Privacy Policy

1. Data Controller and Contact Channels

Aurehealth (HK) Co., Limited (registered address: Room 602, 6/F, Kai Yu Commercial Building, 2C Argyle Street, Mong Kok, Kowloon, Hong Kong; hereinafter referred to as “Xinheal,” “Aurehealth,” or “we”) is responsible for the personal information processing activities relating to this website. Depending on the specific scenario, different service providers may act as entrusted processors, service providers, or independent personal information processors/controllers; the final role shall be determined by applicable law and contract.

Privacy contact channel: xinheal888@gmail.com; mailing address: Room 602, 6/F, Kai Yu Commercial Building, 2C Argyle Street, Mong Kok, Kowloon, Hong Kong. Data Protection Officer, EU/UK representative, or other local representative (if applicable): None.

2. Scope of This Policy

This Policy applies to the Xinheal public website, contact forms, the appointment coordination call portal, third-party forms/calendars/chats embedded in the website, and the non-clinical communications you choose to have with us via email, telephone, or WhatsApp.

3. Information We May Collect

Information we may collect (to be verified line by line against the actual data flow)

Category	Examples	Current Purpose
Identity and contact information	Name, email address, telephone or WhatsApp number	Responding to requests, arranging communications
Geographic and communication preferences	Country/region, preferred language, contact time, contact channel	Assigning appropriate communication method and timing
Inquiry category	General customer service, partnership, media; reviewed coarse-grained service categories	Identifying the type of request
Free text (if retained)	General customer service, media, or partnership messages; may inadvertently contain sensitive content that should not be submitted	Understanding general requests and executing misdirection handling
Appointment and interaction information	Appointment time, form submission status, non-clinical communication records	Arranging and following up on coordination calls
Source and consent records	Coarse-grained source codes, permitted UTM fields, consent text version, timestamp	Attribution, compliance evidence, and process improvement
Technical and security information	IP address, device/browser, timestamp, request ID, error classification, security logs	Website operation, security, abuse prevention, and troubleshooting
Analytics information (with consent)	Page categories, sessions, de-identified events, cookie identifiers	Understanding website usage and improving experience
Cookie choice records	Selected categories, timestamp, language, region determination, and policy version	Enforcing and evidencing the user’s cookie choices

Medical service names, disease-page visits, source URLs, or advertising tags may give rise to inferences about health interests. In the formal implementation, granularity should be minimized, unnecessary association with identity data should be avoided, and the legal basis and access scope should be confirmed by privacy/legal.

4. Information Not to Be Submitted Through Public Websites

Please do not send diagnoses, symptoms, medical history, prescriptions, medications, examination reports, images, treatment plans, insurance information, identity documents, bank card information, or attachments through public websites, ordinary forms, online chats, WhatsApp, or general emails. The production version should preferably remove patient-related free text and replace it with fixed options; if the business decides to retain general messages, it must truthfully disclose the actual collection, limit the purpose and permissions, and implement sensitive-content interception, isolation/deletion, audit, and retention periods — relying on reminders alone is insufficient.

If you inadvertently send such information, we will, in accordance with applicable law and internal procedures, restrict access, isolate, delete, or require resubmission through an approved secure channel, and record the necessary handling status.

5. Sources of Information

We may obtain information from the following sources:

• Forms you complete directly or contact channels you select.

• Your non-clinical communications with customer service or coordination personnel.

• Browsers, devices, and website security logs.

• Data generated by analytics tools with your consent.

• Reviewed source codes or advertising parameters you carry when visiting the website.

• Family members, guardians, or agents you explicitly authorize.

6. Purposes and Legal Bases of Processing

We process personal information only to the extent permitted and necessary under applicable law, primarily for:

• Responding to your requests and arranging coordination calls.

• Identifying language, time zone, and preferred contact channel.

• Establishing and maintaining non-clinical CRM lead records.

• Safeguarding website security, troubleshooting, and preventing abuse.

• Recording privacy, contact, and marketing consents.

• Sending non-medical service information with your consent.

• Conducting website analytics and effectiveness evaluation with your consent.

• Fulfilling legal obligations, handling complaints, and protecting legitimate interests.

The processing bases that may apply include your consent, pre-contractual measures taken to respond to your request, fulfillment of legal obligations, and legitimate interests permitted under applicable law; the specific basis and applicable region depend on the law applicable to your location. Marketing, non-essential cookies, and the processing of sensitive information required by applicable law should use independent consent and should not be bundled with general inquiries.

This website does not currently make decisions that produce legal or similarly significant effects on you solely through automated processing, nor does it plan to sell personal information. If we enable cross-site targeted advertising, advertising audiences, or activities that may constitute a “sale/share” in the future, we will update this Policy before activation, provide the required choice entry points, and comply with applicable requirements.

7. With Whom We Share Information

To achieve the foregoing purposes, we may provide necessary information to the following categories of recipients:

Sharing and recipients (GA4/GTM descriptions have been revised to reflect the actual implementation)

Recipient Category	Current or Planned Products	Primary Purpose
Website and hosting	WordPress and related infrastructure	Pages, CMS, network transmission, security logs
CRM, forms, and appointments	HubSpot Forms, CRM, Meetings, and Chat enabled upon approval	Leads, forms, appointments, and non-clinical follow-up
Communication platforms	Corporate email, telephone, WhatsApp/Meta	Replying and communicating per user choice
Analytics and tags	Google Analytics / Google Ads tags within the Google Tag Manager container, WordPress native analytics (all enabled after consent gating)	De-identified website analytics; the two analytics layers are implemented and accepted separately
Search performance	Google Search Console	Website verification, indexing, and aggregated search performance
Professional services	Authorized development, operations, legal, privacy, and security service providers	System support, audits, and professional advice
Public authorities	Regulatory, law enforcement, judicial, or other legally empowered authorities	Complying with legal requirements or protecting legitimate interests

Supplier names, product versions, data roles, and sub-processors may change. For current recipients and sub-processors, please contact xinheal888@gmail.com. We will not, by virtue of this Policy alone, authorize suppliers to use personal information for purposes unrelated to Xinheal.

8. Cross-Border Transfers

Website visitors, Xinheal, and third-party service providers may be located in different countries or regions. Personal information may be processed by Xinheal and its service providers in Hong Kong and other countries or regions, and the protection level of the relevant jurisdictions may differ from that of your location.

Where required by law, we will provide the overseas recipients, processing purposes, categories of information, methods of exercising rights, and applicable safeguards, and obtain separate consent or adopt applicable adequacy decisions, standard contractual clauses, UK IDTA/Addendum, certifications, security assessments, standard contracts for cross-border transfer of personal information, or other lawful mechanisms. The specific cross-border transfer mechanisms, overseas recipients, and processing regions will be determined based on applicable law, the actually enabled service providers, and the corresponding contracts.

9. Retention Periods

We retain information for the shortest period necessary to achieve the purposes, taking into account legal, complaint, audit, and security requirements. The current retention periods are as follows:

Data Category	Retention Period	Trigger for Deletion or Anonymization
Unconverted leads	6 months after last interaction	Expiry of period, valid deletion request, or cessation of purpose
Contact preferences	General preferences retained 6 months with the lead; unsubscribe/refusal of marketing records retained in minimized form, in principle not less than 3 years after the last marketing	After the proof obligation ends
Appointment and non-clinical communication records	2 years after service stage completion or last interaction; enters legal hold upon complaint or dispute	Service stage completed and no retention obligation
Privacy and marketing consent records	During the validity of consent and 3 years after withdrawal, unsubscribe, or last relevant processing	After the proof obligation ends
Website security logs	6 months; logs related to security incidents, complaints, or investigations may be retained up to 3 years after case closure	After the security troubleshooting window ends
GA4 and similar analytics data	Recommended 2 months; extended to 14 months only if annual analytics is genuinely necessary and assessed	Upon tool setting expiry or after user withdrawal per capability
WhatsApp records	Device-side records deleted 90 days after last interaction; necessary business records transferred to approved CRM retained 2 years	Follow-up purpose completed, statutory period expired, or valid deletion request
Employee device records	Deleted within 30 days after synchronization completes
Misdirected sensitive information original/text/attachments	Deleted within 7 days after identification, notification, and secure diversion	Retain necessary handling evidence excluding medical content
Misdirected sensitive information handling records	Delete medical content, retain only de-identified handling evidence for 3 years

10. Cookies and Similar Technologies

We use necessary cookies to maintain sessions, security, and website operation. With your consent, we may use analytics cookies or load third-party embeds. Detailed names, providers, purposes, durations, and methods of choice are set out in the Cookie Policy. Except for necessary technologies permitted by applicable law, tags requiring consent shall not be loaded before you consent.

11. Information Security

We will disclose the actual administrative and technical measures implemented based on pre-launch verification results, which may include access control, individual accounts, multi-factor authentication, transmission protection, least privilege, log de-identification, vendor management, backups, and incident response. Only measures that have been implemented and verified may be published as facts on the official page. Internet transmission and third-party systems cannot guarantee absolute security; we will handle security incidents in accordance with the law and notify individuals and regulators when required.

12. Your Rights and Third-Party Websites

Under applicable law, you may have the right to:

• Learn about and access the personal information we process.

• Request correction, supplementation, copying, portability, or deletion.

• Withdraw consent, object to, or restrict specific processing.

• Cancel marketing subscriptions and manage cookie choices.

• Learn about cross-border recipients and methods of exercising rights.

• Request explanation, review, or complaint regarding a decision to refuse a request.

• Lodge a complaint with the competent supervisory authority.

You may submit requests to xinheal888@gmail.com. We may verify your identity to protect your and others’ rights and interests. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, nor processing that must continue based on other lawful grounds.

After clicking external links to hospitals, government, HubSpot, WhatsApp, Google, or other third parties, the third party may process information pursuant to its own policies. Please read the relevant policies before use. Xinheal cannot control third parties’ independent processing activities, but will conduct vendor due diligence and contract management within its controllable scope.

13. Minors, Policy Updates and Contact

This website does not actively target minors under the age of 18. Public forms should not contain the name, condition, or information of a minor patient; family members or guardians should only submit their own contact information first. Where entry into a subsequent medical information process is genuinely necessary, guardianship relationships should be verified, applicable authorization obtained, and additional protections adopted. If unauthorized collection is discovered, please contact xinheal888@gmail.com.

We may update this Policy due to changes in services, suppliers, technology, or law. Material changes will be notified in a prominent manner, and the version and effective date will be updated. For historical versions of this Policy, please contact xinheal888@gmail.com.

For privacy questions, rights requests, or complaints, please contact: xinheal888@gmail.com. If you are dissatisfied with the handling result, you may complain to the competent personal information protection regulator as prescribed by applicable law.

If any provision of this Policy is deemed invalid by a competent authority, such invalidity shall not affect the validity of the remaining provisions.