Privacy Policy

1. Our approach

BloodPk handles information that is sensitive by nature: your blood type, your city, your contact details, and documents relating to blood donations. We collect the minimum needed to connect a person who needs blood with someone willing to donate it, and we do not publish your contact details to anyone without your explicit, channel-by-channel permission.

2. Information we collect

Account information

Your name, email address, WhatsApp number, an optional secondary phone number, your city, and a password. Passwords are never stored as text.

Donor information

If you register as a donor: your blood type, your availability preferences, your donor status, your contact preference, and your permissions controlling which contact channels may be shared. We also keep counts of your administrator-verified donations.

Request information

If you create a blood request: the blood type required, the city, the hospital, the urgency, the volume required, when it is needed, and any notes you add. Please do not include diagnoses or other medical details in the notes field - the platform does not need them.

Donation proof documents

If you upload proof of a donation, such as a hospital slip or blood bank receipt, we store the file so an administrator can verify the donation. These files are treated as confidential. See section 5.

Activity and technical information

We record security-relevant events in an audit log: sign-ins and failed sign-in attempts, verification, profile and permission changes, contact releases, donation verification, and administrator actions. These records may include your IP address and browser user agent. We never write passwords, verification codes, reset tokens, or session tokens to logs.

3. Why we collect it

• To match compatible donors to requests by blood type and city.
• To verify that an account belongs to a real, reachable person.
• To let two people who have both agreed to make contact reach each other.
• To verify donations so that only confirmed donations count towards rankings.
• To investigate abuse, fraud, and misuse of contact information.
• To keep the service secure and operating.

4. Cookies

BloodPk sets one cookie: a session cookie that keeps you signed in. It is marked HttpOnly, so scripts running in your browser cannot read it, and it is restricted to this site. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

5. How we protect information

• Passwords are hashed with a memory-hard algorithm (scrypt) and a unique salt for each account. We cannot read your password, and we cannot tell you what it is.
• Sign-in sessions are stored only as a cryptographic hash, so a copy of our database could not be used to impersonate you.
• Donation proof files are stored outside the public web area. There is no web address that serves them. They can only be opened by an administrator through an authorised, audited route.
• Access to personal data is checked on our servers on every request, not merely hidden in the interface.
• Sensitive actions are rate limited to resist automated abuse.

6. What we share, and when

We do not sell personal information, and we do not publish donor contact details.

Search results and public donor pages show an abbreviated name, such as "Ali R.", along with blood type, city, availability, and verified donation counts. They never contain your email address, WhatsApp number, secondary phone number, or full name.

Your contact details are released to a specific requester only when all of the following are true:

• You and that requester are matched to the same blood request.
• Both of you have separately confirmed that contact was made.
• You have permitted that specific channel, such as WhatsApp or phone.

If you choose "contact me first" or in-platform contact only, no phone number is released at all, even after a confirmed match. Every release is written to the audit log. You can withdraw a permission at any time in your settings; withdrawing it stops future releases, though it cannot retrieve details someone already received.

7. Third parties

We use a small number of service providers to operate the platform. Where a provider is configured, the data described is shared with it only for that purpose.

• WhatsApp messaging provider - receives your WhatsApp number and the verification message, so that a code can be delivered to you.
• Human verification (CAPTCHA) provider - receives a verification token and your IP address when you register, to distinguish people from automated scripts.
• Hosting and storage provider - stores the database and uploaded files on our behalf.

If payment or email providers are introduced later, this section will be updated before they are used.

8. Your choices and controls

• Update your name, city, and phone numbers from your profile.
• Change your contact permissions and preferred channel at any time.
• Set your donor status to busy or temporarily unavailable, or remove yourself from search results entirely, without deleting your account.
• Change your password, which signs you out on every other device.
• Request a copy of your data, or request deletion of your account.

9. Retention and deletion

We keep account information while your account is open. When you ask us to delete your account, we remove your profile, donor details, and requests. Some records are kept longer where we must: security and audit records, and records relating to an investigation of fraud or abuse. Verification codes and password reset tokens are short-lived and expire automatically.

10. Children

BloodPk is not intended for children. Blood donation is subject to minimum age requirements set by the collecting facility and by law. Do not create an account if you are below the age of majority in your jurisdiction.

11. Where your data is handled

Our providers may process data in countries other than your own. The platform is built so that additional obligations under applicable privacy laws can be accommodated as it grows. Specific hosting locations and legal bases should be completed by the operator before production use.

12. Changes to this policy

If we make a material change, we will update the date at the top of this page and, where the change significantly affects how your information is shared, notify you in the platform.

13. Contacting us

For any privacy request - access, correction, deletion, or a complaint - use the contact page. The operator of this platform must publish a monitored contact address here before production use.

See also our Terms of Service and Medical Disclaimer.