Privacy Policy

“Bụt”, “we”, “us” refers to the Bụt health record & health management application, owned and operated by Heart Rate Technology Investment and Development Joint Stock Company (“Heart Rate JSC”). The website and application are developed by our technology partner BeaverX Technology.

“You”, “user” refers to any individual who creates an account or uses the Bụt application.

“Basic personal data” includes your full name, date of birth, gender, phone number, email, address, photos, and similar identifying information.

“Sensitive personal data” includes data about your health condition, medical history, drug allergies, prescriptions, test results, biometric indicators, and other medical data. This is the category of data Bụt processes most, and it is protected at the highest level.

“Data processing” means one or more operations performed on personal data: collection, recording, storage, editing, retrieval, use, sharing, encryption, or deletion.

“Data controller” is the party that determines the purposes and means of data processing. “Data processor” is the party that processes data on behalf of the controller, under a contract.

Depending on the features you use, Bụt may process the following categories of data:

• Account data: full name, date of birth, gender, phone number, email, profile photo, address.
• Health record data: medical history, chronic conditions, drug allergies, blood type, health metrics (blood pressure, heart rate, height, weight), prescriptions, medication history — including antibiotic history, test results, visit history, and medical documents you upload.
• Health data from Health Connect on Android devices, if you grant permission — see Article 3 for details.
• Family member data: if you create profiles for family members, the data categories listed above for those persons are also processed under the management of your account.
• Insurance referral data: information you provide when you register interest in an insurance plan, referral status, and any credit balance you are granted. Policy documents, claim files, and premium payment information are collected and managed by Affina and are not held in Bụt's systems.
• Usage and device data: device type, operating system, app version, error logs, in-app actions, IP address.
• Location data (optional): only when you grant permission, used to suggest pharmacies and healthcare facilities near you and to show health-related weather information. You can turn this off at any time in your device settings.

You are not required to provide all of the data above. If some data is missing, the related features may not work fully, but you can still use the application.

On Android devices, Bụt can connect to Health Connect to read health data you have recorded through other apps or wearable devices, so your health record is more complete without manual entry.

This connection is entirely optional. Bụt only accesses Health Connect after you actively grant permission, and only for the exact data types you consent to.

Data types Bụt requests read access to from Health Connect:

• Heart rate
• Blood pressure
• Weight
• Steps
• Sleep

Our commitments regarding Health Connect data:

• Read-only, no writing. Bụt does not write, edit, or delete any data in your Health Connect.
• Used only to display back to you in your health record and tracking charts within the app. This is the sole purpose.
• Not shared with any third party — including our insurance partner Affina, medical partners, and analytics services.
• Not used for advertising, marketing, or any form of user profiling for advertising purposes.
• Never sold to anyone, under any circumstances.
• Never transferred to data brokers, credit-scoring services, or for similar purposes.

You control this connection. You can revoke access at any time in the Health Connect settings on your device or in Bụt's settings. Once revoked, Bụt immediately stops reading new data. Previously synced data is deleted from Bụt's systems when you request deletion or when you delete your account, as described in Article 8.

Bụt's use of information received from Health Connect complies with Google's Health Connect Permissions policy, including the Limited Use requirements.

Bụt processes personal data for the following purposes:

• Creating and managing accounts, authenticating users.
• Building and maintaining your health record — the core purpose of the application.
• Medication reminders, follow-up visit reminders, and other health care reminders.
• Cross-checking new prescriptions against your antibiotic history to warn about antimicrobial resistance risks.
• Sharing your record with doctors, healthcare facilities, or family members — only when you actively initiate the sharing action.
• Suggesting hospitals, clinics, and pharmacies in our partner network.
• Referring you to insurance plans from our partner Affina when you actively express interest, and managing granted credits.
• Customer support, complaint handling, and responding to your requests.
• Improving product quality and fixing technical issues — using usage data and error logs; health data is not used for this purpose.
• Ensuring system security, detecting and preventing fraud and abuse.
• Sending service notifications. Marketing communications are sent only with your consent, and you can opt out at any time.
• Complying with legal obligations and lawful requests from competent state authorities.

Bụt does not use your health data for advertising purposes and does not process data beyond the list above without your consent.

The processing of your personal data is based on one or more of the following grounds:

• Your consent — in particular for health data (sensitive data), the Health Connect connection, location permission, and each time you share your record.
• Contract performance — to provide the services you have signed up for in the application.
• Legal obligations — where the law requires data to be retained or provided.
• Protection of life and health in emergency situations.

This policy is drafted in accordance with current Vietnamese law on personal data protection and sector-specific regulations on medical data.

Heart Rate JSC is the data controller. Your data may be shared with the following parties:

a) At your choice

• Doctors and healthcare facilities — only within the scope and duration you choose when sharing your record.
• Family members with whom you actively share your record or credits.
• Affina — insurance partner: only when you actively register interest in an insurance plan and consent at that time, and only including the information necessary for the registration. Bụt does not automatically send your health record to Affina. Once received, Affina acts as an independent data controller for the data used for the insurance contract — Affina's processing of that data is governed by Affina's own policy and falls outside the scope of this policy.

b) Technical service providers — acting as data processors, bound by confidentiality contracts and processing only under our instructions:

• Supabase — database and authentication infrastructure. This is where your health record is stored.
• Google Firebase Analytics and Firebase Crashlytics — measuring app usage and recording technical incidents. We do not send health data, record data, or Health Connect data to these services; only aggregated usage data, device information, and error logs.
• Open-Meteo — weather data provider. When you enable the related feature, approximate location coordinates are sent to this service to retrieve weather information, without any identifying information or health data.
• OpenStreetMap and CARTO — map data and imagery for displaying pharmacy and healthcare facility locations. These services only receive map tile requests, not your health record.

c) Competent state authorities — upon a lawful written request.

We do not sell your personal data to anyone, do not share health data for advertising purposes, and do not transfer data to data brokers.

Some of the infrastructure providers above operate servers outside Vietnam. In such cases, cross-border data transfers are carried out in accordance with Vietnamese law and with corresponding safeguards.

Collection: directly from you when you register, enter records, or upload documents; from Health Connect when you grant permission; automatically as you use the application; or from medical partners when you allow syncing.

Storage: in access-controlled database systems. Data is encrypted in transit and at rest.

Protection measures:

• Encryption of data in transit (TLS) and at rest.
• Least-privilege access control — staff can only access the data required for their work.
• Access logging for health records.
• Record-sharing links protected by a PIN and an expiry period; you can revoke them at any time.
• Periodic system security reviews and data backups.

We work to protect your data to the highest standard we can, but no system is absolutely secure. If an incident affecting personal data occurs, we will notify you and the competent authorities as required by law.

Data is stored from the time of collection until you request deletion or until the processing purpose has been fulfilled.

• You can request account deletion directly in the app or via the email address in Article 12.
• When you request account deletion, we will delete or anonymize your personal data — including your entire health record and data synced from Health Connect — within 30 days of confirming the request.
• You can also request deletion of only the data synced from Health Connect while keeping your account.
• Some data may be retained longer if required by law, or where necessary to resolve an ongoing dispute.
• Anonymized data that can no longer identify you may be retained for statistical purposes.

Note: deleting your Bụt account does not delete the original data in Health Connect on your device, nor data held by Affina under an insurance contract. Those are independent systems — you need to delete data directly in Health Connect, or send a request to Affina.

You have the right to:

• Know what data of yours is being processed and for what purposes.
• Access, view, and edit the data in your record.
• Withdraw consent you have given, at any time — including revoking Health Connect and location permissions.
• Revoke access to records you have shared with doctors or family members.
• Request deletion of your data or your account.
• Request restriction of, or object to, data processing.
• Request a copy of your data.
• Lodge complaints, report violations, or claim compensation in accordance with the law.

Withdrawing consent or deleting data may cause some features to stop working, and does not affect the lawfulness of processing carried out beforehand.

You are obliged to:

• Provide accurate information — inaccurate health data can create risks when doctors rely on your record.
• Keep your login credentials and record-sharing PINs confidential.
• Only create profiles for family members when you have the legal right or their consent; for minors or persons lacking legal capacity, you must be their legal guardian.
• Respect other people's data when records are shared with you.

Bụt is not intended for persons under 16 to register their own accounts. Children's health records may only be created and managed by a parent or legal guardian, and processing of such data requires the guardian's consent.

If we discover that we have collected a child's data without valid consent, we will delete that data as soon as possible. Please contact us if you believe this may have happened.

The Bụt website uses cookies and local storage to remember your login session, save your preferences, and measure performance at an aggregate level.

The mobile application may use device identifiers for similar purposes. You can clear cookies or reset your advertising identifier in your browser and device settings; some functions may not work fully afterwards.

To exercise the rights described in Article 9, request data deletion, report an incident, or file a complaint related to personal data, please contact:

• Owner and operator: Heart Rate Technology Investment and Development Joint Stock Company (Heart Rate JSC)
• Business registration number: 0319262930
• Address: 44 Nguyen Binh Khiem (extended), Tan Dinh Ward, Ho Chi Minh City, Vietnam
• Legal representative: Ms. Le Phuong Thao
• Email (personal data contact point): admin@heartrate.vn
• Application & website developer: BeaverX Technology

We respond to your requests within 72 working hours of receipt. For complex requests, processing may take longer and we will keep you informed.

We may update this policy when our services or legal requirements change. The latest version is always published on this page with its update date.

For material changes that significantly affect your rights — including changes to how health data or Health Connect data is processed — we will notify you via the app or email before they take effect. Your continued use of Bụt after the new policy takes effect means you have read and accepted the updated content.

This policy is an integral part of the Bụt Terms of Use (currently available in Vietnamese).

This Privacy Policy is provided in English and Vietnamese. The Vietnamese version is available here. In case of any discrepancy between the two versions, the Vietnamese version prevails for users in Vietnam.