Privacy Policy

HRPETH is operated by BOSIA Technology, [registered address] ("HRPETH", "we", "us"). We decide how and why personal information on the Service is used, and we are responsible for it, except as explained below.

This policy covers the website at hrpeth.com, the HR-Peth mobile app and the HRPETH API. When you apply for a job, the employer you apply to receives your application and becomes separately responsible for how it uses that information (for example in its own hiring records). The employer's own privacy practices then also apply.

Questions or requests about your information: [privacy e-mail].

We collect only what the Service needs. Depending on how you use it:

Account

Your name, e-mail address and password (stored only as a one-way hash), whether your e-mail is verified, your language, the version of these terms you accepted and when, and, if you turn it on, your two-step verification settings (stored encrypted).

Professional profile

What you choose to add: display name, headline, summary, phone number, photo, location (country, province, city), profession and specialty, experience, education, skills, languages, availability, employment status, salary expectations and job preferences, and your visibility and contact-sharing choices.

Licences, certificates and documents

Licence and certification details (including licence numbers, which we store encrypted), and files you upload such as your CV and copies of licences, certificates and degrees.

Jobs and applications

Jobs you save, your job alerts, and each application: the cover note, the CV you chose, the contact details you agreed to share, a copy of your profile at the time you applied, and the application's status history.

Recruitment information from employers

When an employer handles your application, it may record interviews (times, place or meeting link), offers (job title, salary, start date) and its own internal notes and assessments. Internal notes and assessments are never shown to you.

Verification

When a record is checked, copies of the documents used as evidence, the details being checked and the reviewer's decision and notes.

Employers and their teams

Organization details and verification documents (business registration, healthcare licence), and for each team member: name, e-mail, role and invitations.

Mobile app

If you turn on push notifications: a random installation ID made by the app (not a hardware or advertising ID), your device platform, the push token, the app version and language. The app keeps your sign-in in your phone's secure storage.

Security and technical records

IP address and browser or device type for your sign-in sessions and for our security log, which records important actions (for example sign-ins, changes to your profile or visibility, and each time an employer opens your application, CV or contact details). We also keep limited technical logs and error reports with personal details removed.

We do not ask for your national ID or passport number, date of birth, age, gender, marital status, religion or nationality, and you should not include them. We do not use page-view tracking, analytics tools, advertising pixels or third-party trackers. Usage statistics in the Service are calculated from the data described above, are shown only in aggregate, and groups of fewer than three people are never shown.

• To create and secure your account, sign you in and keep you signed in.
• To show your profile to employers only as your settings allow, and to send your applications to the employers you choose.
• To let employers publish jobs, manage applications and, on eligible plans, find professionals.
• To check licences, certificates and employer documents when verification is requested.
• To send the notifications you choose (in the app, by e-mail and by push), job alerts and messages we must send (for example about your account's security or status).
• To prevent fraud, spam, scraping and misuse, enforce our Terms and keep a record of who accessed sensitive information.
• To keep the Service working, fix problems and improve it, using aggregate figures where possible.
• To meet legal obligations and respond to lawful requests.

We do not sell your personal information, rent it, or use it for advertising. We do not make decisions about you based solely on automated processing; Talent Search filters only help employers find profiles.

We use personal information where it is needed to provide the Service you asked for under our Terms; where you have given consent (for example to make your profile visible to employers, to share your phone number in an application, to share your contact details with paying employers, or to receive push notifications), which you can withdraw at any time; where it is in our legitimate interests to keep the Service safe and working, in ways that do not override your rights; and where the law requires it. [Counsel to confirm the applicable law and how it treats health-related professional data.]

The public

Nothing about professionals. There is no public directory of candidates. Published jobs and verified employers' public details are public.

Employers searching for talent

Only if you choose to make your profile visible. Your profile is private by default. If visible, team members of verified employers on an eligible plan can see your name, headline, summary, profession, experience, education, skills, languages, credentials and whether they are verified, general location, availability and preferences. They never see your e-mail, phone, photo, CV or documents, salary expectations or licence numbers in search. Each time they open your profile it is recorded.

Employers you contact-share with

If you also turn on contact sharing, employers on a paid plan can open your e-mail and phone number to contact you about jobs, up to a monthly limit. You can see the list of employers who opened your contact details, and turn sharing off at any time.

Employers you apply to

Only that employer, and only its team members with a role allowing it, sees your application: a copy of your profile at the time you applied (with your licence number partly hidden), the CV you chose, your account e-mail and your phone number only if you ticked the box. Each time they open it or your CV it is recorded.

HRPETH staff

Reviewers see the record being verified and its evidence, and each document opened is recorded. Other staff access personal information only when needed to support you, secure the Service or meet legal obligations.

E-mail addresses, phone numbers, links and messaging handles typed into profile text are blocked or hidden from employers, so your contact details are shared only in the ways above.

We use a small number of providers who process information on our behalf, under contracts that allow them to use it only to provide their service to us:

Hosting and database

[Hosting provider], in [region / country].

File storage

[Object storage provider], in [region / country], with encryption at rest.

E-mail delivery

[E-mail provider] sends our account and notification e-mails.

Push notifications

Expo (Expo Push Service), and through it Apple Push Notification service and Google Firebase Cloud Messaging, receive your push token and the short notification text. Push messages never include your name, salary, licence numbers, interview details or job titles.

Error monitoring

[Error monitoring provider] receives error reports with personal details removed.

Fonts are served from our own servers, so visiting the website does not send your information to font providers. Virus scanning of uploaded files runs on our own servers. We may disclose information if required by law or a valid legal request, to protect the rights, safety or property of users or others, or to a company that takes over the Service (which will be bound by this policy).

Your information is stored in [region / country]. Some providers, such as push notification services, may process it in other countries. Where we transfer information abroad we use providers with appropriate safeguards and contracts. [Counsel to confirm transfer requirements.]

We use only what the Service needs to work. We do not use analytics, advertising or social media cookies.

hrpeth.session_token

Keeps you signed in (7 days, renewed while you use the Service). Secure and not readable by scripts.

Two-step verification cookie

Remembers, for a few minutes, that you are part-way through signing in with two-step verification.

hrpeth.accountType (browser storage)

Remembers whether you last chose "professional" or "organization" on the sign-in page, to send you to the right place. It stays on your device.

Mobile app secure storage

The app keeps your sign-in, your language choice and its installation ID in your phone's secure storage.

The language of the website comes from its address (/km for Khmer), not from a cookie.

Your account and profile

As long as your account is open.

When you delete your account

Your other sessions end and your profile is hidden at once. After a grace period (currently 14 days) in which you can cancel, we erase your sign-in details, name and e-mail, your whole profile, all your uploaded files, verification records, saved jobs, alerts, notifications, preferences and devices.

Applications you sent

Kept by the employers that received them, with your name and contact details removed when you delete your account. What remains (job, dates, status and history, your profession and years of experience) is kept for [retention period] so employers and HRPETH can keep accurate recruitment records. Notes, interviews and offers written by employers stay with the employer.

Verification evidence

[retention period], or until you delete your account.

Notifications

[retention period], or until you delete your account.

Push registrations

Removed when you sign out, reset your password or delete your account, and after 90 days without use.

Security log

[retention period]. After account deletion, entries refer to you only by a random ID, with the IP address and device type.

Technical logs and error reports

[30 days / provider default].

Backups

Encrypted backups are kept for [14 days]; deleted information disappears from them when they expire.

Jobs

Listings close automatically 60 days after publication unless renewed, and remain with the employer's account.

• Encrypted connections (HTTPS) for the website, app and API.
• Passwords stored only as one-way hashes; licence numbers and verification details encrypted in the database; two-step verification available to everyone and required for staff.
• Uploaded files are scanned for viruses before anyone can open them, are never given public links, and can be downloaded only by people allowed to see them.
• Access is checked on every request, employers can see only their own organization's information, and access to sensitive information is recorded.
• Limits on sign-in attempts, searches and downloads to stop guessing and scraping.
• Encrypted backups, and staff access only when needed.

No system is completely secure. If a breach affects your information, we will tell you and the relevant authorities where the law requires and as quickly as we reasonably can.

• See and correct your information: in your profile, applications and account settings.
• Choose who can find you: your profile visibility and contact sharing settings, which you can change at any time.
• Choose your notifications: per category for e-mail and push. Messages about your account's security or status are always sent.
• Delete your account: in the mobile app (Account, then Delete account), or by writing to [privacy e-mail].
• Get a copy of your information: write to [privacy e-mail]. We will reply within [30] days.
• Withdraw consent you gave (for example contact sharing) at any time. This does not affect what was done before.
• Object to or ask us to limit some uses, or complain to us at [privacy e-mail]. You may also have the right to complain to a data protection authority.

We may need to confirm your identity before acting on a request. If you applied for a job, requests about how that employer uses your application should also be sent to the employer.

The Service is for professionals and employers and is not intended for anyone under [18]. We do not knowingly collect information from children. If you think a child has created an account, please contact us and we will delete it.

We will update this policy when the Service or the law changes. The version number and effective date are shown at the top of this page. If a change affects how we use your information in a significant way, we will tell you by e-mail or in the Service before it takes effect.

Privacy questions and requests

[privacy e-mail]

Postal address

BOSIA Technology, [registered address]

This policy is written in English. Where we provide a translation, the English version prevails if they differ.