Kankoon Privacy Policy

The data controller responsible for the processing of your personal data under the EU General Data Protection Regulation (GDPR) is Kankoon (represented by Dr. Aaref Mayoh). For any privacy-related inquiries, requests, or concerns, please contact our Data Protection team at [email protected] or [email protected].

To deliver our certificate equalization assessment, syllabus review, and consultation services, Kankoon collects the following categories of information: • Account & Profile Information: Full name, professional title, email address, password hash, phone/WhatsApp number, current country of residence, and communication preferences. • Medical Qualification & Professional Data: Medical specialty (Human Medicine, Dentistry, Pharmacy, Nursing), university attended, graduation year, target DACH country (Germany, Austria, or Switzerland), and licensing status. • Uploaded Documents & Credentials: Diplomas, transcripts of records (Stundentafel), licenses to practice, language certificates, and CVs submitted voluntarily for eligibility checks, curriculum audits, or sworn translation services. • Device & App Telemetry: IP address, device model, operating system version, app version, crash diagnostics, and anonymous session analytics to optimize mobile app stability and performance.

We process your data strictly under the following legal bases pursuant to Art. 6(1) of the GDPR: • Performance of a Contract (Art. 6(1)(b) GDPR): To evaluate your qualification eligibility, produce curriculum equivalence reports, coordinate sworn translations, and deliver personalized consulting services. • User Consent (Art. 6(1)(a) GDPR): When you voluntarily upload educational certificates or consent to receive tailored updates and informational resources. • Legitimate Interests (Art. 6(1)(f) GDPR): To safeguard application security, prevent unauthorized access or abuse, and troubleshoot technical errors in the mobile app. • Compliance with Legal Obligations (Art. 6(1)(c) GDPR): To retain billing and transaction records where mandated by applicable commercial and tax regulations.

The Kankoon Android mobile application requests only runtime permissions essential to core functionality: • Camera (CAMERA): Requested only when you choose to take a photo of an educational document or certificate directly within the app for an eligibility check. • Storage / Photos (READ_MEDIA_IMAGES / READ_EXTERNAL_STORAGE): Requested only when you choose to select and upload document scans (PDF/JPEG/PNG) from your device gallery or file manager. • Notifications (POST_NOTIFICATIONS): Requested on Android 13+ to send you real-time alerts regarding document audit results, milestone status updates, or responses from your consulting advisor. You can grant or revoke these permissions at any time through your Android device settings without losing access to non-dependent features.

Kankoon does NOT sell, rent, monetize, or trade your personal information or uploaded documents with third parties or data brokers. Data is shared exclusively with certified technical service providers under strict Data Processing Agreements (DPAs): • Hosting & Infrastructure: Cloudflare, Inc. (providing enterprise-grade edge routing, CDN, and encrypted cloud storage in the European Union). • Transactional Email: Secure SMTP providers for sending verification codes, document confirmations, and audit notifications. • Sworn Translators: Publicly appointed and court-sworn translators in Germany/Austria/Switzerland, strictly upon your explicit request for certified translation services.

In strict compliance with Google Play's User Data and Account Deletion policies, Kankoon provides all users with a straightforward, transparent mechanism to request permanent deletion of their account and all associated personal data: • Within the Mobile App: Navigate to Settings > Account > Delete Account, and confirm your request. • Public Web-Accessible Request: You can submit an account deletion request at any time without needing the app installed by emailing [email protected] with the subject line 'Account Deletion Request' from the email address associated with your account, or using our contact form. Upon receiving your request, Kankoon permanently and irreversibly deletes your user profile, credentials, contact information, and all uploaded medical certificates and audit files from our active systems within 30 days. Where certain billing or invoice records must be retained to satisfy statutory fiscal obligations (e.g. § 147 German Fiscal Code / AO), such data is restricted from active use and deleted promptly once legal retention windows expire.

We implement state-of-the-art technical and organizational measures (TOMs) to protect your sensitive credentials against unauthorized access, loss, or destruction. All data transmission between your device and our servers is secured using modern TLS 1.3 encryption. Uploaded documents are stored in encrypted cloud object storage with role-based access restrictions limited solely to authorized credential evaluators.

Under the European General Data Protection Regulation, you have the right to: • Right of Access (Art. 15 GDPR): Request a copy of all personal data we hold about you. • Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal information. • Right to Erasure / Right to be Forgotten (Art. 17 GDPR): Request permanent deletion of your account and personal data. • Right to Restriction of Processing (Art. 18 GDPR): Limit how we process your personal data under certain conditions. • Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, commonly used, and machine-readable format. • Right to Object (Art. 21 GDPR): Object to data processing based on legitimate interests. • Right to Lodge a Complaint: File a complaint with a competent supervisory authority, such as the German Federal Commissioner for Data Protection and Freedom of Information (BfDI).

Kankoon is designed exclusively for medical students, university graduates, and licensed healthcare professionals. We do not knowingly solicit or collect personal information from individuals under the age of 16.

We may update this Privacy Policy from time to time to reflect evolving regulatory standards, Google Play policy updates, or enhanced app features. Significant updates will be communicated through the mobile app and on our website. For any questions, please email [email protected].