DWA Privacy Policy

App: DWA - Digital Workflow
Publisher: Teng Wei Yuen, Singapore
Apple App Store publisher display name: Wei Yuen Teng
Google Play developer display name: SIMTech eDataLogger
Last updated: 23 September 2026

1. Who is responsible for your information

DWA is a business forms and workflow application for activities such as inspections, service work, approvals and laboratory or operational records. Teng Wei Yuen publishes the mobile application and is the contact for the publisher-operated organization directory, public website, demonstration/reviewer services and publisher support. In this policy, "we", "us" and "our" refer to Teng Wei Yuen in that capacity. SIMTech eDataLogger is the Google Play developer display name, not a separate legal entity for this policy.

Privacy contact and responsible person: Teng Wei Yuen
Email: wyteng05@gmail.com
Telephone: +65 9863 0285
Postal address: 17 West Coast Road, Singapore 127304

When you connect to a company workspace, that organization operates or selects its DWA server and determines the purposes, forms, authorized users, hosting and retention of its business records. It is normally responsible for that processing. We do not automatically receive a copy of every customer's database merely because we publish the mobile app. Where we host or support a customer workspace, we process its information within the agreed service and the customer's lawful instructions, except for information we independently need for security, support or legal obligations.

This policy covers the app, publisher-operated services and our handling of support/privacy requests. Your workspace's privacy notice and retention schedule explain its own business processing. Contact us if you need help identifying the appropriate workspace operator. Applicable privacy rights are not waived by this allocation of responsibilities.

2. Information DWA processes

Account and access information. Name, registered email, optional telephone number and profile photo, internal user identifier, organization membership, role, groups, account status, invitations and authentication/session information. Passwords are processed to authenticate you; secret credentials must not be included in support requests.

Business content. Form and table values, submitted and saved drafts, selected files and photos, drawn or digital signatures and signing details, inventory entries and transactions, task assignments, approvals, corrections, reasons and impacts of changes, and associated workflow and field audit history. A signature is an acknowledgement record; DWA does not use it as a biometric identification template.

AI-related information. When you choose an enabled AI feature, relevant prompts, selected documents, workflow rules, form/table values, metadata, previous forms, audit information and session conversation context may be processed according to the feature. AI analysis sessions may be stored for later viewing. A report of inappropriate AI output includes its category/source, your reason, a limited excerpt, your account identifier and review status.

Organization discovery and technical information. Organization codes or search terms submitted to the directory; request/network information such as IP address where processed by servers; application/device versions; necessary security and diagnostic events. The app stores selected organization settings and session material on the device to support sign-in and switching workspaces.

Your organization may configure forms containing health, financial, employment or other sensitive personal information. Such content is not automatically excluded from processing. Enter only information you are authorized to provide and that is necessary for the task. Publisher demonstration and reviewer workspaces must use fictional or non-confidential information.

3. Why information is used

We and the relevant workspace operator use information to provide account access, populate and validate forms, assign and complete tasks, support shared editing, preserve justified business records, generate and share reports, send account/task emails, provide optional AI functions, answer support requests, investigate abuse and secure the service. We use information for these disclosed purposes or another purpose permitted by applicable law.

Required information depends on the workspace and form. A field marked required may be necessary to complete that task. You can decline optional profile fields, device permissions or AI processing, but the corresponding feature may not be available. Where consent is relied upon, you may withdraw it for future processing; this does not automatically erase information that must lawfully be retained.

DWA does not include advertising or cross-app behavioral tracking features. We do not sell or rent your personal information or use workspace content for targeted advertising.

4. Who may receive information

Information is sent to the company server you select. Authorized colleagues, managers, reviewers and administrators may access records according to the workspace's permissions. Presence and change-history features may show your name and the time of your activity to authorized collaborators.

Hosting, storage, email, security and other technical providers process information needed for the configured service. When you share, print, download or email a record, the selected recipient, printer or application may receive a copy outside DWA. The recipient's handling of that copy is separate from DWA's active server record.

Information may also be disclosed when necessary to comply with law, protect rights and safety, investigate abuse, or manage a lawful business transfer with appropriate safeguards and notice. We do not give unrelated organizations access merely because they also use DWA.

5. Optional AI and document extraction

AI Check, previous-form review, data analysis and document extraction send the selected content and relevant context through the workspace server to its configured provider. The mobile app identifies that provider and asks you to allow the transfer before starting the AI operation. A model name and a hosting provider can be different; the actual route depends on the workspace configuration.

You may cancel and continue using non-AI functions available to your account. Do not send another person's confidential information without authority. AI output can be incomplete or wrong and must be reviewed before use; it does not replace a qualified person's professional judgement, approval or safety procedure.

We do not use workspace content to build our own general-purpose advertising or training dataset. External providers' storage, security, training-use terms and processing locations depend on the workspace's provider agreement and configuration. We do not promise zero retention or identical no-training terms for every provider. Ask your administrator before sending sensitive data.

Use Report AI content to flag an unsafe or inappropriate result. The report is sent to your organization administrator and contains your reason and at most 2,000 characters of the selected result, not an automatic copy of the entire workspace. You can also contact the publisher for escalation.

6. Device permissions and third-party SDKs

Camera access is used when you choose to scan an organization code or take a photo. System photo and document pickers allow you to select content; DWA does not need unrestricted access to your entire photo library for selection. Saving a captured photo to Photos/Gallery is optional and may need separate permission. Refusing that optional save should not prevent uploading an authorized form photo. You can change permissions in the device settings.

DWA does not request access to your contacts, microphone or device location for its current core functionality. A photo you select may already contain metadata supplied by your device; do not assume every attachment has had all embedded metadata removed.

On Android, QR scanning uses Google ML Kit. QR image processing is on-device, but Google documents collection of device/app information, installation-related identifiers, performance metrics and SDK events for diagnostics and usage analytics. This is distinct from uploading a document to the workspace's extraction provider. See Google's ML Kit data-disclosure information and Google's Privacy Policy. Operating-system and app-store services also process information under their own policies.

7. Security and processing locations

DWA uses HTTPS for supported server connections and platform secure storage for session credentials. Access controls and organization-scoped services limit record access. No application or network is absolutely secure. Protect your device and account, and report suspected unauthorized access promptly.

Server, storage, email and AI processing locations depend on your chosen workspace and its providers. Processing may take place outside Singapore or your country. Publisher-controlled transfers must use protections appropriate to applicable law; independently operated workspaces must apply their own required safeguards. We do not claim that all DWA data stays in Singapore or is end-to-end encrypted.

8. Account deletion, company assets and retention

Deleting an individual DWA account is not deleting a company workspace or its records. The account-deletion operation removes the selected account's live personal profile, including name, email, telephone, profile photo and thumbnail, its credentials and sessions, current memberships/access, and private AI analysis and workflow-drafting conversations. Minimum non-login identifiers may remain only to maintain the integrity of legitimate company references; they must not provide sign-in access or be represented as anonymous when they remain identifiable.

The operation does not delete, archive, redact or change company-owned workflow executions or tasks, whether ongoing or completed; workflow or form templates; master lists; inventory registers or transactions; saved business form/table values; execution snapshots; business attachments; reports/PDFs; signatures; or workflow, template and field audit history. This applies even when the departing user created the item or is its recorded author. A personal conversation and an approved company template/output saved from it are different records: deleting the conversation must not delete the company asset.

Deleting the live profile does not rewrite the name, signature, timestamp or action previously recorded as business evidence. Company records can therefore still contain personal data. Company ownership does not make such information anonymous or automatically exempt from privacy obligations.

The responsible workspace organization determines record-specific retention based on applicable law, regulatory requirements and legitimate documented purposes. A regulated production or laboratory record may have a different retention requirement from an ordinary administrative record. There is no universal DWA retention period for all customers. The organization must be able to explain the affected categories, applicable retention basis, duration or determining criteria, and access restrictions. Nothing in this policy grants unlimited retention simply because a record is called an audit record.

A request about personal information retained in company records is routed to the responsible organization for a separate authorized assessment. The self-service account-deletion operation never silently destroys or alters those records. Any legally necessary record-management action must follow applicable law, the organization's authorized controls and its audit requirements; this policy does not limit a person's applicable rights.

For publisher-operated account/support services, normal successful in-app profile and credential removal takes effect when confirmed by the server. For emailed requests, we verify identity, identify the responsible operator and explain the expected timing and any lawful retention. Applicable statutory deadlines still apply.

Security, support, AI-report and backup retention must be defined and maintained by the responsible operator for each category; this policy does not establish an unverified fixed schedule. Recovery procedures must prevent deleted accounts from regaining access before a restored system is reopened. This requirement is separate from account deletion in the active database. Removal does not recall independently exported email, files or device-gallery copies.

See Account Deletion for the in-app and public request methods. Removing a saved organization, uninstalling DWA or signing out alone is not account deletion.

9. Your choices and privacy requests

You can edit supported profile information, decline optional AI, adjust device permissions, sign out, delete private analysis sessions and initiate account deletion. Signing out, uninstalling the app or removing an organization from the device is not the same as deleting a server account.

To request access, correction, withdrawal of consent, deletion or information about transfers/retention, email wyteng05@gmail.com with your organization code and registered email. Do not send passwords, recovery codes or unnecessary identity documents. We use proportionate identity verification and coordinate with the relevant workspace operator when necessary.

We explain verification requirements, the responsible operator, expected timing and any information that must lawfully be retained. Contact the privacy address above for request status. We do not represent retention in company records as complete erasure or limit applicable legal deadlines.

Depending on applicable law, additional rights may include restriction, objection or portability. You can complain to the Personal Data Protection Commission of Singapore or your competent local authority. No right is waived by using DWA.

10. Intended users and policy changes

DWA is designed for authorized business users, not children. It is a general-purpose business forms/workflow client, not a claim of medical, clinical or regulatory certification. Publisher-run demo/reviewer services are intended for adults aged 18 or over; we do not ask users to supply birth dates merely to run ordinary business forms. Contact us if a child has supplied personal data without appropriate authority so we can investigate and take suitable action.

Material changes to this policy will be dated and communicated through an appropriate in-app or service notice where required. New processing requiring consent will not be justified solely by changing this page. The current policy, support and deletion resources remain publicly accessible without a DWA sign-in.

Contact: Teng Wei Yuen | wyteng05@gmail.com | +65 9863 0285 | 17 West Coast Road, Singapore 127304