Introduction
SinoMediMate ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our website and services. It applies to all visitors, registered users, patients, and patient navigators ("you" or "your").
Our services are operated by Shanghai Guiyi Technology Co., Ltd. (上海归宜科技有限公司), registered in Shanghai, China. We process personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA), the California Consumer Privacy Act (CCPA) for California residents, the Lei Geral de Proteção de Dados (LGPD) for Brazil, the Personal Data Protection Act (PDPA) for Singapore, and the Personal Information Protection Law (PIPL) for China.
1. Information We Collect
We collect the following categories of information:
1.1 Personal Information
- Contact Details: Full name, email address, phone number, country of residence, nationality, and preferred language.
- Account Credentials: Encrypted passwords and account identifiers.
- Payment Information: Payment method details (PayPal account ID, transaction IDs). We do not store full credit card numbers; these are processed securely by our payment providers (PayPal, Airwallex).
1.2 Health and Medical Information
- Medical symptoms, histories, and diagnostic reports (e.g., MRI, CT, X-rays) that you voluntarily share via our AI Symptom Guide, booking forms, or support tickets.
- Hospital preferences, department selections, and appointment details.
- Important: This information is strictly used for facilitating navigation and translation services. We do not use it for medical diagnosis or treatment decisions.
1.3 Technical and Usage Data
- Device Information: IP address, browser type and version, operating system, device type, screen resolution.
- Usage Data: Pages visited, time spent on pages, clicks, referral URLs, and feature interactions.
- Cookies and Tracking Technologies: See our Cookie Policy section below.
1.4 Communication Data
- Messages exchanged via our Support Page (Tidio Live Chat), email correspondence, and AI chat conversations.
- Ticket IDs and support history linked to your email address.
1.5 Companion Data (for Companions)
- Identity documents (ID card front/back, professional certificates) uploaded during registration.
- Profile information, language skills, availability status, and service history.
2. How We Collect Information
- Directly from you: When you fill out forms, book services, register as a navigator, use the AI chat, or contact support.
- Automatically: Through cookies, server logs, and analytics tools when you browse our website.
- From third parties: Payment providers (PayPal, Airwallex) share transaction confirmation details; hospitals may share appointment status updates.
3. How We Use Your Information
We use your information for the following purposes:
- Service Delivery: To process bookings, match you with navigators, coordinate hospital appointments, and provide translation services.
- AI Assistance: To power our AI Symptom Guide, which helps you identify suitable hospital departments. Your chat messages are sent to third-party AI providers for processing (see Section 8: AI Data Processing).
- Customer Support: To respond to inquiries, resolve issues, and process refund or cancellation requests.
- Payment Processing: To process deposits and service fees through our payment providers.
- Communication: To send booking confirmations, appointment reminders, service updates, and marketing communications (only with your consent).
- Security and Fraud Prevention: To detect and prevent unauthorized access, fraud, or abuse.
- Legal Compliance: To comply with applicable laws, regulations, and legal obligations.
- Service Improvement: To analyze usage patterns and improve our website functionality and user experience.
4. Legal Basis for Processing (GDPR)
Under the GDPR, we process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to fulfill our service contract (e.g., booking coordination, navigator assignment).
- Legal Obligation: Processing required to comply with applicable laws (e.g., tax records, fraud prevention).
- Legitimate Interests: Processing for our legitimate business interests (e.g., service improvement, security), provided your rights and interests do not override these interests.
- Consent: Processing based on your explicit consent (e.g., marketing communications, optional health data sharing, AI chat usage). You may withdraw consent at any time.
5. Data Sharing and Third Parties
We do not sell your personal data. We may share your data with the following categories of recipients:
5.1 Service Providers
- Payment Processors: PayPal, Airwallex (for payment processing and fraud prevention).
- AI Service Providers: FreeLLMAPI (router), OpenRouter, Mistral AI, NVIDIA NIM, GitHub Models, and HuggingFace (for AI chat processing). Your chat messages are transmitted to these providers; see Section 8 for details.
- Live Chat Provider: Tidio (for customer support messaging).
- Cloud Infrastructure: Amazon Web Services (AWS) Lightsail Singapore (for website hosting and data storage).
5.2 Companions
Your contact information and medical navigation needs are shared with the assigned patient navigator to facilitate service delivery. Navigators are contractually bound to confidentiality.
5.3 Medical Institutions
Your appointment details and relevant medical information are shared with the hospital or clinic you choose to visit, solely for the purpose of scheduling and preparing your consultation.
5.4 Legal and Regulatory Authorities
We may disclose your data if required by law, court order, or governmental request, or to protect our rights, property, or safety, or the rights of others.
6. International Data Transfers
Our servers are hosted in Singapore (AWS Lightsail). Our company is registered in Shanghai, China. Our payment processors operate in the United States (PayPal) and internationally (Airwallex). Our AI chat messages are routed through third-party AI providers, which may process data in various jurisdictions including the United States, European Union, and others.
When we transfer your personal data outside your country of residence, we implement appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) for transfers to jurisdictions without adequate data protection.
- Data encryption in transit (TLS 1.2+) and at rest.
- Contractual agreements with third-party providers requiring them to maintain appropriate security measures.
7. Data Security
We implement industry-standard security measures to protect your data:
- Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. API keys and sensitive credentials are encrypted at rest.
- Access Controls: Access to personal data is restricted to authorized personnel only.
- Monitoring: We monitor our systems for security vulnerabilities and unauthorized access attempts.
- Payment Security: Full payment card details are never stored on our servers; they are processed directly by PCI-DSS-compliant payment providers.
While we strive to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
8. AI Data Processing (Important)
Our AI Symptom Guide sends your chat messages to third-party AI providers for natural language processing. This is governed by the following rules:
- What is shared: Only the text you type into the AI chat interface is transmitted. We do not share your name, email, or other account information with AI providers unless you include it in your chat message.
- Providers: Your messages may be routed through FreeLLMAPI (our router), which then selects an optimal model from OpenRouter, Mistral AI, NVIDIA NIM, GitHub Models, or HuggingFace.
- Retention: Chat messages are temporarily stored in your browser's localStorage for session continuity. We do not permanently store AI chat conversations on our servers.
- Warning: Do not share sensitive personal information (e.g., full name, address, ID numbers, credit card details) in the AI chat. The AI is not a secure medical record system.
- Medical Disclaimer: AI responses are for informational purposes only and do not constitute medical advice. Always consult a licensed healthcare professional.
9. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Booking and Service Data: Retained for 7 years after service completion (for tax and legal compliance purposes).
- Account Information: Retained for as long as your account is active. You may request deletion at any time.
- AI Chat Conversations: Stored in your browser only (localStorage) and can be cleared by clearing your browser data.
- Support Tickets: Retained for 3 years after ticket resolution.
- Payment Records: Retained for 7 years in accordance with tax regulations.
- Navigator Documents: Retained for the duration of the navigator's engagement plus 2 years after termination.
After the applicable retention period expires, your data is securely deleted or anonymized.
10. Your Rights
Depending on your location and applicable laws, you have the following rights regarding your personal data:
10.1 GDPR Rights (EEA Residents)
- Right to Access: Request a copy of your personal data.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your data when it is no longer necessary.
- Right to Restrict Processing: Request that we limit how we use your data.
- Right to Data Portability: Receive your data in a structured, machine-readable format and transfer it to another controller.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
- Right to Lodge a Complaint: File a complaint with your local data protection authority.
10.2 CCPA Rights (California Residents)
- Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected.
- Right to Delete: Request deletion of your personal information.
- Right to Opt-Out: Opt out of the sale of personal information. We do not sell personal information.
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
10.3 LGPD Rights (Brazil Residents)
- Right to Confirmation: Confirm whether we process your personal data.
- Right to Access: Access your personal data.
- Right to Correction: Correct incomplete, inaccurate, or outdated data.
- Right to Anonymization, Blocking, or Deletion: Request anonymization, blocking, or deletion of unnecessary or excessive data.
- Right to Portability: Port your data to another service provider.
- Right to Information: Information about third parties with whom we share your data.
- Right to Withdraw Consent: Withdraw consent at any time.
10.4 PIPL Rights (China Residents)
- Right to Know and Decide: Know how your personal information is processed and have the right to restrict or refuse processing.
- Right to Access and Copy: Access and obtain a copy of your personal information.
- Right to Correction and Deletion: Request correction or deletion of your personal information.
- Right to Withdraw Consent: Withdraw consent for processing based on consent.
10.5 PDPA Rights (Singapore Residents)
- Right to Access: Request access to your personal data.
- Right to Correction: Request correction of inaccurate personal data.
- Right to Withdraw Consent: Withdraw consent for the collection, use, or disclosure of personal data.
To exercise your rights, contact us via our Support Page or email support@withyora.com. We will respond within 30 days (or the applicable timeframe under your local law).
11. Cookies and Tracking Technologies
We use cookies and similar technologies to:
- Essential Cookies: Enable core website functionality (e.g., booking forms, login sessions). These cannot be disabled.
- Analytics Cookies: Help us understand how visitors interact with our website (e.g., Google Analytics, if implemented).
- Preference Cookies: Remember your language preferences and display settings.
- Third-Party Cookies: Our live chat provider (Tidio) and payment providers may set their own cookies.
You can manage your cookie preferences through our cookie banner or your browser settings. Note that disabling certain cookies may affect website functionality.
12. Children's Privacy
Our services are not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately, and we will take steps to delete such information.
13. Data Protection Officer (DPO)
We have appointed a Data Protection Officer responsible for overseeing our privacy practices and ensuring compliance with data protection laws.
- Email: support@withyora.com
- Address: Room 701, No. 58 Xinyuan Road, Anting Town, Jiading District, Shanghai 201805, China
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting a notice on our website or by email. The "Last Updated" date at the top of this policy indicates when it was last revised.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Email: support@withyora.com
- Support Page: sinomedimate.com/support.html
- Registered Company: Shanghai Guiyi Technology Co., Ltd. (上海归宜科技有限公司)
- Registered Address: Room 701, No. 58 Xinyuan Road, Anting Town, Jiading District, Shanghai 201805, China