Privacy Policy
At a glance
- CRM Hồng Hưng is an internal work application for employees and authorized staff of Hồng Hưng General Hospital, an affiliated healthcare facility of Công ty TNHH XNK-TM-CN-DV Hùng Duy. Accounts are issued by the hospital — there is no public sign-up.
- The only data the App collects from your device and sends to our servers is a device identifier, device name and a push-notification token, together with the work account you sign in with.
- That data is used only to make the App work: signing you in with a one-time code, keeping your session tied to a trusted device, and asking you to approve sign-ins to the hospital’s web systems.
- We do not show advertising, build advertising or marketing profiles, or sell, rent or trade any data.
- The App is a healthcare management and services tool for hospital staff. It gives no medical advice, no diagnosis and no clinical decision support, it does not monitor anyone’s health, and it is not a medical device — see section 4.
1. Who we are
CRM Hồng Hưng (the “App”) is developed and operated by Công ty TNHH XNK-TM-CN-DV Hùng Duy, also written as HUNGDUY CO.,LTD (“we”, “us”), for Hồng Hưng General Hospital. The App is distributed to hospital staff so they can sign in securely to the hospital’s CRM and web systems and carry out their work. This policy explains what the App collects from you, why, and what your options are.
By signing in to the App you accept this policy. If you do not agree with it, do not use the App and contact your manager or the IT department.
2. Data we collect
The table below is the complete list of data the App collects from you and transmits off your device. It matches the declaration we file in the Google Play Data safety section.
| Data | Sent off your device? | Why we need it |
|---|---|---|
| Device or other IDs A device identifier generated for your installation, the device model name, and the push-notification registration token issued by Firebase Cloud Messaging. |
Yes, to our servers | App functionality only: keeping one trusted phone per account, showing you which device a session belongs to, and delivering sign-in approval requests to the right device. |
| Work account identifier The username and password issued to you by the hospital, submitted when you sign in, and the one-time code you enter. |
Yes, at sign-in | App functionality only: authenticating you and applying the access rights your role has been granted. Passwords and one-time codes are never stored on the device. |
The one-time sign-in code is delivered through the company’s internal HRM application, keyed to your employee code; the App does not collect your phone number.
The App does not collect your location, contacts, calendar, SMS messages, call logs, installed-app list, personal financial or payment details, or any advertising identifier. It contains no advertising or behavioural-analytics SDK.
3. Work data you handle inside the App
When you use the App to do your job you view and record information that belongs to the hospital — for example news and doctor schedules published to the hospital’s patient app, medical incident reports, quality-evaluation records and system administration settings. That information is the hospital’s data, not yours and not ours: the hospital decides how it may be used, and we process it only on its instruction and under its internal rules and applicable Vietnamese law. It is never used for any purpose of our own, and it is not part of the personal data described in section 2.
Access to work data inside the App is limited to what your role has been authorised to see.
4. Health-related use of this application
The App is a healthcare management and services tool. It supports the operational work of hospital staff — publishing hospital information, recording and following up medical incident reports, quality management and system administration — and nothing more.
To be explicit about what the App is not:
- It is not a patient-facing app. It is distributed only to staff of the hospital and of Công ty TNHH XNK-TM-CN-DV Hùng Duy, on accounts issued by the employer.
- It does not provide medical advice, diagnosis, triage, treatment recommendations or clinical decision support.
- It does not monitor, measure or track the health of the person using it, and it reads no data from health or fitness sensors or from any health platform on the device.
- It is not a medical device and is not intended for any diagnostic or therapeutic purpose.
- It does not conduct research on human subjects and is not used for clinical trials.
Information about patients that may appear in a medical incident report is the hospital’s record, shown to authorised staff so they can do their job, as described in section 3. It is held under the hospital’s medical-record rules, the Law on Medical Examination and Treatment and Decree 13/2023/ND-CP on the protection of personal data. We never use health information for advertising, marketing, profiling or any purpose of our own, and we never sell it or share it with third parties for those purposes.
5. How we use the data
- To authenticate you, including a one-time code delivered through the company’s HRM application, and keep your signed-in session valid.
- To tie a session to a device you have registered, and to end sessions on devices that are no longer trusted.
- To ask you to approve or reject sign-ins to the hospital’s web systems made with your account, and to let you sign in to those systems by scanning a QR code.
- To keep security records of sign-ins (time, device and network address), so that unauthorised access can be detected and investigated.
- To diagnose errors reported by you or by the App.
We do not use any of this data for advertising, profiling, scoring, or any purpose unrelated to your work.
6. Device permissions
- Camera — used only while you scan a sign-in QR code. Frames are processed on the device and are neither stored nor uploaded.
- Photo library — used only when you pick an image yourself, such as a picture of a QR code or an image to attach to hospital content. Only the image you select is used.
- Notifications — used to deliver sign-in approval requests.
Declining a permission only disables the feature that needs it; the rest of the App keeps working. You can change or withdraw any permission at any time in your device settings.
7. Sharing and disclosure
We do not sell, rent or trade your data, and we do not share it with third parties for advertising or marketing.
- Google (Firebase Cloud Messaging) receives the push token and the notification payload for the sole purpose of delivering the message to your device.
- Within the company and the hospital, authorised administrators and the IT department can see sign-in and device records as part of operating and securing the system.
- Legal requests: we may disclose data where Vietnamese law obliges us to, or where it is necessary to protect the security of our systems or the rights and safety of others.
We use no other third-party processor for the data listed in section 2.
8. Retention and deletion
- The device identifier, device name and push token are kept while your account is active and the device is signed in. They are replaced when you sign in on another phone and removed when the account is deactivated.
- One-time codes are stored only as a one-way hash, expire within three minutes and cannot be reused.
- Sign-in and security records are kept for as long as company policy and Vietnamese law require, then deleted.
- Your work account and the records attached to it are part of the hospital’s records and are retained under hospital policy and Vietnamese law.
To ask for access to, correction of, or deletion of the data described in section 2, write to info_hungduy@hungduy.vn or contact the hospital’s IT department. We respond within 30 days. Some data cannot be deleted while it is still required by law or by an ongoing employment obligation; if that applies we will tell you which data and why.
9. Security
All traffic between the App and our servers goes over encrypted connections (HTTPS/TLS). Sign-in requires a one-time code and registration of a trusted device, sign-ins to the hospital’s web systems can require approval in the App, and access inside the App is restricted by role. Sessions are stored in the device’s secure storage. No system can be guaranteed absolutely secure, but we work to keep protection appropriate to the sensitivity of the data.
10. Children
The App is a workplace tool for adult employees and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has used an account, contact us and we will remove the data.
11. Changes to this policy
If we change this policy we will update the page and the “Last updated” date above. Material changes will also be announced inside the App. Please review this page from time to time.
12. Contact us
Công ty TNHH XNK-TM-CN-DV Hùng Duy
Email: info_hungduy@hungduy.vn
Website: hungduy.vn