Privacy Policy

BloodPulse is a blood donation management platform. Depending on how you interact with the service, we may collect and process the following information:

• Account Information: Name, email address, password hash (for manual signups), user role, and session timestamps.
• Personal & Profile Details: Full name, date of birth, gender, contact number, and address provided for donation eligibility.
• Social Authentication Information: When signing in via Google or Facebook, we receive your provider UID, name, and verified email address via Firebase Authentication.
• Identity Verification Evidence: Government ID type, document photo, OCR-extracted biographical fields, and cryptographic hashes of document numbers for duplicate prevention.
• Facial Evidence & Liveness Data: Camera stream images, movement challenge timestamps (e.g. blink, turn left/right), and portrait crops collected during active liveness checks.
• Biometric Face Templates: Mathematical 128-dimensional vector representations generated from facial images, used exclusively for 1:1 face matching and 1:N duplicate-person prevention.
• Donation Records: Blood type, donation appointment history, collection site, donation status, and health questionnaire responses.

We process your data strictly for legitimate operational and safety purposes:

• Authentication & Account Access: To identify you, authenticate sign-ins, and maintain secure sessions.
• Automated Identity Verification: To verify donor age, legal identity, and document validity prior to donation scheduling.
• Duplicate Account Prevention: To prevent the creation of multiple accounts by the same individual across differing email addresses, social logins, or ID types.
• Donation Management: To organize appointment schedules, track blood inventory, and maintain donation interval eligibility.
• Security & Audit Logging: To detect suspicious behavior, protect donor accounts, and maintain audit trails for safety-critical changes.
• Communications: To send transaction notifications, verification OTP codes, and donation schedule reminders.

BloodPulse applies strict privacy safeguards to sensitive verification evidence:

• Immediate Raw Image Purge: When automated identity verification is completed, raw government ID photos and selfie captures are permanently purged from private storage.
• Encrypted Biometric Storage: Biometric embeddings (128-d numerical vectors) are encrypted at rest using AES-256-GCM and stored outside public web directories.
• 30-Day Evidence Cleanup: Incomplete, unreviewed, or abandoned verification evidence is subject to a 30-day cleanup process. Automatic cleanup depends on an active scheduled maintenance job. You can also request deletion through the contact information below.
• Transport Security: All web traffic and camera captures require HTTPS and secure cookies.

BloodPulse is developed as an academic capstone software application. It does not claim third-party certifications, governmental endorsement, or formal compliance certifications that have not been independently audited. Features are provided in good faith for demonstration, educational, and operational management purposes.

If you have questions regarding this Privacy Policy, wish to access or update your information, or would like to request deletion of your account and personal data, please contact:

For account data deletion instructions, visit our dedicated User Data Deletion page.