Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

• Identity & Contact Information: name, email, phone, WeChat ID, passport/national ID number (for visa invitation letters)
• Medical Information: medical records, test reports, diagnoses, medication history, allergy history, imaging (CT/MRI/PET-CT)
• Payment Information: last four digits of credit card, bank transfer receipts (full card numbers are not stored; encrypted by PCI DSS-compliant payment processors)
• Website Usage Data: IP address, device type, browser, pages visited (after cookie consent)
• Cost Comparison Tool Inputs: treatment category, condition severity, target city, daily income, number of companions

2. How We Use Your Information

3. Special Notes on the Cost Comparison Tool

The cost estimation tools we provide on the /cost-comparison and /cost-estimator pages default to purely client-side computation: the treatment category, condition severity, target city, daily income, number of companions, and other parameters you select are not uploaded to our servers, nor written to Cookies/LocalStorage.

If you fill out and submit the /contact form, the relevant information will enter our CRM, with the same retention periods as described above.

Daily income constitutes sensitive personal information (which may infer economic status). This field is optional — leaving it blank will not calculate opportunity cost. By choosing to fill it in, you are deemed to have given explicit consent for local browser-side processing.

4. How We Share Your Information

We only share your information under the following circumstances:

• Partner Hospitals & Doctors: sharing necessary medical records and identity information to arrange appointments and treatment
• Payment Service Providers: Stripe / Adyen / PingPong etc. (subject to PCI DSS certification)
• Cloud Services & Infrastructure: AWS Hong Kong / Alibaba Cloud Singapore region (data transmission defaults to TLS 1.3, at-rest encryption AES-256)
• Regulatory Requirements: pursuant to court orders, lawful requests by regulatory authorities, or anti-money laundering/counter-terrorism financing obligations

We do not sell your personal information, nor do we share it with third-party advertising platforms.

5. Cross-Border Data Transfers

Our primary servers are located in Hong Kong, with some data potentially backed up to AWS Singapore. For EU users, cross-border data transfers to Hong Kong rely on EU Standard Contractual Clauses (SCC, 2021/914). Transmissions are protected by TLS 1.3 encryption + AES-256 at-rest encryption + strict access controls (role-based least privilege).

6. Your Rights

6.1 EU Users (GDPR)

You enjoy the following rights:

• Right to be informed (Art 13-14): This policy serves as the notice
• Right of access (Art 15): Obtain a copy of your personal information
• Right to rectification (Art 16): Correct inaccurate information
• Right to erasure / Right to be forgotten (Art 17): Deletion when conditions are met
• Right to restriction of processing (Art 18): Suspend specific processing activities
• Right to data portability (Art 20): Export your data (JSON / CSV)
• Right to object (Art 21): Object to processing based on legitimate interests
• Right to lodge a complaint with a supervisory authority (Art 77): You may complain to the data protection authority in your country of residence

6.2 California Users (CCPA / CPRA)

You have:

• Right to know: Understand the categories and purposes of PI collected
• Right to delete: Delete your PI
• Right to correct: Correct inaccurate PI
• Right to limit use of sensitive PI
• Right to non-discrimination: Exercising your rights will not result in price/service discrimination
• Right to opt-out of sale/sharing: We do not sell PI, but you may designate an opt-out

6.3 Mainland China Users (PIPL)

For data generated within Mainland China, you have the rights to be informed, to decide, to inquire, to copy, to correct, and to delete under the Personal Information Protection Law. Cross-border transfers are handled in accordance with the Data Export Security Assessment Measures and supporting rules.

7. Exercising Your Rights

To exercise any of the above rights, please send an email to: [email protected] (English or Chinese accepted)

We will respond within 30 calendar days (GDPR statutory maximum). To verify your identity, we may require you to provide a copy of your passport/national ID.

8. Cookies & Tracking

Our website uses the following categories of cookies:

• Essential Cookies: always enabled (session, CSRF token, language preference)
• Analytics Cookies: enabled only after your consent (Google Analytics 4 / Plausible)
• Marketing Cookies: enabled only after your consent (Meta Pixel / LinkedIn Insight Tag)

You can manage consent through your browser settings or the "Cookie Preferences" button at the bottom of our website. Withdrawing consent does not affect processing carried out prior to withdrawal.

9. Data Security

The technical and organizational measures we adopt include:

• TLS 1.3 site-wide encryption
• AES-256 at-rest encryption
• Role-based access control (RBAC) + least privilege
• Annual third-party security audits + penetration testing
• Employee HIPAA + GDPR training
• 24/7 anomalous behavior monitoring
• Data breach notification mechanism within 72 hours (GDPR / PIPL)

10. Children's Privacy

Our services are not directed at minors under 18 years of age. If medical appointments need to be made for minor children, a consent form must be signed by a parent/legal guardian.

11. Policy Changes

This policy may be updated. Material changes will be notified via email (if available) or website banner. Continued use of our services constitutes acceptance of the updated policy.

12. Contact Information

Data Protection Officer (DPO): [email protected] / XX/F, XXX Building, XXX Queen's Road Central, Hong Kong

EU Representative (GDPR Art 27): [email protected] / (Designated based on the primary country of origin of clients; see our website footer for details)