Legal
Privacy Policy
Last updated: 11 October 2026
This policy explains how the Suandok Bioinformatics Unit (SBU), Center of Multidisciplinary Technology for Advanced Medicine (CMUTEAM), Faculty of Medicine, Chiang Mai University ("we", "us") handles personal data when you use the Suandok Imputation Server at sis.suandok-bioinformatics.org (the "Service") and this website. We process personal data in line with Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).
1. Who is responsible
The data controller is the Suandok Bioinformatics Unit, Faculty of Medicine, Chiang Mai University, 110 Intawaroros Road, Sri Phum, Mueang, Chiang Mai 50200, Thailand. Contact: apiwat.sang@cmu.ac.th.
2. What we collect
- Account information — username, full name, email address and a securely hashed password. If you sign in with Google or Microsoft, we receive only your name, email address and a unique account identifier from that provider; we never see your Google or Microsoft password.
- Uploaded data — the genotype files (VCF) you submit for imputation, and the parameters you choose (reference panel, genome build, phasing method).
- Results — imputed genotypes, quality-control reports, logs and a technical infrastructure report (compute instances used, run time, estimated cost; it contains no personal data).
- Technical data — IP address, browser type, and request times in server logs, used for security and troubleshooting.
3. Genetic data
Genotype data is sensitive personal data under the PDPA. The Service is designed for de-identified research data:
- Upload only data you are authorised to process, collected with appropriate participant consent and ethics approval.
- Remove names, hospital numbers and other direct identifiers from sample IDs before uploading.
- We use uploaded data only to run the analysis you request. We do not view, share, sell, re-identify or reuse your data for our own research, and we do not add it to any reference panel.
4. Why we use your data (legal basis)
- To provide the Service you request — run imputation jobs, deliver results, manage your account (performance of a contract / your request).
- To send service emails such as account activation, password reset and job-completion notices.
- To keep the Service secure, prevent misuse and fix problems (legitimate interests).
- To produce anonymous usage statistics (for example, number of jobs or samples) for reporting to funders. These statistics never identify you or your samples.
5. Where your data is stored and processed
- The web server, your uploads, results and the imputation computation run on Amazon Web Services in the Asia Pacific (Bangkok) region, Thailand. Temporary intermediate files are stored in an encrypted, private Amazon S3 bucket in the same region and are deleted automatically after 2 days.
- Service emails are sent through Amazon Simple Email Service in Singapore; only your email address and the message content leave Thailand for this purpose.
- If you use Google or Microsoft sign-in, those providers process your sign-in under their own privacy policies.
- All connections use HTTPS encryption. Access to servers is restricted to authorised SBU staff.
6. How long we keep data
- Uploaded files and results are deleted automatically 5 days after your job finishes. When the job finishes we email you the deletion date. You can delete a job and its files earlier at any time from the Jobs page.
- Temporary compute files are deleted automatically after 2 days.
- Account information is kept while your account is active. Ask us to delete your account at any time.
- Server logs are kept for a limited period for security purposes.
7. Sharing
We do not sell or rent personal data. We share it only with service providers that run the Service on our behalf (Amazon Web Services for hosting, computing and email; Google and Microsoft only if you choose their sign-in), or when required by law.
8. Cookies
The Service uses a session token in your browser to keep you signed in. We do not use advertising or tracking cookies. This website loads fonts from Google Fonts, which receives your IP address when you visit.
9. Your rights
Under the PDPA you may request access to, correction of, deletion of, or a copy of your personal data, object to or restrict its processing, and withdraw consent. Email apiwat.sang@cmu.ac.th; we will respond within 30 days. You may also complain to Thailand's Personal Data Protection Committee.
10. Changes
We may update this policy. The "Last updated" date above shows the latest version; significant changes will be announced on the Service.