reason for changes, as required for clinical research. These records are part of the study record.
• 3.6 Device, diagnostic and usage data: the App uses Google Firebase Analytics and Firebase Crashlytics to understand how the App is used and to fix errors. This may include device model, operating system and app version, app installation identifiers, crash reports and logs, and in-app events such as screens viewed. Your IP address may be processed by Google when this data is sent.
• 3.7 Notification tokens: to send push notifications (for example upcoming visits, open queries and SAE reporting deadlines), the App registers a device token with Firebase Cloud Messaging and, on iOS, the Apple Push Notification service.

Biometric unlock (Face ID, Touch ID or fingerprint) is handled entirely by your device's operating system. The App only receives a success or failure result and never accesses or stores your biometric data.

Drafts entered while offline are stored on your device until they can be synchronised with the server.

4. Device permissions

The App asks for permission before using the following features. You can refuse or withdraw a permission at any time in your device settings; only the related feature will stop working.

• Camera and photos: to capture or attach photos in study forms that contain a photo field.
• Location (while using the App): to fill GPS fields in study forms.
• Notifications: to receive reminders about visits, queries and SAE deadlines.
• Face ID / biometrics: to unlock the App quickly and securely.

5. How we use information

Information is used to:

• Sign you in, verify your identity and apply the permissions your organisation has given you.
• Provide the App's functions: data entry, offline drafts, synchronisation, queries, SDV, safety reporting and visit schedules.
• Send notifications you have allowed.
• Maintain the security and integrity of study data, including the audit trail.
• Detect, diagnose and fix crashes and errors, and improve the App's stability and usability.
• Comply with legal and regulatory obligations that apply to clinical research.

Depending on the applicable law, we rely on the performance of the agreement with your organisation, our legitimate interests in operating a secure and reliable service, compliance with legal obligations, and your consent for optional permissions such as camera, location and notifications.

We do not sell personal information, do not use information from the App for advertising, and do not track you across apps or websites owned by other companies. The App does not make automated decisions that produce legal or similarly significant effects for you.

6. Third-party services

The App uses the following third-party services, which process information under their own privacy policies:

• Google Firebase (Cloud Messaging, Analytics, Crashlytics)
• Google Sign-In
• Microsoft sign-in
• Apple Push Notification service (iOS)

Files and study data are stored with the hosting or storage provider chosen for your organisation's deployment (for example a cloud storage service or the organisation's own servers), under agreements that require them to protect the data.

We may also disclose information when required by law or a valid request from a public authority, or when necessary to protect the rights, safety or property of users, OKAXI or others.

7. International transfers

Some service providers, such as Google, may process information on servers outside your country, including outside Vietnam. Where this happens we rely on the safeguards offered by those providers and by applicable law to protect the information.

8. Data retention

Study data, electronic signatures and audit trail records are kept for as long as your organisation requires for the study and for the archiving periods set by clinical research regulations. Because these records must remain complete and unaltered, they may be retained even after your account is closed.

Account information is kept while your account is active and deleted or anonymised after the account is closed, except where it must be kept as part of the study record described above.

Diagnostic and usage data is kept according to the retention settings of Firebase Analytics and Firebase Crashlytics.

9. Deleting your account and data

Because accounts are issued by your organisation, you can request deletion of your UniCDM account in either of these ways:

• Ask your organisation's UniCDM administrator to deactivate and delete your account.
• Email info@okaxi.com from your work email address with the subject "UniCDM account deletion", stating your name and organisation.

We will verify your request with your organisation and respond within 30 days. When your account is deleted, your account information is removed, except for records that must be kept as part of the study record (see section 8). Uninstalling the App removes offline drafts and other data stored on your device.

10. Children

The App is intended for adult professionals and is not directed at children. We do not knowingly collect personal information from children through the App. Information about research participants, including minors, is entered by authorised study staff under the study's ethics approval and is not collected from children directly.

11. Security

We protect information with measures that include encrypted connections between the App and the server, role-based access control by study, site and form, optional two-factor authentication, biometric unlock and a tamper-evident audit trail. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a security incident affecting your information, we will notify the affected organisation and, where required by law, the competent authorities and affected users.

12. Your rights

Subject to applicable data protection laws, including Vietnam's personal data protection regulations and, where applicable, the EU GDPR, you may have the right to access, correct or delete your personal information, to restrict or object to its processing, to data portability and to withdraw consent.

For study data, please contact your organisation, which controls that data. For account, diagnostic and usage data, or if you are unsure, contact us at info@okaxi.com. You may also lodge a complaint with your local data protection authority.

13. Changes to this policy

We may update this policy from time to time. The updated version will be published on this page with a new "Last updated" date. Significant changes will also be announced in the App or through your organisation.

14. Contact us

If you have questions about this policy or about your information, please contact OKAXI TECHNOLOGY SOLUTIONS CO., LTD. at info@okaxi.com.