TAMSA Data Protection & Privacy Policy

1. Data Controller & Scope

The Tanzania Medical Students' Association (TAMSA) is the national representative body of medical students across United Republic of Tanzania, affiliated with the International Federation of Medical Students' Associations (IFMSA).

This Policy applies to all personal data collected via the TAMSA Forms Platform, including national conferences (General Assembly, Scientific Conferences), university chapter memberships, standing committee projects (SCOME, SCOPH, SCORA, SCORE, SCOPE), elections, academic competitions, and grant/scholarship applications.

2. Personal Data We Collect

Depending on the specific form or event you participate in, we may collect:

• Identity Data: Full name, university/medical school (e.g. MUHAS, CUHAS, KCMUCo, UDOM, HKMU), student ID number, academic year.
• Contact Data: Official email address and telephone/WhatsApp contact for administrative dispatch.
• Accreditation & Academic Records: Conference registration codes, digital QR badges, Continuing Professional Development (CPD) accreditation points, and scientific abstract submissions.
• Financial Confirmation: Mobile money transaction reference numbers (M-Pesa, Airtel Money, Tigo Pesa, Halopesa) or bank deposit slips for event fee verification.
• Technical Telemetry: Submission timestamps, secure session tokens, and IP addresses to prevent fraudulent automated submissions and double-voting.

3. Lawful Basis & Purpose of Processing

TAMSA collects and processes your data strictly for legitimate organizational and academic purposes:

• Event Accreditation: Issuing conference passes, verifying delegate registration, and conducting on-site QR check-ins.
• Official Certificate Issuance: Validating participation and generating official, cryptographically verifiable Certificates of Attendance, Participation, or Appreciation.
• Democratic Governance: Ensuring one-person-one-vote integrity during national and chapter elections.
• Scientific Research & Surveys: Aggregating anonymous health survey responses for student health advocacy and policy briefs.

4. Strict Role-Based Access Control (RBAC)

Data access is governed by strict organizational boundaries:

• Chapter & Committee Organizers: Organizers can ONLY access responses and attendee records for forms authored by their specific Chapter or Standing Committee account.
• Superadmin Oversight: The National Executive superadmin retains constitutional oversight over platform integrity, security audits, and system reliability.
• No Public Exposure: Attendee contact details and submission files are never made publicly searchable on the open web.

5. Security Standards

We deploy robust organizational and technical safeguards:

• Cryptographic Password Hashing: All administrative credentials use industry-grade `bcrypt` key derivation with unique random salts.
• Cross-Site Request Forgery (CSRF) Protection: All form submission channels and administrative actions are protected by cryptographic CSRF tokens.
• Input Sanitization: Form data is sanitized and parameterized via PDO Prepared Statements to prevent SQL injection and cross-site scripting (XSS).
• File Attachment Isolation: Uploaded payment receipts and abstract documents are stored in secured directories with randomized file naming to prevent direct directory traversal.

6. Your Legal Rights as a Data Subject

Under the Tanzania Personal Data Protection Act, you have the right to:

• Access: Request confirmation and an export of personal records held about you.
• Rectification: Request correction of inaccurate student details or academic affiliations.
• Certificate Retrieval: Verify and download your official certificate using your unique Registration Code.
• Erasure & Withdrawal: Request deletion of your registration details subject to statutory event archive requirements.

7. Contact Data Protection Desk

For inquiries, data correction, or privacy compliance queries, please contact the TAMSA National Secretariat: