SYCVAC Platform Users' Privacy Policy

Part I — Introduction, Scope, Information Collection, and Data Sources

1. Introduction

Welcome to the SYCVAC Platform ("SYCVAC," "we," "our," or "us").

SYCVAC is a global digital health platform designed to support secure immunization management, digital health credentials, healthcare interoperability, and public health initiatives through modern, scalable, and secure technologies. The Platform provides individuals and authorized organizations with digital tools to create, manage, verify, and exchange immunization information while maintaining strong privacy protections, data security, and compliance with applicable healthcare and data protection regulations.

The SYCVAC Platform enables:

• Individuals to securely access, manage, store, and share their lifelong digital immunization records and vaccination credentials;
• Healthcare providers and healthcare organizations are to document, verify, update, and securely exchange immunization information;
• Ministries of Health, national immunization programs, and public health authorities to strengthen immunization management, improve data quality, support population health planning, and enhance public health preparedness;
• Authorized institutions and verification entities to securely validate immunization credentials for permitted purposes, including healthcare services, education, employment, humanitarian programs, travel-related requirements, and emergency response activities.

SYCVAC is designed around principles of privacy-by-design, security-by-design, interoperability, and responsible health data governance. The Platform incorporates technical and organizational safeguards intended to protect personal information, protected health information (PHI), and immunization data throughout its lifecycle, including collection, processing, storage, exchange, verification, and deletion.

This Privacy Policy explains how SYCVAC collects, uses, processes, stores, shares, protects, and safeguards personal information when you access or use SYCVAC products, applications, digital credentials, services, and related technologies.

This Privacy Policy describes:

• The types of information SYCVAC collects;
• The sources from which information may be obtained;
• The purposes for which information is processed;
• How information may be shared with authorized entities;
• The security measures used to protect information;
• Your privacy rights and choices;
• The responsibilities of healthcare providers and organizations using the Platform;
• How SYCVAC supports national and international immunization initiatives while respecting applicable privacy, healthcare, and data protection laws.

This Privacy Policy applies to all users of the SYCVAC Platform, including individuals, healthcare professionals, healthcare organizations, government health entities, and authorized institutions, unless a separate privacy notice, contractual agreement, or specific service-level privacy framework expressly governs a particular SYCVAC product, deployment, or service.

By using the SYCVAC Platform, you acknowledge that you have reviewed this Privacy Policy and understand how your information may be collected, processed, protected, and used in accordance with the principles described herein and applicable legal requirements.

SYCVAC is committed to building a trusted global digital immunization ecosystem that empowers individuals, strengthens healthcare delivery, supports public health systems, and protects the privacy and security of immunization information worldwide.

2. Purpose of this Privacy Policy

The purpose of this Privacy Policy is to provide transparency regarding how SYCVAC collects, processes, uses, protects, and governs personal information, vaccination records, and related health data within its digital immunization ecosystem.

This Privacy Policy explains:

• What Information SYCVAC Collects — The categories of information collected through the SYCVAC Platform include personal information, immunization records, healthcare-related information, device-generated information, account information, and other data necessary to provide secure digital vaccination services.
• How Information Is Collected — The methods through which information may be collected include information provided directly by users, information entered by authorized healthcare providers, data synchronized from authorized immunization information systems, device-generated technical information, and other authorized sources.
• Why Information Is Collected — The purposes for collecting information include creating and maintaining lifelong digital immunization records, generating digital immunization credentials, supporting healthcare continuity, improving platform security and performance, enabling interoperability, and supporting legitimate public health activities.
• How Information Is Used — How SYCVAC uses information to provide, operate, secure, improve, and maintain the Platform, including vaccination record management, credential generation, identity verification, healthcare support, analytics, research, and public health initiatives where legally permitted.
• When Information Is Shared — The circumstances under which information may be shared with authorized healthcare providers, public health authorities, national immunization systems, interoperability partners, service providers, or other authorized entities in accordance with applicable laws, user permissions, and data governance requirements.
• How Information Is Protected — The technical, administrative, and organizational safeguards implemented by SYCVAC to protect personal information and protected health information (PHI), including encryption, access controls, identity verification, security monitoring, audit logging, disaster recovery measures, and privacy-by-design principles.
• Your Privacy Rights — The rights available to users regarding their information, including rights related to access, correction, transparency, consent management, account control, and other privacy protections provided under applicable data protection laws.
• The Responsibilities of Healthcare Providers Using the Platform — The obligations of authorized healthcare providers regarding identity verification, accurate record submission, appropriate access to patient information, confidentiality, and compliance with applicable healthcare standards and regulations.
• How SYCVAC Supports National and International Public Health Initiatives — How SYCVAC enables secure digital immunization management, interoperability, epidemiological analysis, and public health preparedness while respecting individual privacy, data protection requirements, and applicable national and international regulations.

SYCVAC is committed to maintaining a trusted digital immunization infrastructure that balances individual privacy protection, secure health information management, healthcare interoperability, and global public health objectives. This Privacy Policy reflects SYCVAC's commitment to transparency, responsible data stewardship, and the protection of individuals' rights throughout the lifecycle of their immunization information.

3. Scope of the SYCVAC Platform

The SYCVAC Platform consists of multiple interoperable healthcare services designed to operate independently or together depending on deployment requirements.

The Platform may be deployed directly to individuals, healthcare providers, hospitals, healthcare systems, ministries of health, governmental agencies, humanitarian organizations, or international public health institutions.

The Platform currently includes:

3.1 Digital Immunization Passport

The Digital Immunization Passport provides individuals with a secure, portable, electronic record of vaccination status that may be presented for purposes permitted under applicable law, including:

• international travel;
• border entry;
• educational enrollment;
• employment verification;
• occupational health;
• humanitarian assistance;
• healthcare services;
• public health emergency response.

Whenever technically feasible, verification is performed using minimum-disclosure principles that allow validation of credential authenticity without exposing unnecessary medical information.

3.2 Digital Immunization Record

The Digital Immunization Record is a lifelong electronic immunization record that securely stores vaccination history throughout an individual's lifetime.

Records may include:

• childhood immunizations;
• adult immunizations;
• booster vaccinations;
• travel vaccines;
• occupational vaccinations;
• military vaccinations;
• emergency vaccination campaigns;
• future immunization recommendations.

Healthcare providers may update records only when properly authorized.

3.3 Digital Immunization Credential

The Digital Immunization Credential is a cryptographically signed digital credential designed to enable secure verification of vaccination status.

The credential may support:

• QR Codes;
• SMART Health Cards;
• W3C Verifiable Credentials;
• HL7 FHIR resources;
• WHO Digital Documentation standards;
• national credential frameworks;
• future interoperable credential technologies.

Credential verification is designed to minimize disclosure of protected health information whenever possible.

3.4 Outbreak Epidemiological Surveillance

The SYCVAC Platform supports authorized epidemiological surveillance using de-identified, aggregated, or legally reportable health information to assist public health authorities in:

• vaccine coverage monitoring;
• outbreak detection;
• disease surveillance;
• epidemiological modeling;
• vaccination campaign planning;
• vaccine inventory forecasting;
• public health preparedness;
• health equity analysis;
• emergency response.

Whenever feasible, surveillance activities use de-identified or aggregated information rather than directly identifiable personal information.

4. Information We Collect

Depending on the services you use, SYCVAC may collect the following categories of information.

4.1 Identity Information

Identity information may include:

• full legal name;
• preferred name;
• date of birth;
• sex or gender (where applicable);
• government-issued identification numbers;
• passport information when required;
• national identification numbers where permitted by law;
• patient identification numbers;
• healthcare provider identification numbers.

4.2 Contact Information

We may collect:

• email address;
• telephone number;
• mailing address;
• emergency contact information;
• preferred communication language;
• country of residence.

4.3 Healthcare Provider Information

Healthcare provider accounts may include:

• professional license number;
• licensing jurisdiction;
• medical specialty;
• healthcare organization;
• employer;
• professional credentials;
• license expiration date;
• verification status;
• digital signature information.

4.4 Vaccination and Immunization Records

Immunization information may include:

• vaccine name;
• manufacturer;
• lot number;
• dose number;
• administration date;
• administration site;
• administration route;
• administering healthcare provider;
• administering a healthcare facility;
• vaccine expiration date;
• vaccine funding source where applicable;
• immunization schedule.

4.5 Tuberculosis Records

Where applicable, SYCVAC may collect information related to the Red Immunization Card (RIC) program, including:

• Tuberculosis (TB) skin test results;
• IGRA laboratory results;
• chest radiography documentation;
• treatment status;
• treatment completion dates;
• related clinical documentation.

4.6 Medical Exemptions

Where authorized, the Platform may record:

• permanent medical exemptions;
• temporary exemptions;
• contraindications;
• allergy documentation;
• physician certifications;
• exemption expiration dates.

4.7 Device Information

We may automatically collect:

• IP address;
• browser type;
• operating system;
• device identifiers;
• application version;
• operating system version;
• crash reports;
• security logs.

4.8 Location Information

With your permission or where authorized by applicable law, we may collect:

• approximate location;
• GPS location;
• country;
• state or province;
• city;
• healthcare facility location;
• vaccination site location.

Location data may assist public health surveillance, epidemiological analysis, and fraud detection.

4.9 Verification Logs

We maintain secure logs documenting:

• credential issuance;
• credential verification;
• credential revocation;
• authentication events;
• login history;
• security events;
• administrative actions.

4.10 Artificial Intelligence Interaction Data

If you interact with AI-assisted features, we may collect:

• prompts;
• responses;
• system interaction history;
• feedback;
• quality improvement information.

4.11 Public Health Reporting Data

Where required by law, we may process information necessary to support:

• mandatory disease reporting;
• vaccination reporting;
• adverse event reporting;
• national immunization registries;
• public health surveillance systems;
• outbreak investigations.

5. How We Collect Information

We collect information from multiple authorized sources to ensure the integrity and accuracy of immunization records.

5.1 Information You Provide

You may provide information when you:

• create an account;
• update your profile;
• upload vaccination documentation;
• communicate with customer support;
• participate in surveys;
• report technical issues.

5.2 Information Entered by Authorized Healthcare Providers

Authorized healthcare providers may enter, update, validate, or confirm vaccination information within the SYCVAC Platform after appropriately verifying an individual's identity and administering, documenting, or confirming immunization services in accordance with applicable healthcare practices and regulatory requirements.

Healthcare provider-entered information may include, where applicable:

• Vaccine name, manufacturer, and product information
• Date and location of vaccine administration
• Dose number and vaccination series information
• Healthcare provider or organization identification
• Lot number, expiration date, and administration details when available
• Clinical documentation related to immunization services
• Other information required to maintain an accurate immunization record

Healthcare providers are responsible for ensuring that information submitted to SYCVAC is accurate, complete, timely, and consistent with the services provided. Providers must follow applicable professional standards, immunization reporting requirements, and organizational policies when entering or modifying vaccination records.

SYCVAC may implement verification and security controls to support the integrity of provider-submitted information, including:

• Healthcare provider authentication and account validation
• Verification of authorized healthcare organizations
• Role-Based Access Control (RBAC) and permission management
• Audit logging of record creation, updates, and access activities
• Monitoring of suspicious or unauthorized modifications
• Data validation mechanisms to improve record quality

Healthcare providers remain responsible for the clinical accuracy of the vaccination information they submit. SYCVAC provides a secure digital infrastructure to store, manage, and exchange immunization records but does not independently replace the professional judgment, documentation responsibilities, or regulatory obligations of licensed healthcare providers.

Where permitted by law, SYCVAC may facilitate corrections, updates, and verification workflows to maintain accurate lifelong immunization records while preserving the integrity, traceability, and security of vaccination information.

5.3 Government Immunization Registries

Where authorized, SYCVAC may receive information from:

• national immunization registries;
• state or provincial immunization information systems;
• ministries of health;
• governmental vaccination databases.

5.4 Electronic Health Records (EHR/EMR)

SYCVAC may exchange information with authorized Electronic Health Record (EHR) and Electronic Medical Record (EMR) systems using secure interoperability standards.

5.5 National Immunization Information Systems

SYCVAC may exchange or synchronize vaccination information with authorized National Immunization Information Systems (NIIS), Immunization Information Systems (IIS), Electronic Health Records (EHRs), Health Information Exchanges (HIEs), and other approved public health platforms to improve data quality, strengthen immunization program management, and support continuity of care.

Where legally authorized and technically implemented, interoperability with national immunization systems may support:

• Improved Data Quality and Accuracy — Synchronization helps ensure that vaccination records are complete, consistent, and up to date by reducing incomplete entries, identifying inconsistencies, and improving the reliability of immunization information.
• Duplicate Record Identification and Resolution — Data exchange mechanisms may assist authorized health authorities and healthcare providers in identifying potential duplicate vaccination records and consolidating information to maintain accurate lifelong immunization histories.
• Continuity of Care — Secure access to verified immunization information enables healthcare professionals to make informed clinical decisions, identify missing vaccinations, reduce unnecessary repeat vaccinations, and support preventive healthcare throughout an individual's lifetime.
• Public Health Program Support — Interoperability may assist authorized public health organizations in monitoring vaccination coverage, evaluating immunization campaigns, managing vaccine programs, and responding to emerging public health needs.
• Cross-System Interoperability — SYCVAC is designed to support recognized healthcare interoperability frameworks and standards, which may include: HL7 Fast Healthcare Interoperability Resources (FHIR); Secure API-based data exchange; OAuth 2.0 authorization frameworks; Digital identity and authentication mechanisms; Other nationally or internationally recognized health information exchange standards.

Data synchronization with National Immunization Information Systems is performed only with authorized entities, under appropriate legal agreements, security controls, and governance frameworks. SYCVAC applies privacy-by-design principles, ensuring that information sharing is limited to the minimum necessary data required for the intended healthcare or public health purpose.

Appropriate safeguards may include:

• Identity verification and authentication controls
• Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC)
• Encryption during data transmission and storage
• Audit logging and monitoring of data exchange activities
• Compliance with applicable healthcare privacy and data protection regulations

Through secure interoperability with National Immunization Information Systems, SYCVAC supports the creation of a more connected global immunization ecosystem while preserving individual privacy, improving healthcare efficiency, and strengthening public health preparedness.

5.6 Laboratories

Authorized laboratory partners may provide:

• tuberculosis test results;
• serology results;
• immunity testing;
• vaccine-related laboratory information.

5.7 Connected Healthcare Systems

SYCVAC may receive information from:

• hospitals;
• clinics;
• pharmacies;
• occupational health providers;
• school health systems;
• travel medicine clinics;
• humanitarian healthcare organizations.

5.8 Device-Generated Information

SYCVAC applications automatically collect certain technical information generated by the user's device and system environment that is necessary to operate, maintain, secure, monitor, and improve the Platform. This information helps ensure reliable performance, protect user accounts, detect security threats, troubleshoot technical issues, and enhance the overall user experience.

Device-generated information may include, where applicable:

• Device Information — Information about the device used to access SYCVAC, including device type, operating system, hardware specifications, application version, language settings, and device configuration.
• Application Usage Information — Technical data related to application performance and functionality, including feature usage, application events, error reports, crash logs, performance metrics, and diagnostic information.
• Network and Connectivity Information — Information required to establish secure communication with SYCVAC services, such as internet connection type, network status, IP address, and connection quality indicators.
• Security and Authentication Information — Information used to protect accounts and prevent unauthorized access, including authentication events, login timestamps, security alerts, device authorization status, and session information.
• Device Identifiers — Certain technical identifiers, such as application instance identifiers or device-generated tokens, may be collected to support secure authentication, notifications, fraud prevention, and platform integrity.

SYCVAC uses device-generated information primarily for legitimate operational and security purposes, including:

• Maintaining platform availability and reliability
• Improving application performance and user experience
• Detecting, preventing, and investigating cybersecurity threats
• Identifying technical errors and resolving system issues
• Supporting software updates and compatibility improvements
• Monitoring system performance and operational stability
• Protecting the confidentiality, integrity, and availability of vaccination records and related health information

Device-generated information is processed in accordance with applicable privacy and data protection requirements. SYCVAC applies appropriate safeguards, including encryption, access controls, security monitoring, and data minimization principles, to ensure that technical information is collected and used only for authorized purposes.

Whenever feasible, SYCVAC limits the collection of device-related information to what is necessary for the secure operation of the Platform and does not use such information to identify individuals beyond what is required for authentication, security, compliance, and service improvement purposes.

5.9 Cookies, SDKs, and Similar Technologies

SYCVAC uses cookies, software development kits (SDKs), local storage, and similar technologies to:

• authenticate users;
• maintain secure sessions;
• remember user preferences;
• improve performance;
• prevent fraud;
• monitor cybersecurity threats;
• Analyze platform usage.

Part II — How We Use Your Information, Legal Basis for Processing, Data Retention, Information Sharing, Digital Credential Verification, Artificial Intelligence, Public Health Research, and Cookies & Similar Technologies

6. How We Use Your Information

SYCVAC processes personal information solely for legitimate healthcare, public health, security, regulatory, and operational purposes. We process only the minimum amount of information reasonably necessary to fulfill those purposes.

Depending on your use of the Platform, we may use your information to:

6.1 Create and Maintain Digital Immunization Records

We use your information to:

• establish and maintain your lifelong Digital Immunization Record;
• update vaccination history;
• synchronize authorized immunization records;
• prevent duplicate immunization records;
• Support continuity of care.

6.2 Issue Digital Immunization Passports

SYCVAC processes authorized user information and verified immunization records to generate secure Digital Immunization Passports designed to provide individuals with a trusted, portable, and privacy-preserving method of presenting their vaccination history to authorized organizations for legitimate purposes permitted under applicable laws and regulations.

Digital Immunization Passports may be used, where applicable and legally authorized, to support verification of immunization status for purposes including:

• International Travel – Facilitating secure presentation and verification of vaccination requirements established by airlines, travel operators, border authorities, or destination countries.
• Border Entry – Supporting authorized public health and governmental entities in verifying required immunization documentation while respecting applicable privacy and data protection requirements.
• Education – Allowing schools, universities, training institutions, and educational organizations to verify vaccination requirements when legally required or authorized.
• Employment – Enabling employers or occupational health services to verify immunization information when permitted by applicable workplace health regulations and privacy laws.
• Healthcare Services – Supporting healthcare providers, hospitals, clinics, and public health organizations in accessing verified vaccination information to improve continuity of care, clinical decision-making, and patient safety.
• Humanitarian Assistance – Supporting authorized humanitarian organizations and emergency healthcare providers in verifying immunization status during disaster response, refugee assistance, migration support, and public health programs.
• Emergency Response – Enabling authorized public health authorities and emergency response organizations to verify immunization information during outbreaks, epidemics, pandemics, or other public health emergencies.

SYCVAC Digital Immunization Passports are designed according to privacy-by-design principles, ensuring that users maintain control over how and when their vaccination information is shared. Whenever technically feasible, the passport provides only the minimum information required for verification and avoids unnecessary disclosure of complete medical histories.

Digital Immunization Passports may incorporate secure technologies, including:

• Cryptographically signed digital credentials
• QR-code-based verification
• SMART Health Card-compatible formats
• W3C Verifiable Credentials
• HL7 FHIR interoperability standards
• Secure identity verification mechanisms
• Encryption and access-control protections

SYCVAC does not authorize unrestricted access to personal health information. Verification is limited to authorized entities with a legitimate purpose and is subject to applicable privacy laws, healthcare regulations, consent requirements, and data governance policies.

Through Digital Immunization Passports, SYCVAC supports a trusted global digital health ecosystem by replacing vulnerable paper-based vaccination documentation with secure, verifiable, and interoperable digital credentials while protecting individual privacy and confidentiality.

6.3 Generate Digital Immunization Credentials

SYCVAC uses authorized user information and verified immunization records to generate secure digital immunization credentials designed to facilitate trusted verification of vaccination status while protecting individual privacy.

Digital credentials generated through the SYCVAC platform may include or support interoperability with recognized health credential formats and international digital health standards, including:

• QR Code-Based Digital Credentials – Secure, machine-readable codes that allow authorized entities to verify the authenticity and validity of vaccination records while minimizing unnecessary disclosure of personal health information.
• SMART Health Cards – Verifiable health credentials based on open standards that enable individuals to securely store, share, and present vaccination information across compatible healthcare and verification systems.
• W3C Verifiable Credentials (VCs) – Decentralized digital credentials designed to support cryptographically secure verification, trusted issuers, and user-controlled sharing of health information.
• HL7 FHIR Resources – Structured healthcare data formats that support interoperability between SYCVAC and electronic health records (EHRs), immunization information systems (IIS), health information exchanges (HIEs), and other healthcare platforms.
• WHO Digital Documentation Standards – Where implemented, credential formats aligned with internationally recognized digital documentation principles promoted by the World Health Organization (WHO) and other global health interoperability initiatives.
• Other Interoperable Credential Formats – Additional secure digital health credential technologies that may be adopted to support evolving national, regional, and international interoperability requirements.

SYCVAC applies privacy-by-design and data minimization principles when generating and presenting digital immunization credentials. Whenever technically feasible, credentials are designed to disclose only the minimum information necessary to complete a specific verification purpose, rather than exposing an individual's complete vaccination history or full health record.

Depending on the verification context, a credential may confirm specific information, such as:

• Proof of vaccination status
• Vaccine type and administration date
• Credential validity and authenticity
• Issuing healthcare organization or authority
• Compliance with defined immunization requirements

without unnecessarily revealing additional personally identifiable information (PII) or protected health information (PHI).

Digital credentials generated by SYCVAC incorporate security measures such as:

• Cryptographic signatures and credential validation mechanisms
• Secure identity verification processes
• Encryption during storage and transmission
• Controlled access permissions
• Audit logging of credential-related activities

Through these capabilities, SYCVAC supports a secure, interoperable, and privacy-preserving digital immunization ecosystem that enables individuals, healthcare providers, public health authorities, and authorized organizations to verify vaccination information with confidence while maintaining individual privacy and data protection.

6.4 Verify Vaccination Status

Authorized verification services may validate:

• credential authenticity;
• credential expiration;
• credential revocation;
• vaccination validity;
• issuer authenticity;
• Digital signature integrity.

Verification generally confirms credential validity without revealing the complete medical record.

6.5 Prevent Fraud and Protect Platform Integrity

SYCVAC processes information to:

• detect fraudulent vaccination records;
• identify forged credentials;
• investigate suspicious activity;
• detect unauthorized access;
• prevent identity theft;
• monitor cybersecurity threats;
• protect healthcare providers;
• Protect public health systems.

6.6 Support Public Health Surveillance

Subject to applicable law, SYCVAC may support:

• vaccine coverage monitoring;
• epidemiological surveillance;
• outbreak detection;
• disease surveillance;
• vaccination campaign monitoring;
• health equity analysis;
• emergency preparedness.

Whenever feasible, these activities use de-identified or aggregated information.

6.7 Outbreak Prediction

Authorized public health authorities may use aggregated information to:

• identify emerging disease clusters;
• monitor vaccination coverage;
• estimate outbreak risks;
• support vaccine distribution planning;
• Evaluate immunization effectiveness.

6.8 Vaccine Inventory Management

Healthcare organizations may use SYCVAC to assist with:

• inventory forecasting;
• cold-chain planning;
• vaccine utilization;
• stock replenishment;
• expiration monitoring;
• Distribution management.

6.9 Artificial Intelligence and Analytics

Artificial Intelligence (AI) and Machine Learning (ML) technologies may assist with:

• outbreak prediction;
• immunization coverage analysis;
• forecasting;
• operational planning;
• anomaly detection;
• Public health research.

6.10 Platform Security

Information is processed to:

• authenticate users;
• authorize access;
• monitor suspicious activity;
• investigate incidents;
• improve cybersecurity;
• maintain audit trails;
• Secure the Platform.

6.11 Regulatory Compliance

We process information to comply with applicable:

• healthcare regulations;
• vaccination reporting requirements;
• legal obligations;
• court orders;
• public health reporting mandates;
• governmental requests authorized by law.

7. Legal Basis for Processing

Depending on your jurisdiction, SYCVAC processes information under one or more legal bases.

7.1 Consent

Certain processing activities are based upon your consent, including:

• optional location services;
• optional notifications;
• optional research participation;
• Optional AI-assisted features were required.

7.2 Performance of a Contract

Processing is necessary to provide:

• Digital Immunization Records
• Digital Immunization Passports
• Digital Immunization Credentials
• account management;
• Healthcare services requested by users.

7.3 Legal Obligation

Processing may be required to comply with:

• vaccination reporting laws;
• communicable disease reporting;
• public health regulations;
• healthcare licensing requirements;
• court orders;
• regulatory obligations.

7.4 Public Interest

Processing may be necessary for reasons of substantial public interest, including:

• outbreak surveillance;
• vaccination monitoring;
• disease prevention;
• emergency preparedness;
• National immunization programs.

7.5 Legitimate Interests

Where permitted by law, SYCVAC may process information for legitimate interests, including:

• cybersecurity;
• fraud prevention;
• platform improvement;
• operational efficiency;
• quality assurance.

8. Data Retention

SYCVAC retains personal information, vaccination records, and related health data only for as long as necessary to fulfill the purposes described in this Privacy Policy, provide essential platform services, maintain accurate lifelong immunization records, comply with applicable legal and regulatory obligations, and support legitimate public health objectives.

Retention periods may vary depending on the type of information, the purpose of processing, contractual requirements, healthcare regulations, and applicable laws governing medical records and public health information. Certain vaccination and immunization records may require extended retention periods because they represent lifelong health documentation and may be necessary for future healthcare decisions, disease prevention efforts, or public health protection.

SYCVAC may retain de-identified and aggregated epidemiological information for extended periods to support:

• Public health research and scientific analysis
• Immunization coverage assessments
• Epidemiological surveillance and disease prevention strategies
• Vaccine effectiveness studies
• Population health planning and healthcare system improvement
• Public health emergency preparedness and response initiatives

Such information is processed using appropriate safeguards, including de-identification, aggregation, access controls, and security protections designed to prevent the identification of individual users.

When information is no longer required for the purposes described above, and there is no legal, regulatory, scientific, or public health justification for continued retention, SYCVAC will implement appropriate measures for secure deletion, anonymization, or disposal of the data.

SYCVAC's data retention practices follow principles of data minimization, purpose limitation, privacy-by-design, and responsible health data governance, while balancing individual privacy rights with the long-term needs of healthcare continuity, epidemiological research, and global public health protection.

8.1 Digital Immunization Records

Digital Immunization Records may be retained:

• For the duration of your account;
• For periods required by applicable healthcare laws;
• For public health recordkeeping requirements.

8.2 Healthcare Provider Records

Healthcare Provider accounts may be retained to:

• verify professional actions;
• satisfy regulatory requirements;
• maintain audit histories;
• support investigations.

8.3 Verification Logs

Credential verification logs may be retained for fraud prevention, auditing, cybersecurity, and regulatory compliance before being securely deleted or aggregated.

8.4 Public Health Data

De-identified epidemiological information may be retained by SYCVAC for long-term public health research, statistical analysis, immunization program evaluation, disease prevention strategies, and healthcare planning purposes where permitted by applicable laws and regulatory requirements.

Such information is processed using privacy-preserving methodologies, including de-identification, aggregation, and data minimization techniques, ensuring that individual users cannot reasonably be identified. De-identified public health data may be used to support epidemiological surveillance, vaccine coverage assessments, population health studies, outbreak preparedness, and scientific research initiatives conducted by or in collaboration with authorized public health institutions, academic organizations, governmental health authorities, and recognized international health organizations.

SYCVAC maintains strict governance controls to ensure that public health data is used only for legitimate purposes consistent with applicable privacy regulations, ethical research principles, and public health objectives. The retention and analysis of such information help improve immunization strategies, strengthen healthcare systems, identify population-level trends, and support evidence-based decision-making while protecting individual privacy and confidentiality.

Where required, data use may be subject to additional safeguards, institutional review processes, regulatory approvals, or agreements with authorized public health and research entities. No personally identifiable information (PII) or protected health information (PHI) is disclosed for public health analysis unless expressly authorized by law or by the appropriate consent mechanisms.

8.5 Account Deletion

Users may request the deletion of their accounts; however, certain vaccination records may be retained when required by applicable laws, regulations, public health obligations, or legitimate scientific and epidemiological purposes. SYCVAC may retain de-identified and aggregated immunization data for epidemiological surveillance, scientific research, and public health analysis, including studies conducted by or in collaboration with recognized international health organizations, governmental health authorities, and accredited research institutions. Such data retention will be performed using appropriate safeguards to protect individual privacy and confidentiality.

9. Disclosure of Information

SYCVAC does not sell personal health information.

We disclose information only when authorized by law, required to provide services, or with appropriate authorization.

9.1 Healthcare Providers

Authorized healthcare providers may receive information necessary to:

• administer vaccines;
• update immunization records;
• verify patient identity;
• provide clinical care.

9.2 Ministries of Health

Authorized Ministries of Health may receive information required to:

• maintain national immunization registries;
• monitor vaccination programs;
• support disease surveillance;
• satisfy legal reporting obligations.

9.3 National Immunization Programs

Information may be shared with authorized national immunization programs responsible for implementing vaccination policies.

9.4 Border Authorities

Where authorized by applicable laws, regulations, and international health frameworks, Digital Immunization Credentials, including Digital Yellow Fever Cards and other verified vaccination certificates issued through the SYCVAC Platform, may be presented to and verified by authorized immigration, border control, quarantine, and public health authorities for legitimate travel and public health purposes.

SYCVAC supports minimum-disclosure verification principles, allowing authorized border authorities to confirm the validity and authenticity of an immunization credential without requiring access to an individual's complete medical history or unrelated health information.

Verification activities may include confirmation of:

• The existence and validity of a digital immunization credential;
• The authenticity of the credential issuer;
• The integrity of the digital certificate;
• The vaccination status required for entry or public health compliance;
• The applicable vaccination date and validity period;
• The authenticity of a Digital Yellow Fever Certificate was required for international travel.

The verification process may use secure technologies, including:

• Cryptographically signed digital credentials;
• QR-code-based verification;
• Digital certificate validation;
• Secure authentication protocols;
• Trusted issuer verification frameworks;
• Encrypted communication channels.

For international travel purposes, SYCVAC Digital Yellow Fever Cards are designed to support the secure digital representation of the International Certificate of Vaccination or Prophylaxis (ICVP) while maintaining the essential requirements necessary for authorized verification by competent authorities.

SYCVAC does not provide unrestricted access to personal health information. Border authorities and other authorized verification entities receive only the minimum information necessary to determine whether a credential satisfies a specific requirement, consistent with:

• Data minimization principles;
• Privacy-by-design standards;
• Applicable national privacy laws;
• International health regulations;
• Public health governance requirements.

Where implemented, verification may be performed through a trusted credential validation process in which the authority confirms the authenticity of the certificate without storing unnecessary personal health information.

SYCVAC may support international verification scenarios, including:

• Yellow fever vaccination requirements for entry into countries with endemic or transmission-risk areas;
• Public health screening at international points of entry;
• Travel-related immunization compliance;
• Humanitarian and emergency response movements;
• Cross-border healthcare access.

All verification activities are subject to the applicable legal authority, operational requirements, and agreements established between SYCVAC, healthcare providers, governments, public health authorities, and authorized verification organizations.

Through secure digital verification capabilities, SYCVAC helps modernize international immunization documentation by reducing reliance on paper-based certificates, improving fraud prevention, strengthening public health protection, and enabling trusted cross-border recognition of vaccination credentials while preserving individual privacy.

9.5 WHO-Compatible Verification Systems and Digital Yellow Fever Card Integration

SYCVAC is designed to support interoperability with internationally recognized digital health credential ecosystems and global immunization verification frameworks. Where implemented, SYCVAC may enable secure verification of vaccination records through standards-based approaches aligned with recommendations, technical specifications, and interoperability principles promoted by the World Health Organization (WHO) and other recognized global health technology frameworks.

A key application of this capability is the transformation of the traditional International Certificate of Vaccination or Prophylaxis (ICVP), commonly known as the Yellow Fever Card, into a secure Digital Yellow Fever Vaccination Certificate within the SYCVAC ecosystem.

The Digital Yellow Fever Card is designed to preserve the legal and public health purposes of the traditional paper-based certificate while improving security, accessibility, authenticity verification, and international usability. It provides individuals with a secure digital representation of their yellow fever vaccination history that may be presented to authorized travel, border, healthcare, and public health authorities where legally recognized and implemented.

The objective of WHO-compatible verification is to facilitate trusted, secure, and privacy-preserving confirmation of immunization status while maintaining individual control over personal health information. Rather than replacing national immunization systems or official public health authorities, SYCVAC is designed to complement existing government platforms by providing a secure digital layer that enables authorized verification across healthcare providers, ministries of health, public health institutions, travel authorities, employers, educational institutions, humanitarian organizations, and other approved entities.

9.5.1 Digital Yellow Fever Card (Digital International Certificate of Vaccination or Prophylaxis – ICVP)

SYCVAC may support the creation, storage, and verification of a digital version of the Yellow Fever Vaccination Certificate based on internationally recognized requirements for proof of yellow fever vaccination.

The Digital Yellow Fever Card may include authorized vaccination information such as:

• Individual identity information required for certificate validation;
• Vaccine recipient identification details;
• Yellow fever vaccine administration date;
• Vaccine product information
• Vaccine manufacturer;
• Vaccine batch or lot number when available;
• Date of vaccination validity;
• Authorized healthcare provider or vaccination center information;
• Country or jurisdiction issuing the certificate;
• Digital issuance date;
• Credential authenticity information.

The digital certificate is designed to maintain the essential elements required for international recognition while reducing dependence on physical paper documents that may be:

• Lost or damaged;
• Difficult to verify internationally;
• Vulnerable to alteration or fraud;
• Inaccessible during travel emergencies.

9.5.2 International Digital Health Credential Interoperability

SYCVAC supports interoperability principles that allow vaccination credentials, including Digital Yellow Fever Cards, to be securely exchanged and verified across different healthcare environments and jurisdictions.

Capabilities may include:

• Digital vaccination certificates and immunization credentials;
• Digital Yellow Fever Vaccination Certificates
• QR-code-based verification mechanisms;
• Cryptographically signed health credentials;
• Secure validation without requiring access to the individual's complete medical record;
• Compatibility with national and regional immunization information systems;
• Integration with authorized travel health verification ecosystems.

This approach supports the development of globally connected digital health ecosystems where vaccination information can be verified securely while respecting national sovereignty, individual privacy rights, and applicable data protection regulations.

9.5.3 Alignment with WHO Digital Health Standards and Frameworks

Where applicable, SYCVAC can support implementation approaches consistent with internationally recognized WHO digital health initiatives, including:

• Digital documentation of vaccination status;
• International vaccination certificate verification principles
• Trust frameworks for health credential authentication;
• Secure exchange of health information;
• Interoperability between public health information systems;
• Privacy-preserving digital identity principles;
• Secure credential issuance and validation processes.

SYCVAC is designed to adapt to evolving international standards rather than relying on a single technology ecosystem, allowing governments, ministries of health, airports, healthcare institutions, and authorized organizations to implement solutions according to their regulatory and operational requirements.

9.5.4 Secure QR Code Verification Technology for Digital Yellow Fever Cards

SYCVAC Digital Yellow Fever Cards may include secure QR-code verification capabilities designed to:

• Confirm the authenticity of yellow fever vaccination records;
• Validate that the certificate was issued by an authorized healthcare provider or authority;
• Detect altered, fraudulent, or counterfeit vaccination certificates;
• Verify credential integrity using cryptographic signatures;
• Enable rapid verification at airports, border checkpoints, healthcare facilities, and authorized locations;
• Reduce reliance on physical paper Yellow Fever Cards.

Verification may be performed without exposing unnecessary personal health information by applying data minimization principles.

For example, a border authority may verify that:

• A valid yellow fever vaccination certificate exists;
• The vaccination was administered by an authorized provider;
• The certificate meets applicable entry requirements;

Without receiving access to the individual's complete immunization history.

9.5.5 Privacy-Preserving Verification Model

SYCVAC follows a privacy-by-design approach where verification focuses on confirming the validity of a credential rather than exposing an individual's complete health record.

Security principles include:

• Minimum necessary data disclosure;
• User-controlled sharing permissions;
• Consent-based access where applicable;
• Encryption of transmitted information;
• Protection of personally identifiable information (PII);
• Protection of protected health information (PHI);
• Secure credential storage
• Controlled access authorization.

The Digital Yellow Fever Card is designed to provide only the information required for travel or public health verification while protecting additional medical information that is not necessary for that purpose.

9.5.6 Cross-Border Health Credential Verification

International travelers frequently cross borders for:

• Tourism;
• Migration;
• Education;
• Employment;
• Humanitarian assistance;
• Emergency response operations;
• International business activities.

SYCVAC's verification framework can support authorized cross-border validation of immunization credentials, including yellow fever vaccination certificates, while respecting:

• National data protection laws;
• Regional privacy requirements;
• International health regulations;
• Healthcare governance frameworks;
• International interoperability agreements.

A Digital Yellow Fever Card can support faster and more reliable verification processes while reducing administrative burden on travelers and border health authorities.

9.5.7 Integration with National Immunization Information Systems

SYCVAC is designed to operate alongside existing government immunization platforms through secure interoperability mechanisms.

Potential integrations may include:

• National Immunization Information Systems (NIIS/IIS);
• Electronic Health Records (EHR)
• Health Information Exchanges (HIE)
• Travel health information systems
• Laboratory information systems
• Public health surveillance platforms.

Interoperability may be achieved through recognized healthcare data exchange standards, including:

• HL7 Fast Healthcare Interoperability Resources (FHIR);
• International Patient Summary (IPS) principles;
• Secure RESTful APIs;
• OAuth 2.0 authorization frameworks;
• Digital certificate-based authentication;
• Secure identity verification protocols.

9.5.8 Fraud Prevention and Credential Authenticity

Digital transformation of the Yellow Fever Card strengthens public confidence by reducing risks associated with:

• Lost paper vaccination cards;
• Damaged physical certificates;
• Unauthorized modifications;
• Counterfeit vaccination documents;
• Fraudulent vaccine records;
• Inconsistent documentation between jurisdictions.

SYCVAC applies security mechanisms such as:

• Digital signatures;
• Certificate validation;
• Cryptographic verification;
• Immutable audit trails;
• Identity verification controls;
• Access monitoring;
• Provider authentication.

9.5.9 Support for Global Health Emergency Preparedness

A secure digital credential infrastructure can support preparedness for future outbreaks and public health emergencies by enabling:

• Rapid verification of vaccination status;
• Secure vaccine campaign monitoring;
• Improved international health coordination;
• Faster response between health authorities;
• Continuity of immunization services during crises;
• Reliable documentation for displaced populations and humanitarian situations.

9.5.10 Governance and Trust Framework

SYCVAC recognizes that digital health credential systems require strong governance beyond technology.

Implementation may include:

• Clearly defined credential issuers and verifiers;
• Authorized healthcare provider validation;
• Government and health authority oversight;
• Transparent data governance policies;
• Compliance with applicable privacy regulations;
• Security audits and continuous monitoring;
• International cooperation frameworks.

Through WHO-compatible verification capabilities and Digital Yellow Fever Card integration, SYCVAC contributes to the development of a trusted global digital immunization ecosystem.

By transforming the traditional paper-based Yellow Fever Card into a secure digital credential, SYCVAC supports:

• Safer international travel
• Faster border health verification;
• Reduced fraud and document loss;
• Improved healthcare interoperability;
• Stronger public health preparedness;
• Protection of individual privacy and personal health information.

SYCVAC enables secure verification of immunization status across borders while maintaining the principles of privacy, security, interoperability, and global public health collaboration.

9.6 Public Health Authorities

Public health authorities may receive information required to:

• investigate outbreaks;
• monitor communicable diseases;
• support emergency response;
• comply with applicable reporting laws.

9.7 Service Providers

SYCVAC may engage trusted service providers for:

• cloud infrastructure;
• cybersecurity;
• identity verification;
• customer support;
• analytics;
• credential infrastructure.

All service providers must comply with contractual confidentiality and security obligations.

9.8 Legal Authorities

Information may be disclosed when required by:

• applicable law;
• lawful court orders;
• subpoenas;
• regulatory investigations;
• public health emergencies.

10. Digital Credential Verification

SYCVAC Digital Immunization Credentials are designed using modern cryptographic technologies to support secure, privacy-preserving verification.

Verification systems may support:

• digital signatures;
• public-key cryptography;
• QR Code validation;
• credential expiration;
• credential revocation;
• issuer verification;
• selective disclosure where supported.

Whenever possible, verification confirms credential validity without revealing unnecessary personal information.

11. Artificial Intelligence

SYCVAC may use Artificial Intelligence (AI), Machine Learning (ML), and advanced analytics to improve healthcare delivery and public health operations.

AI applications may include:

• outbreak forecasting;
• immunization coverage analysis;
• operational planning;
• fraud detection;
• anomaly detection;
• predictive analytics;
• healthcare reporting.

SYCVAC is committed to responsible AI principles, including:

• transparency;
• human oversight;
• fairness;
• security;
• accountability;
• privacy protection.

AI does not replace clinical judgment or public health decision-making.

12. Public Health Research

Where permitted by law, de-identified information may support:

• epidemiological research;
• vaccine effectiveness studies;
• academic research;
• healthcare quality improvement;
• disease surveillance;
• public health policy;
• global immunization initiatives.

Researchers receiving data must:

• comply with applicable ethics requirements;
• prohibit re-identification;
• maintain appropriate security safeguards;
• use data solely for approved purposes.

13. Cookies and Similar Technologies

SYCVAC uses cookies, software development kits (SDKs), local storage, pixels, and similar technologies to:

• authenticate users;
• maintain secure sessions;
• remember preferences;
• improve platform performance;
• measure application usage;
• detect fraud;
• protect against cyberattacks;
• enhance user experience.

Users may modify cookie preferences through browser or device settings. Certain Platform functionality may be unavailable if cookies or similar technologies are disabled.

Part III — Privacy Rights, Data Protection, and Enterprise Security Architecture

3.1 Your Privacy Rights

• Right to access personal vaccination and health records
• Right to request correction of inaccurate information
• Right to request deletion where legally applicable
• Right to obtain a copy of personal health information
• Right to control data-sharing permissions and consent preferences
• Right to withdraw consent for optional data processing activities
• Right to receive transparency regarding data collection, processing, and disclosure

3.2 Children's Privacy

• Protection of vaccination records belonging to minors
• Compliance with applicable child privacy regulations, including COPPA, GDPR requirements for children, and local health data protection laws
• Parental or legal guardian authorization for account creation and data management
• Enhanced safeguards for children's personally identifiable information (PII) and protected health information (PHI)
• Role-based access controls restrict access to authorized guardians and healthcare providers

3.3 Healthcare Provider Responsibilities

Healthcare providers and authorized healthcare organizations using the SYCVAC Platform play an essential role in maintaining the accuracy, security, confidentiality, and reliability of digital immunization records. Providers are responsible for ensuring that information entered, accessed, updated, or shared through the Platform is handled in accordance with applicable healthcare regulations, professional standards, privacy requirements, and organizational policies.

Healthcare providers using SYCVAC are responsible for:

3.3.1 Ensuring Accuracy and Completeness of Vaccination Records

Healthcare providers must ensure that vaccination information entered into SYCVAC is accurate, complete, timely, and consistent with the immunization services provided.

Responsibilities may include:

• Recording vaccine administration information correctly;
• Confirming patient vaccination history when available;
• Entering relevant vaccine details, including vaccine type, administration date, dose information, and provider information;
• Updating records when corrections or additional documentation become available;
• Avoiding duplicate, incomplete, or inaccurate record submissions.

Accurate provider documentation helps maintain reliable lifelong immunization records and supports safe clinical decision-making and public health reporting.

3.3.2 Verifying Patient Identity Before Accessing or Modifying Health Information

Healthcare providers must verify an individual's identity before accessing, creating, updating, or modifying vaccination records within SYCVAC.

Identity verification measures may include:

• Confirming patient demographic information;
• Applying approved identity verification procedures;
• Validating authorized guardian or representative access when applicable;
• Ensuring that vaccination information is associated with the correct individual.

These measures help prevent unauthorized access, identity errors, and incorrect medical record associations.

3.3.3 Maintaining Confidentiality of Patient Records

Healthcare providers are responsible for protecting the confidentiality and privacy of patient information accessed through SYCVAC.

Providers must:

• Access patient information only for authorized healthcare, operational, or public health purposes;
• Prevent unauthorized disclosure of personal information and protected health information (PHI);
• Maintain secure handling of credentials and authentication methods;
• Follow organizational security policies and professional confidentiality obligations;
• Ensure that personnel accessing SYCVAC are appropriately authorized and trained.

3.3.4 Following Applicable Healthcare Privacy Regulations and Professional Standards

Healthcare providers must comply with all applicable laws, regulations, and professional obligations governing health information privacy, security, and data management.

Depending on the jurisdiction, requirements may include:

• Healthcare privacy regulations;
• Data protection laws;
• Public health reporting requirements;
• Medical record retention obligations;
• Professional licensing standards;
• Institutional security policies.

SYCVAC provides a secure technology platform but does not replace the provider's legal, regulatory, or professional responsibilities.

3.3.5 Obtaining Appropriate Patient Consent Before Sharing Vaccination Information

Healthcare providers must ensure that appropriate authorization or consent requirements are followed before sharing vaccination information with third parties, except where disclosure is legally permitted or required.

Consent-related responsibilities may include:

• Informing individuals about applicable data-sharing practices;
• Obtaining authorization where required;
• Respecting patient privacy preferences;
• Sharing only the minimum information necessary for the intended purpose.

SYCVAC supports privacy-preserving sharing mechanisms designed to help providers and users maintain appropriate control over immunization information.

Reporting Suspected Unauthorized Access, Data Breaches, or Security Incidents

Healthcare providers must promptly report suspected security incidents involving SYCVAC, including:

• Unauthorized access to vaccination records;
• Loss or compromise of authentication credentials;
• Suspected data breaches;
• Improper disclosure of patient information;
• Unauthorized modification of immunization records;
• Suspicious platform activity.

Providers should follow applicable incident reporting procedures established by their organization, SYCVAC, and relevant regulatory authorities.

3.3.5 Healthcare Provider Accountability and Data Integrity

Healthcare providers remain responsible for the clinical accuracy, legitimacy, and appropriate use of vaccination information they submit or manage within SYCVAC. SYCVAC provides the digital infrastructure, security controls, interoperability capabilities, and governance mechanisms necessary to support trusted immunization data management.

By fulfilling these responsibilities, healthcare providers contribute to a secure and reliable digital immunization ecosystem that supports:

• Safe patient care;
• Accurate lifelong vaccination records;
• Trusted digital immunization credentials;
• Public health surveillance;
• National and international immunization initiatives.

SYCVAC and authorized healthcare providers share a common responsibility to protect vaccination information, maintain data integrity, and ensure that digital immunization records remain secure, accurate, and accessible throughout an individual's lifetime.

3.4 International Data Transfers

SYCVAC supports global deployment while maintaining strong privacy and security protections for international data flows.

The platform applies:

• Data protection principles aligned with GDPR, HIPAA, and international privacy frameworks
• Appropriate safeguards for cross-border transfers of health information
• Regional data residency strategies are required by national regulations
• Encryption during transmission and storage
• Contractual and technical controls for authorized international processing activities

3.5 Enterprise Security Architecture

SYCVAC implements a defense-in-depth security model designed to protect sensitive vaccination and healthcare information.

The architecture includes:

3.5.1 Encryption

SYCVAC protects data through encryption mechanisms including:

• Encryption of data at rest using industry-standard cryptographic algorithms
• Encryption of data in transit using TLS protocols
• Secure key management practices
• Protection of encryption keys through dedicated security controls

3.5.2 Role-Based Access Control (RBAC)

RBAC ensures users receive only the permissions required for their responsibilities.

Examples of roles include:

• Patient/User
• Parent or Guardian
• Healthcare Provider
• Healthcare Organization Administrator
• System Administrator
• Government Health Authority
• Security Administrator

RBAC reduces unauthorized access by enforcing the principle of least privilege.

3.5.3 Attribute-Based Access Control (ABAC)

ABAC provides dynamic authorization decisions based on:

• User attributes
• Organization affiliation
• Geographic location
• Professional credentials
• Data classification
• Contextual security conditions

ABAC enables more granular access decisions beyond traditional role-based permissions.

3.5.4 Zero Trust Architecture

SYCVAC follows Zero Trust security principles: "Never trust, always verify."

Security controls include:

• Continuous identity verification
• Device validation
• Least-privilege access
• Continuous monitoring
• Segmentation of critical services
• Risk-based authentication decisions

3.5.5 Multi-Factor Authentication (MFA)

MFA strengthens account protection by requiring multiple verification factors:

• Password credentials
• Authentication applications
• Hardware security keys
• Biometric verification where supported
• One-time verification codes

3.5.6 OAuth 2.0

SYCVAC uses OAuth 2.0 authorization frameworks to enable:

• Secure third-party application authorization
• Delegated access without sharing passwords
• Controlled API access
• Integration with healthcare information systems

3.5.7 JSON Web Tokens (JWT)

JWT technology supports secure authentication and authorization by providing:

• Signed authentication tokens
• Secure session management
• Stateless API communication
• Verification of user identity and permissions

3.5.8 Hardware Security Modules (HSM)

SYCVAC may utilize HSM-based security controls for:

• Cryptographic key generation
• Encryption key protection
• Digital certificate management
• Protection against unauthorized key extraction

3.6 Security Monitoring and Operational Protection

3.6.1 Audit Logging

SYCVAC maintains comprehensive audit trails documenting:

• User authentication events
• Record access activity
• Data modifications
• Administrative actions
• API transactions
• Security-related events

Audit logs support:

• Compliance verification
• Security investigations
• Incident response
• Regulatory reporting requirements

3.7 Disaster Recovery

SYCVAC implements a comprehensive Disaster Recovery (DR) Framework designed to protect the availability, integrity, confidentiality, and resilience of digital immunization records and critical platform services during unexpected events.

The Disaster Recovery strategy ensures that SYCVAC can rapidly respond to, recover from, and restore operations following incidents that may impact system availability, including:

• Cybersecurity incidents;
• Cloud infrastructure failures;
• Hardware or software failures;
• Natural disasters;
• Regional service disruptions;
• Network interruptions;
• Data integrity incidents;
• Other operational emergencies.

The primary objective of SYCVAC's Disaster Recovery Framework is to maintain continuous access to essential vaccination information while ensuring that immunization records remain accurate, secure, and protected throughout the recovery process.

3.7.1 Disaster Recovery Measures Include:

3.7.1.1 Automated Backups

SYCVAC implements automated backup mechanisms designed to protect critical platform data, including vaccination records, digital credentials, system configurations, and operational information.

Backup processes may include:

• Scheduled and automated data backups;
• Secure storage of backup copies;
• Backup encryption;
• Backup integrity validation;
• Controlled access to backup environments;
• Protection against unauthorized modification or deletion.

These measures support reliable restoration of information following unexpected events.

3.7.1.2 Geographic Redundancy

SYCVAC utilizes resilient infrastructure strategies designed to reduce dependency on a single geographic location or system component.

Geographic redundancy may include:

• Replicated infrastructure environments;
• Distributed data storage capabilities;
• Regional availability options;
• Failover mechanisms;
• Disaster recovery environments.

This approach helps maintain service availability during regional disruptions or infrastructure failures.

3.7.1.3 Recovery Point Objectives (RPO)

SYCVAC establishes Recovery Point Objectives (RPO) to define the maximum acceptable amount of data loss following an unexpected disruption.

RPO planning considers:

• Frequency of backups;
• Data synchronization processes;
• Criticality of vaccination information;
• Operational requirements of healthcare providers and public health organizations.

The objective is to minimize potential data loss and preserve the continuity and accuracy of lifelong immunization records.

3.7.1.4 Recovery Time Objectives (RTO)

SYCVAC establishes Recovery Time Objectives (RTO) to define the targeted timeframe for restoring critical platform services after an incident.

RTO planning supports:

• Prioritization of essential services;
• Rapid restoration of vaccination record access;
• Recovery of authentication and verification services;
• Continuity of healthcare and public health operations.

3.7.1.5 System Restoration Procedures

SYCVAC maintains documented recovery procedures to support secure restoration of platform operations.

Recovery procedures may include:

• Incident assessment and classification;
• System recovery prioritization;
• Infrastructure restoration;
• Database recovery;
• Application service restoration;
• Security validation before returning systems to operation;
• Post-recovery monitoring.

All restoration activities are performed using controlled processes designed to protect data integrity and prevent unauthorized access.

3.7.1.6 Regular Recovery Testing

SYCVAC performs periodic disaster recovery testing and validation activities to ensure that recovery procedures remain effective and aligned with operational requirements.

Testing may include:

• Backup restoration testing;
• Recovery environment validation;
• System failover exercises;
• Security verification;
• Documentation review;
• Continuous improvement activities.

Regular testing helps identify potential weaknesses and strengthens SYCVAC's overall resilience.

3.7.2 Protection of Digital Immunization Records During Disruptions

SYCVAC recognizes that vaccination records represent critical lifelong health information. Therefore, disaster recovery processes are designed to preserve:

• Confidentiality: ensuring vaccination information remains protected from unauthorized access;
• Integrity: ensuring records remain accurate and unchanged during recovery operations;
• Availability: ensuring individuals, healthcare providers, and authorized public health organizations can access essential immunization information when needed.

Through its Disaster Recovery Framework, SYCVAC supports a secure, reliable, and resilient digital immunization infrastructure capable of maintaining essential vaccination services during unexpected events while protecting individual privacy and public health continuity.

3.8 Penetration Testing

SYCVAC performs security assessments, including:

• Network penetration testing
• Application vulnerability testing
• API security testing
• Cloud infrastructure assessments
• Authentication and authorization testing
• Remediation tracking

Testing helps identify vulnerabilities before they can impact users or healthcare organizations.

3.9 Incident Response

SYCVAC maintains an incident response framework covering:

• Detection — Identification of suspicious activities or security events
• Containment — Isolation and mitigation of affected systems
• Investigation — Root-cause analysis and forensic review
• Notification — Communication with affected parties and authorities when required
• Recovery — Restoration of secure operations
• Lessons Learned — Continuous improvement of security controls

3.2.1 Business Continuity

SYCVAC's Business Continuity Framework is designed to ensure the continued availability, reliability, and resilience of critical digital immunization services during unexpected events that may affect normal operations, including:

• Cybersecurity incidents
• Natural disasters
• Cloud infrastructure or technology failures
• Network disruptions
• Regional or geographic service interruptions
• Public health emergencies
• Operational disruptions or system outages

The objective of SYCVAC's business continuity strategy is to maintain uninterrupted access to essential vaccination services, protect the integrity and availability of immunization records, and support healthcare providers, individuals, and public health organizations during periods of disruption.

3.2.1.1 Continuity Measures Include:

• Redundant Cloud Infrastructure — SYCVAC utilizes resilient cloud-based architectures designed to reduce single points of failure through redundancy, geographic availability options, secure backups, and scalable infrastructure capabilities.
• Backup and Recovery Procedures — SYCVAC maintains structured backup processes and recovery procedures to protect vaccination records and critical system data while supporting timely restoration of services following unexpected incidents.
• Alternative Communication Channels — SYCVAC maintains contingency communication methods to support coordination among users, healthcare providers, technical teams, and authorized stakeholders during operational disruptions.
• Emergency Response Plans — SYCVAC maintains documented incident management and emergency response procedures designed to identify, contain, mitigate, and recover from operational and security events.
• Continuous Availability Strategies — SYCVAC implements availability-focused practices, including system monitoring, performance management, security monitoring, and operational controls designed to support reliable access to digital immunization services.
• Data Protection and System Resilience — SYCVAC applies security and resilience measures to protect the confidentiality, integrity, and availability of personal information, protected health information (PHI), and immunization records throughout the data lifecycle.

3.2.2 SYCVAC Commitment to Security, Privacy, and Global Digital Immunization Resilience

SYCVAC is committed to protecting individual privacy, safeguarding sensitive health information, and maintaining a secure, resilient, and globally scalable digital immunization infrastructure.

Through a comprehensive security and privacy framework based on internationally recognized principles and standards, SYCVAC supports:

• Confidentiality: ensuring that personal and health information is accessible only to authorized individuals and organizations;
• Integrity: ensuring that vaccination records remain accurate, complete, traceable, and protected against unauthorized alteration;
• Availability: ensuring that individuals, healthcare providers, and public health authorities can access essential immunization information when needed;
• Responsible Data Use: ensuring that vaccination data is processed ethically, transparently, and only for legitimate healthcare, public health, operational, and research purposes permitted by applicable laws.

By combining privacy-by-design, security-by-design, interoperability standards, and operational resilience practices, SYCVAC enables trusted healthcare delivery, secure cross-border immunization verification, collaboration with national and international health systems, and lifelong digital immunization records for individuals worldwide.

SYCVAC's mission is to provide a trusted global digital foundation for immunization management protecting individuals, strengthening healthcare systems, and supporting global public health preparedness through secure, reliable, and interoperable technology.

Contact Us

For questions, requests, or complaints regarding this Privacy Policy or your data:

SYCVAC Privacy Office — Email: privacy@sycvac.com

Security Incident Reporting: contact@sycvac.com