Privacy & Data Protection Policy
Table of Contents
The Centre for Integrated Health Programs (CIHP) is committed to safeguarding the privacy, confidentiality, and integrity of personal and enterprise data processed through the CIHP Enterprise Resource Planning (ERP) Platform (available across Web browsers, Progressive Web App (PWA), and Desktop Client Executables).
This Privacy Policy explains how information is collected, stored, utilized, and protected when staff members, consultants, short-term hires, and authorized personnel access the CIHP Enterprise Portal.
1 Information We Collect
To provide internal enterprise management services, CIHP ERP processes the following data categories:
- Account Identification & Profile Data: Full legal name, corporate email address, staff identification number, department, position, phone number, and official profile photo.
- Authentication & SSO Credentials: Microsoft Entra ID OAuth tokens for single sign-on authentication, hashed passwords for short-term hires, and session identifiers.
- Operational & Administrative Records: Staff appraisal reviews, timesheet submissions, inventory tagging records, memorandum approvals, and financial requisition entries.
- System Audit & Technical Logs: IP address, browser user-agent, operating system details, access timestamps, and security event logs for compliance verification.
2 How Information is Used
Information collected within the CIHP ERP platform is strictly used for internal organizational operations:
Identity Verification
Authenticating authorized staff members and enforcing role-based access controls across departments.
Workflow Execution
Processing staff appraisals, requisitions, inventory asset verification, and supervisory memo approvals.
Security & Auditing
Monitoring unauthorized login attempts, contract expiration dates, and tracking administrative changes.
Compliance Reporting
Generating institutional reports required for grant oversight, HR audits, and operational accountability.
3 Security & Data Protection
We enforce robust technical and organizational measures to safeguard data against unauthorized access, loss, or alteration:
- Encryption in Transit: All web and API traffic is encrypted using Secure Sockets Layer (TLS 1.2 / TLS 1.3).
- Credential Protection: Passwords are stored using strong cryptographic hashing algorithms (`BCRYPT`).
- Session Security: HTTP-Only, Secure, and SameSite session cookies prevent session hijacking and cross-site scripting (XSS).
- Single Sign-On (SSO): Integration with Microsoft Entra ID ensures enterprise-grade multi-factor authentication.
4 Information Sharing & Third Parties
CIHP DOES NOT SELL, RENT, LEASE, OR MONETIZE ANY USER DATA.
Information is shared only with trusted institutional infrastructure providers required for system operations:
- Microsoft Entra ID / 365 Services: Used strictly for identity authentication and corporate single sign-on.
- Regulatory / Grant Auditors: Disclosed only when mandatory under applicable healthcare program oversight regulations or legal orders.
5 User Rights & Data Retention
Staff members have the right to inspect, update, and request corrections to their personnel profiles through the ERP Profile portal (`/profile.php`).
Operational records (such as timesheets, requisitions, and audit logs) are retained in accordance with CIHP institutional document retention policies and funding compliance mandates. Account termination automatically disables platform access and revokes active sessions.
6 Cookies & Local Storage
The platform uses essential cookies and local storage items solely for system functionality:
- `PHPSESSID`: Maintains authenticated user state during an active browser session.
- `erp_theme`: Remembers user theme preference (Light or Dark mode).
- No Tracking Cookies: The system does not use advertising, marketing, or cross-site behavioral tracking cookies.
7 Contact Information
If you have questions regarding this Privacy Policy or data handling within the CIHP ERP Platform, please contact: