This Privacy Policy applies when you use the ASRC 2027 website and abstract submission portal (the “Website”).

1. Who we are

The data controller is the Society of Medical Students of Chulabhorn International College of Medicine (SMO CICM), organiser of ASRC 2027, at Chulabhorn International College of Medicine, Thammasat University, 99/129 Moo 18 Phahon Yothin Rd., Khlong Nueng Subdistrict, Khlong Luang District, Pathum Thani 12120, Thailand (“we”, “us”, “the Organising Committee”).

Contact for privacy matters: smomedcicm+asrc@gmail.com

2. Personal data we collect

Information you give us

• Account details: email address and password. Your password is stored only in hashed form; we cannot see it.
• Profile details: title/prefix, first name, other names, last name, suffix, phone number, city, participant category (for example medical student, resident, faculty), position, specialty, department, and institution or affiliation. You may also upload a profile photo.
• Abstract submissions: title, research category, author list (names, affiliations, presenting author, faculty advisor), advisor details, abstract text, keywords, declarations you confirm, and any supporting files you upload (up to 5 files, 20 MB each).
• Affiliations you add: if your institution is not on our list, the details you enter for it.
• Your choices: your agreement to these policies and whether you want email updates about the conference.
• Messages to us: anything you send to our contact email.

Information about other people. When you list co-authors or advisors, you give us their names and affiliations. Please make sure they know you are submitting their details for ASRC 2027 and that they agree.

Information created by us or the system

• Account records such as when your account was created, when your email was verified, and the time of sign-in sessions.
• Abstract records such as submission and update times, review status, the reviewer’s decision and feedback to you, presentation category, and the abstract code.
• Internal reviewer notes about your abstract, which are visible only to authorised committee members.
• If the Organising Committee pre-registers you (for example, invited speakers or faculty), the details we entered for you, which link to your account when you sign up with the same email.

Technical information. To keep you signed in, the Website stores a login token in your browser’s local storage. Our hosting and backend providers keep standard server logs (such as IP address, browser type and request times) for security and troubleshooting. We do not use advertising or third-party analytics cookies.

Sensitive data. We do not ask for sensitive personal data such as health, religion or ethnicity. Please do not include such data, or any identifiable patient or research-participant data, in your profile, abstract or supporting files.

3. Why we use your data, and our legal basis

We do not sell your personal data and do not use it for automated decisions that have legal or similarly significant effects on you. Abstract decisions are made by people on the Academic Committee.

4. Who can see your data

• You: your own profile, abstracts and files.
• Organising and Academic Committee members: authorised staff, academic staff and administrators can see participant profiles and submissions to run registration and review. Access is limited by role.
• The public: if your abstract is accepted, its title, text, keywords, and the names and affiliations of its authors may be published in the conference programme, the abstract book and on the Website. Unaccepted abstracts, supporting files, contact details and reviewer notes are not published.
• Chulabhorn International College of Medicine and Thammasat University, where needed for conference administration, certificates or academic records.
• Service providers who process data on our behalf under contract, only for the purposes above:
  • Convex, Inc. — database, file storage and account login
  • Vercel Inc. — website hosting
  • Resend — sending emails
• Authorities, if required by law or to protect rights and safety.

5. Transfers outside Thailand

Our service providers may store or process data on servers outside Thailand, including in the United States. Where this happens, we rely on the providers’ contractual data protection commitments and security measures, as permitted under the PDPA and its rules on cross-border transfers, so that your data receives an adequate level of protection.

6. How long we keep your data

• Accounts, profiles and unaccepted submissions: until 2 years after ASRC 2027 ends, then deleted or anonymised.
• Accepted abstracts and author details: kept as part of the permanent conference record and publications.
• Draft abstracts: you can delete unsubmitted drafts at any time; otherwise they follow the account period above.
• Server logs: kept by our providers for their standard periods, usually no more than a few months.

We may keep data longer if the law requires it or if it is needed to deal with a complaint or an academic-integrity investigation.

7. Your rights

Under the PDPA you have the right to:

• access and get a copy of your personal data;
• ask us to correct inaccurate or incomplete data (you can edit most of your profile yourself);
• ask us to delete or anonymise your data, or to restrict its use;
• object to processing based on our legitimate interest;
• receive your data in a commonly used electronic format, or have it sent to another controller (data portability);
• withdraw consent at any time, for example to stop announcement emails, without affecting processing that already took place;
• complain to the Personal Data Protection Committee (PDPC) of Thailand.

To use any of these rights, email smomedcicm+asrc@gmail.com from the address linked to your account. We will reply within 30 days. Some requests may be limited; for example, deleting your account after your abstract is accepted may not remove it from material already published.

8. How we protect your data

We use encrypted connections (HTTPS), hashed passwords, email verification, and role-based access so that only authorised committee members can see submissions and participant details. No system is completely secure; if a personal data breach is likely to put your rights at risk, we will notify the PDPC and, where required, you.

9. Children

The Website is intended for university students, researchers and faculty. If you are under 18, please get your parent’s or guardian’s consent before creating an account. If we learn we hold a minor’s data without that consent, we will delete it.

10. Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date, and for significant changes we will tell registered users by email. See also our terms and conditions.

11. Contact us