This policy explains what data the Sổ thuốc – Pharmacy Handbook app ("Sổ thuốc", "we") collects, what it is used for, where it is stored and what rights you have. It is based on Decree 13/2023/ND-CP on personal data protection and the 2025 Law on Personal Data Protection of Vietnam.
1. Use it right away, verify when you need to
You can use Sổ thuốc immediately: an account is created on your device and does not need to be verified. While your account is unverified, your pharmacy information, GPP self-assessment results, reminders, operations records, learning progress and so on are stored only on your phone; we do not receive them.
2. Data we collect
When you verify your account (email, Apple or Google):
- Your email, or your Apple / Google sign-in information (the account identifier and email provided by Apple / Google). We do not receive your password.
- Pharmacy information you enter: name, province/city, phone number (optional), address, tax code.
- A backup of your in-app data (see section 4), including photos you take in the app: GPP certificates, evidence photos for GPP self-assessment and supplier licences. Photos are downscaled and location information (EXIF) is removed before storage.
- Your device model (e.g. "iOS iPhone 15") so you can recognise the devices signed in to your account.
When you submit pharmacy verification: a photo of the Certificate of Eligibility for Pharmaceutical Business, the certificate number and tax code – used only for administrators to check and approve.
When you send feedback, ratings or likes: the feedback content, any contact details you choose to include, the app version and device type. While your account is unverified, the app sends a random device code (containing no personal information) to prevent duplicates and spam.
Usage statistics and crash reports: the app uses Google Firebase (Analytics, Crashlytics) to understand which features are used and to fix bugs. This data does not include your email, phone number or pharmacy content.
We do not collect: contacts, location, messages or health data of pharmacy customers. The camera is used only when you choose to photograph documents.
3. Data kept only on your device
- Completed application forms (containing ID card numbers, personal addresses, etc.) in the pharmacy-opening guide are stored only on your device and are not backed up to our server.
4. Cloud backup
When your account is verified (email, Apple or Google), the app automatically backs up all data and photos in the app to our server: pharmacy information, GPP self-assessment results, reminders and documents, records, sales / stock books, company and sales representative contacts, learning progress and guide progress (except application forms – section 3). This does not require pharmacy verification; pharmacy verification is only a trust badge. Backups let you restore your data when you change phones or reinstall the app, and let staff you authorise work on your pharmacy's data.
5. How we use data
- To provide app features: backup, signing in on a new device, pharmacy verification.
- To send relevant notifications (e.g. announcements from the Department of Health for the province/city you choose).
- To send verification codes by email when you verify your account or sign in with email. Fake and disposable emails are rejected to prevent spam.
- To respond to feedback and provide support when you ask.
- To improve the app and fix bugs.
We do not sell your data, do not use it for advertising and do not share it with third parties for marketing purposes.
6. Where data is stored and service providers
- Our servers are located in Vietnam.
- System backups are encrypted before being stored on Cloudflare R2.
- An email delivery service is used to send verification codes.
- Apple, Google: only when you choose to sign in with Apple / Google.
- Google Firebase: anonymous usage statistics and crash reporting.
These providers process data only to provide services to Sổ thuốc.
7. Security
Connections are encrypted (HTTPS). Sign-in tokens on your device are kept in the phone's secure storage. Email verification codes are short-lived and are cancelled after too many wrong attempts. Only authorised administrators can view verification documents.
8. Retention
Account data and backups are kept until you delete your account. Feedback is kept to improve the service but is unlinked from your account when the account is deleted.
9. Your rights
You have the right to be informed, to access, correct and delete your data, to withdraw consent, and to object to or restrict processing in accordance with the law.
- Correct information: Me › Edit pharmacy information.
- Delete your account: Me › Account › Delete account. Your account, backups, pharmacy information and verification photos on our server are permanently deleted.
- Delete data on your device: sign out or uninstall the app.
- Other requests: use Me › Feedback in the app.
Pharmacy staff and mini-games
Pharmacy staff. When you join a pharmacy as staff using an invitation code, the pharmacy owner can see your name, gender, experience, position, practising certificate number (if you enter it) and account email. The pharmacy keeps an activity log (who did what and when). If you leave or are removed, the data you created remains with the pharmacy, labelled with your name.
Customers playing mini-games at a pharmacy. Before playing, customers enter their name and phone number and consent to this information being stored. The pharmacy decides how this data is used (only to give prizes and limit plays per day); Sổ thuốc stores and processes it on the pharmacy's behalf, does not use it for anything else and does not sell it to third parties. Customers who want their information deleted can ask the pharmacy – the owner can delete plays directly in the app – or contact us as described in the Contact section.
Content filter. When content is blocked because it contains inappropriate words, we record only the input field and the word category (not the content and not the customer's name) to monitor abuse trends.
10. Children
Sổ thuốc is intended for pharmacy professionals and owners of pharmaceutical businesses, not for children under 16.
11. Changes to this policy
When this policy changes, we update the effective date at the top of the page and announce important changes in the app.
12. Contact
For any questions about personal data, use Me › Feedback in the app.