CANAMED — Compliance & Accessibility Statement

Franco-Japanese clinical-communication training platform · Université de Caen Normandie × Nagoya University

WCAG 2.1 AA target GDPR (EU) APPI (Japan) No third-party trackers Owned source code

Accessibility

• Target standard: WCAG 2.1 level AA (aligned with the French RGAA criteria).
• Automated testing in CI: every change is scanned with axe-core (via @axe-core/playwright); the build fails on any serious or critical WCAG 2.1 AA violation on the splash, lobby, waiting room and privacy pages.
• Per-device testing: the interface is tested on desktop (Chromium, Firefox, WebKit) and on iPhone / iPad / Android viewport emulation for every UI change.
• Built-in accommodations: adjustable font size, light / dark / high-contrast themes, reduced-motion support, keyboard-operable controls (WAI-ARIA radio/listbox patterns), screen-reader labelling, and a 24×24 px minimum touch-target size.
• Inclusion by design: a fully trilingual interface (English / French / Japanese, with five further locales), explicit "you are assessed on your reasoning, not your English" guidance, and a one-tap "I'd rather observe" option in the roleplay.
• Known limitations & feedback: long-tail moderate/minor findings are tracked in the project's accessibility audit. To report a barrier, contact the maintainer (see the privacy notice).

Data protection (GDPR & APPI)

• Lawful basis & consent: participation and (separately) research use are opt-in, recorded with explicit, versioned consent before any data is collected.
• Data minimisation: the platform collects only what the workshop needs — a chosen display name, university, year, English level, and the answers/decisions made during the session. No special-category health data about the participant is collected.
• Pseudonymisation: exports and all reporting (impact report, accreditation evidence, research export, program overview) are aggregate and pseudonymous by default — no individual is named. A facilitator pseudonymisation toggle is available for the raw answer export.
• Authentication: students join via anonymous authentication — no account, email or password is required of participants.
• No email: the platform itself sends no email. Any follow-up — such as the link to the optional retention self-check — is shared by the session's facilitator through their own channels.
• Retention & rights: session data is retained per the documented retention policy and can be exported (right of access) or deleted on request. See the privacy notice for the full statement, contacts and your rights under GDPR / APPI.
• Residency: data is stored on Google Firebase. Sessions can be run in either institution's project.

Security

• Content Security Policy (script-src 'self') with all dependencies vendored locally — no third-party script origins.
• Output sanitisation: all rich-text rendered from translation tables is sanitised with a locally-vendored DOMPurify.
• Server-side authorization: Firebase Realtime Database security rules enforce write-once bindings, owner-keyed writes, and admin-gated session controls; abuse protection via Firebase App Check (reCAPTCHA).
• No third-party analytics or advertising trackers.
• Continuous verification: the security rules are exercised against the Firebase emulator in CI on every change.

Sustainability & ownership

• Cost: runs on Firebase's free (Spark) tier for typical workshop sizes — no licensing fees.
• No vendor lock-in: the institution owns the source code; the platform is a static site plus a database with open security rules.
• Offline-tolerant: a service worker pre-caches the application shell for resilience on conference-grade Wi-Fi.

← Back to the platform · Privacy notice · Facilitator guide