Privacy Notice and Consent

1. Scope

This notice applies to personal data submitted through the AIDP 2026 website for conference registration, poster submission, and related enquiries. It supplements the conference website and the forms that collect your data. If another service has its own privacy notice, that notice applies to that service.

By submitting a form, you confirm that you have received this notice and consent to the processing described here where consent is required. Where information is needed to perform the requested service, processing may also be necessary to take steps at your request or to meet a legal obligation.

AIDP 2026 is the 2026 Conference on Artificial Intelligence and Digital Pathology, held at The Hong Kong University of Science and Technology from 27 to 29 November 2026.

2. Data user

The data user for this service is the AIDP 2026 Organizing Committee and its HKUST-hosted conference team. The service is operated for conference administration and academic review under HKUST's University Data Privacy Policy Statement.

HKUST's policy requires compliance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”). We also follow the structure of a Personal Information Collection Statement (“PICS”) described in HKUST's PICS guidance.

3. Personal data we collect

We collect only the information needed to process your request.

Conference registration: full name, email address, affiliation, role, selected attendance dates, consent record, submission time, and any message you choose to send us.
Poster submission: presenting author name, contact email, affiliation, poster title, author list, topic, PDF file, file name, file size, file checksum, consent record, and submission time.
Security verification: the selected verification provider processes browser and network signals needed to decide whether a request appears to come from a person. We do not store CAPTCHA tokens in the registration database.
Service operation: the service may use a request address temporarily for abuse prevention. It does not store that address with your registration. Operational hosting logs may record request metadata under the server administrator's own access controls.

The registration and poster fields marked as required are necessary to identify you, communicate with you, manage event attendance, or review a submission. If you do not provide required information, we may not be able to process the relevant request.

You must not include patient-identifiable information, medical record numbers, direct identifiers, confidential clinical material, access credentials, or material you do not have the right to submit.

4. Purposes and use

We use personal data for the following purposes:

administering conference registration and attendance planning;
communicating with you about your registration, poster submission, review result, event logistics, or a request you make;
reviewing poster submissions and recording acceptance or rejection decisions;
creating aggregate attendance and submission statistics that do not identify individuals;
protecting the service against abuse, fraud, denial-of-service attacks, and unauthorized access;
meeting legal, regulatory, accounting, insurance, or institutional requirements; and
handling disputes, complaints, and requests to exercise data subject rights.

We do not use your registration data for unrelated marketing. We do not make decisions about you based on your geographic location. Any region information used to choose a CAPTCHA provider is discarded after that response.

Our collection, accuracy, retention, use, security, openness, and access practices are designed around the six Data Protection Principles in Schedule 1 of the PDPO.

5. Disclosure

Access is limited to organizers, conference reviewers, and technical staff who need the information for their duties. Reviewers receive the information needed to assess a poster, not the entire registration database.

We may disclose personal data to:

Cloudflare, when Cloudflare Turnstile is selected for security verification, under the Turnstile Privacy Addendum and Cloudflare Privacy Policy;
Alibaba Cloud, when Aliyun Captcha is selected for security verification, under the Alibaba Cloud Privacy Policy and the Aliyun Captcha server integration terms and documentation;
hosting, security, or IT contractors bound by confidentiality and security obligations;
HKUST personnel or units that need the information to support an authorized university activity;
law enforcement, regulators, courts, or other authorities where disclosure is required or permitted by law; and
emergency or medical personnel if needed to protect the safety of a person at the event.

We do not sell personal data. We do not share your registration information with conference sponsors for their own marketing.

6. Transfer outside Hong Kong

Cloudflare and Alibaba Cloud may process security signals outside Hong Kong. The conference server and backups may also be operated by providers in other jurisdictions. When personal data is transferred outside Hong Kong, we use contractual, technical, and access restrictions intended to protect it, but the destination may not have data protection laws equivalent to the PDPO.

7. Retention and deletion

Live conference registration records and poster PDFs are automatically deleted 180 days after submission, unless a longer period is required by law, a dispute, or an approved operational record. Duplicate-prevention records are deleted earlier when no longer needed. Administrator exports and backups may persist for a separate operational cycle and must be handled under the same retention decision.

When data is no longer required, we delete it in line with HKUST's data protection guidelines. Secure deletion from every backup or copied file may take an additional backup cycle.

8. Security

We use HTTPS, authenticated administrator access, private file storage, database permissions, request limits, file type and size checks, access logging, and restricted administrator export. Poster PDFs are not served as public website files.

No system is completely secure. If a suspected personal data breach occurs, the organizers will investigate, contain the incident, preserve relevant records, and make required notifications. Staff who handle exports must store them on approved systems, encrypt them where required, and delete them when they are no longer needed.

9. Your rights

Under the PDPO and Data Protection Principle 6, you may request access to your personal data and ask us to correct inaccurate data. You may withdraw consent for optional use where consent is the basis for that use. You may also ask us to delete information that we no longer need to retain.

Send requests to aidp2026hk@outlook.com with your submission reference where possible. Formal HKUST data access requests may also be handled under the procedure in the HKUST University Data Privacy Policy Statement. That policy states that data access requests will normally be addressed within 40 days and a processing fee may apply.

Withdrawing consent may limit our ability to provide registration updates or review a submission, but you may still ask us to stop optional uses. This notice does not reduce any right you have under the PDPO.

10. Submitting for others and minors

Only submit another person's information if you are authorized to do so. For a poster with several authors, the submitting author is responsible for making sure the author list is accurate and that the co-authors know the information and file were submitted for review.

This service is intended for conference participants and researchers. It is not directed at children. If a minor uses the service, a person with parental responsibility should review and approve the submission.

11. Changes

We may update this notice when the service, providers, retention period, or legal requirements change. Material changes will be posted before the next collection whenever practicable.

12. Contact

For privacy questions, correction requests, deletion requests, or suspected data incidents, contact aidp2026hk@outlook.com.

13. Official references

Links are provided for reference. The linked terms belong to their respective owners.

14. Governing framework

This notice and the processing it describes are governed by the laws of the Hong Kong Special Administrative Region. Any dispute concerning this notice will be handled under the applicable Hong Kong legal process.