Privacy policy · English summary

We collect almost nothing, because we don't need to.

What this site collects

• · No user accounts. No login. No medical record intake on public pages.
• · Essential cookies remember your preference choice; analytics cookies are optional and consent-based.
• · Google Analytics 4 through Google tag (gtag.js), with Consent Mode denied by default and analytics cookies enabled only after consent.
• · No advertising signals, no retargeting pixels, no behavioural advertising profile.

The Google tag is loaded on public pages. With analytics_storage denied, Consent Mode may still send cookieless technical pings carrying the denied consent state. Declining analytics prevents analytics storage and cookies such as _ga, but does not block every network request to Google.

Cross-border data processing

The site runs on Cloudflare Pages with a global CDN, so technical data such as IP addresses and request logs may be processed at edge points outside Vietnam. Google tag may process cookieless technical signals while analytics storage is denied and fuller pageview data after analytics consent, on infrastructure that may be outside Vietnam. Activities within Article 20 of Law 91/2025 and Articles 17–18 of Decree 356/2025 require the applicable cross-border impact assessment unless an exception applies; this public notice is not a substitute for that dossier. The public pages are not designed to submit health records, CCCD/BHYT/BHXH data, or clinical content.

Your rights under Law 91/2025

Article 4 includes the rights to know; consent or refuse and request withdrawal; view, correct or request correction; request provision, erasure or restriction; object; complain, denounce, sue and claim damages; and request protective measures. These rights remain subject to the conditions and exceptions in the Law. Since this site has no accounts or medical-record intake, relevant records are usually limited to cookie preferences, infrastructure logs, Google tag/analytics data, and email you voluntarily send. Contact [email protected]; this is the public request channel, not by itself a statement that the mailbox holder is a formally appointed DPO.

Under Article 5 of Decree 356/2025, a procedurally valid request receives a procedural response within two working days. Completion periods vary by request: 10 days for viewing or correction; 15 days for stopping processing or consent withdrawal; 20 days where a processor or third party must stop processing; and 30 days where a processor or third party must provide, erase or restrict data. One reasoned extension of at most 15 days may apply. There is no single general “30-day” rule covering every right. Do not email an identity-card copy or medical record unless a secure verification method has first been requested.

Children and incident notification

The site is not directed at children and has no account or intake form for creating a child profile. A normal request does not disclose the visitor’s age, so the technical processing described above may occur without the site knowing that a visitor is a child. Article 24 of Law 91/2025, not a blanket “under 15” rule, governs children’s personal data; disclosure of private-life or personal-secret information about a child aged seven or older requires both the child’s and legal representative’s consent. For incidents, the 72-hour authority-notification deadline in Article 23(1) applies when the statutory harm threshold is met and runs from detection. Direct notice to data subjects is not a universal rule for every incident; specific duties depend on the data and applicable provision, including Article 29 of Decree 356 for location or biometric data.

Changes to this policy

The revised policy will be published on this page with its effective and review dates. Silence or continued browsing is not consent under Article 9(4) of Law 91/2025. If a change introduces a new processing purpose that requires consent, the site will request an explicit choice. The Vietnamese version is updated first; this English page remains a non-authoritative summary.