Privacy Policy

1. Institutional Commitment & Scope

The Philippine Women's University (PWU) Ethics Review Board ("PWU ERB", "we", "us", or "our") operates the online Ethics Review Portal accessible at https://pwuthesisapp.zandaa.dev. This Privacy Policy describes our practices regarding the collection, storage, protection, and use of personal information submitted by students, faculty researchers, committee reviewers, and administrators in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and applicable institutional policies.

This application is exclusively designed for the academic thesis and research ethics clearance process of Philippine Women's University. By accessing or using the portal, you acknowledge and agree to the policies detailed herein.

2. Google OAuth 2.0 & Data Collected

To maintain institutional security and eliminate insecure password storage, the portal utilizes Google OAuth 2.0 Single Sign-On (SSO). We only permit authentication via official university Google accounts (@pwu.edu.ph).

We do not request, access, read, or store your Google Drive files, Gmail messages, Google Calendar, Google Contacts, or passwords.

3. Purpose of Processing

Information gathered through the portal is strictly used for the following operational and academic functions:

• Identity Verification: Authenticating research proponents and ensuring only verified PWU students and staff access research protocols.
• Ethics Application Management: Creating, routing, screening, and assessing ethics review submissions (e.g., Research Protocol, Informed Consent Forms, Curriculum Vitae).
• Reviewer Assignment & Decision Making: Enabling assigned committee members and the ERB Secretariat to comment, request revisions, and issue formal approvals.
• Certificate Generation: Generating official, tamper-evident ERB Certificates of Ethics Clearance bearing authorized control numbers and electronic signatures.
• System Notifications: Transmitting automated status notifications (via transactional email) regarding review milestones, reviewer comments, and certificate readiness.

5. Research Documents & Data Storage

Documents uploaded by students (research proposals, consent forms, data collection instruments) contain intellectual property and potentially sensitive research methodologies. All submitted files:

• Are stored in private, access-controlled directory partitions inaccessible via direct public web URLs.
• Are accessible only by the primary researcher, designated co-authors, assigned reviewers, and the ERB Chairperson/Secretariat.
• Are transmitted using Transport Layer Security (TLS 1.3 / HTTPS) encryption.

6. Service Providers

To provide transactional delivery and ensure infrastructure reliability, we partner with reputable service providers bound by strict data processing and confidentiality agreements:

• Google Identity Services: For secure OAuth 2.0 authentication.
• Resend Technologies, Inc.: For programmatic delivery of transactional email alerts (submission receipts, reviewer revision notifications).
• Sentry (Functional Software, Inc.): For error monitoring and system diagnostics. Logged error context automatically scrubs sensitive data.

7. Data Retention & User Rights

Under the Data Privacy Act of 2012, you possess clear rights concerning your personal information:

• Right to Access: You can review your profile, submitted protocols, reviewer remarks, and issued certificates directly inside your dashboard.
• Revocation of Google Access: You may revoke the portal's access to your Google account at any time via your Google Account Security Permissions.
• Right to Erasure / Deletion: You may submit an account or document deletion request by contacting the ERB Secretariat. Academic archiving standards established by the Commission on Higher Education (CHED) and university research retention mandates may require retaining issued clearance certificates and signed protocols for auditing periods.