Privacy Policy

Marine Health ("we", "us") operates the Marine Health Statistics Portal at stat.marinehealth.asia (the "Service"). This Privacy Policy describes how we collect, use, and protect information when authorized partners and employees use the Service, including when the Service is embedded as a Microsoft Teams tab.

1. Scope

The Service is a private, access-controlled analytics tool. It is not a consumer product. Access is granted only to registered Marine Health partners and staff members.

2. Information We Collect

• Authentication identifiers. When you sign in via Marine Health SSO, Microsoft Teams SSO (Azure Active Directory), or with an employee login, we process your user ID, email address, display name, and assigned role.
• Business data. Partner turnover (PV), structure (downline tree), marketing period statistics, and related KPI figures displayed in the dashboard. This data originates from Marine Health internal systems and is shown only to users authorized to view it.
• Technical data. IP address, user agent, request timestamps, and audit-log events (successful and failed logins, token verifications, administrative actions). We do not use third-party analytics or advertising trackers.
• Chat and AI interactions. If you use the in-product AI assistant, your questions and a limited set of derived user facts (preferred language, last topic) may be stored to improve response quality.

3. How We Use Information

• To authenticate you and authorize access to dashboards appropriate for your role.
• To display your business statistics and those of partners you are entitled to view.
• To detect abuse, enforce rate limits, and investigate security incidents via audit logs.
• To operate and improve the Service.

4. Legal Basis

We process personal data on the basis of the contractual relationship between you and Marine Health (as a partner or employee), our legitimate interest in operating a secure internal analytics platform, and, where required, your consent.

5. Sharing

We do not sell personal data. We share data only with service providers strictly necessary to operate the Service (cloud hosting, database, Microsoft Azure Active Directory for Teams SSO, OpenAI API for AI assistance of content you submit). These providers process data under appropriate agreements and security controls.

6. Retention

• Authentication tokens: valid until expiry or manual revocation.
• Audit logs: up to 12 months, then rotated.
• Business data: for the duration of your partnership or employment plus applicable legal retention periods.
• Chat history and AI user facts: up to 180 days unless you request earlier deletion.

7. Security

We use HTTPS for all connections, bcrypt for employee password storage, short-lived authentication tokens, rate limiting, and server-side validation of all tokens (including JWTs issued by Microsoft Azure AD for Teams SSO). Access to production infrastructure is restricted to authorized engineers.

8. Your Rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, as well as restriction of processing or data portability. To exercise these rights, contact us at the address below.

9. Microsoft Teams Integration

When the Service is accessed through Microsoft Teams, we receive a signed identity token issued by your Microsoft 365 tenant (Azure AD). We validate this token using Microsoft's public keys and extract your email and object ID solely to identify your existing account in our system. We do not read your Teams messages, calendars, files, or any Microsoft Graph resource beyond your basic identity.

10. Cookies

The Service uses browser localStorage to store your session token. It does not set advertising or tracking cookies.

11. Children

The Service is not directed to children under 16 and does not knowingly collect their personal information.

12. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service.

13. Contact

Questions, requests, or complaints concerning this Privacy Policy should be sent to privacy@marinehealth.asia.