Privacy Policy

Privacy overview

Table 1 · Privacy overview (7 items)

1. Scope of this policy

This policy applies to personal information processed through HaiyiMed services that link to or reference it, including the HaiyiMed website and HaiyiMed-controlled affiliate sites, mobile apps, patient consultation and information request forms, provider marketplace features, messaging and communication tools, customer support, newsletters, referrals and related digital services.

Separate or supplementary privacy notices may apply to specific products, regions, features, events, employment or business relationships. Where a supplementary notice conflicts with this policy regarding the specific processing it covers, the supplementary notice prevails.

This policy does not apply to the independent privacy practices of healthcare providers, travel companies, payment providers, websites, apps or other third parties not controlled by HaiyiMed.

2. Who we are and who controls your information

HaiyiMed is a limited liability company in Xi'an, Shaanxi, China. When HaiyiMed determines the purposes and means of processing personal information, it is the controller or responsible business for that personal information.

located at Block B, Kai'ai Building, Lianhu District, Xi'an, Shaanxi 710003, China. Email: info@haiyimed.com (ASCII alternative: legal@haiyimed.com).

In some workflows, HaiyiMed may process information on behalf of other organizations under contract. In such cases, that organization may be the controller/responsible party for the data, and its privacy statement may also apply.

3. Providers are independent organizations

When you ask HaiyiMed to contact a healthcare provider for you, or when you choose a clinic, hospital, physician, dentist or other provider, HaiyiMed may disclose the information needed to respond to your inquiry or assess your request. The provider may thereafter process your information for its own clinical, administrative, legal and regulatory purposes.

Providers are typically independent organizations that, under applicable law, may act as independent data controllers, businesses, regulated entities or otherwise. After they receive your information, their privacy statements, medical-record rules, informed-consent forms, data-retention requirements and local laws may apply. HaiyiMed does not control providers' independent record-keeping or treatment decisions.

4. Personal information we collect

The information we collect depends on how you use HaiyiMed. We may collect the following categories:

Table 2 · Personal information we collect (13 items)

5. Sources of personal information

• When you act directly — submitting inquiries, creating accounts, uploading records, contacting support, communicating with providers, subscribing to messages or using the mobile app.
• When healthcare providers and other users send information or update cases through workflows managed by HaiyiMed.
• Obtain information about your device and browser through cookies, logs, SDKs, APIs and similar technologies.
• Affiliates, referral partners and business partners, providing information where permitted.
• Public or professional resources, such as provider websites, licensing/certification sources and public directories, particularly provider/business information.
• Service providers supporting security, analytics, communications, authentication, payments, hosting, customer support or other platform functions.

6. How we use personal information

• Provide and operate HaiyiMed services, accounts, inquiry forms, communication tools and mobile features.
• To connect you with a healthcare provider you have chosen, requested or authorized us to contact, and to transmit the information the provider needs to review or respond.
• To facilitate quotes, booking requests, consultations, record reviews, follow-ups, case management and medical travel coordination.
• To communicate about your inquiries, cases, service messages, security notices, bookings, provider replies and support requests.
• Personalize search results, provider recommendations, content, language, destination information and service experiences.
• To protect users and the platform, detect fraud or abuse, investigate complaints, enforce terms and policies, and maintain audit/security logs.
• Analyze performance, diagnose technical issues, conduct research and improve our website, apps, services and user experience.
• Operating permitted AI-assisted, search, matching, translation, summarization, routing or customer-support features, subject to the safeguards below.
• Where permitted by law and your choices, send you newsletters, service updates, SMS, WhatsApp or other marketing messages.
• Comply with legal obligations, respond to lawful requests, establish or defend legal claims, protect vital interests and cooperate with regulators or law enforcement when needed.
• Support corporate transactions such as mergers, acquisitions, financing, restructuring or asset sales in accordance with applicable privacy requirements.

7. Health information and consumer health data

Health information requires heightened protection. Under the law, it may include not only medical records and diagnoses but also information that reveals or allows inference of health, such as treatment searches, appointment requests, page interactions, location related to healthcare services, or other contextual information.

HaiyiMed health data standards:

• We do not sell medical records for monetary gain.
• We do not use uploaded medical-record content or patient treatment-inquiry information to build third-party advertising profiles, nor knowingly disclose such material to advertising partners for targeted advertising.
• We collect health information you provide or authorize us to receive, mainly to respond to your requests, coordinate your case and share relevant information with providers you choose or authorize.
• Our goal is to limit collected information to what is reasonably necessary for providing services or the care-coordination stage.
• Where consent is required by law to collect or share consumer health data or sensitive health information, we seek the necessary consent or authorization before the relevant processing.
• Where applicable law requires a separate Consumer Health Data Privacy Policy or additional notice, HaiyiMed will provide it as a supplement to this policy.
• HaiyiMed configures advertising and analytics technologies to avoid transmitting medical-record content, patient-form content or page-level data that directly identifies a diagnosed condition to advertising partners.

Separate consent for sensitive personal information: Health information is sensitive personal information under the Personal Information Protection Law. Except as described in this policy's “Special provisions under Chinese law” section, before collecting or processing sensitive personal information such as your health information, we obtain yourseparate consent, and fully explain the processing purpose, necessity and impact on your rights and interests. You have the right to refuse or withdraw such separate consent; withdrawal does not affect processing already carried out based on consent, and except as required by laws or to provide services, we will not refuse basic services because you refused or withdrew consent.

8. Important note on HIPAA and other health privacy laws

The US Health Insurance Portability and Accountability Act (HIPAA) does not apply to every company handling health-related information. HIPAA generally applies to HIPAA covered entities and their business associates. Therefore, even when users provide health information, HaiyiMed's general consumer marketplace activities are not automatically governed by HIPAA.

If HaiyiMed acts as a business associate of a HIPAA covered entity and processes protected health information under a valid HaiyiMed user agreement, HaiyiMed will handle that information in accordance with the applicable agreement and HIPAA requirements. Health information outside HIPAA may still be protected by the FTC Act, the FTC Health Breach Notification Rule, state consumer health privacy laws, GDPR/UK GDPR and other applicable laws.

Special provisions under Chinese law (PIPL, DSL, CSL)

HaiyiMed is operated by a company within the People's Republic of China; therefore the PRC Personal Information Protection Law (“PIPL”), Data Security Law (“DSL”) and Cybersecurity Law (“CSL”) form the primary legal framework applicable to this Privacy Policy, and prevail over this policy's descriptions of other countries' or regions' laws (such as HIPAA, GDPR or US state laws).

Purposes, methods and categories of personal information processed

The purposes, methods and categories of personal information we process are described in this policyArticle 4(Personal information we collect),Article 6(How we use personal information) andArticle 19(Data retention). We process your personal information only where one of the lawful bases in Article 13 of the PIPL applies:

• With your consent;
• Necessary to enter into or perform a contract to which you are a party;
• Necessary to perform statutory duties or legal obligations;
• Necessary to respond to public-health emergencies, or in emergencies to protect your life, health or property;
• Processing personal information within a reasonable scope for news reporting or public-opinion supervision in the public interest;
• Processing personal information you have made public yourself or that is otherwise lawfully public, within a reasonable scope under this law;
• Other circumstances prescribed by laws and administrative regulations.

Notification items

Under Article 17 of the PIPL, when collecting your personal information we inform you through this policy and other corresponding notices of: the processor's name and contact details, processing purposes and methods, categories of personal information processed, retention periods, and how you may exercise your rights. This policy"Privacy overview"and the sections above constitute part of such notifications.

Sensitive personal information and separate consent

Health information is sensitive personal information under the PIPL. Except as this policyArticle 7beyond the health-information protection standards listed, when processing your sensitive personal information (especially health information) we will obtain yourseparate consent, and fully explain the processing purpose, necessity and impact on your rights and interests; for personal information of minors under 14, we additionally obtain parental or guardian consent under Article 31 of the PIPL (see this policyArticle 24).

Cross-border provision of personal information

If we provide your personal information (especially sensitive personal information such as health information) outside the People's Republic of China, we will follow one of the compliant pathways under Article 38 of the PIPL, inform you in advance of the overseas recipient's name, contact details, processing purposes and methods, categories of personal information, and how you may exercise rights against the recipient, and obtain your separate consent as required by law:

• Security assessment organized by the CAC;
• Personal information protection certification by a professional body per CAC regulations;
• Concluding standard contracts formulated by the CAC with overseas recipients and filing them.

See this policy for the specific countries/regions of overseas recipients, transfer methods and safeguardsArticles 18(international data transfers).

Domestic representative and data protection officer

If the personal information we process meets the thresholds in Article 53 of the PIPL, we will designate a domestic representative or a dedicated data protection officer and, through this policy"Questions, complaints and contact information"(Article 29) to provide you with their contact details.

Channels for exercising rights

Your rights under the PIPL — access, reproduction, correction, supplementation, deletion, transfer, requests for explanation, withdrawal of consent and account deletion — may be exercised through the channels listed in this policyArticles 20 and 21in the manner listed.

9. Legal bases for processing data in the EEA, UK and similar jurisdictions

Where laws such as the GDPR or UK GDPR require a legal basis, HaiyiMed relies on one or more of the following, depending on the processing:

Table 3 · Legal bases for processing data in the EEA, UK and similar jurisdictions (6 items)

10. How and with whom we disclose personal information

We may disclose personal information to the following categories of recipients for the purposes described in this policy:

Table 4 · How and with whom we disclose personal information (8 items)

11. Sale, sharing, targeted advertising and sensitive information

Terms used in privacy laws — “sale”, “sharing”, “targeted advertising” and “cross-context behavioral advertising” — may include some advertising disclosures even without monetary exchange. HaiyiMed does not sell medical records for monetary gain.

If HaiyiMed's online advertising or analytics activities are deemed a sale, sharing or targeted advertising under applicable law, we will provide the required notices and opt-out mechanisms. Where necessary, we also honor recognized browser- or device-based universal opt-out signals such as Global Privacy Control.

We do not knowingly sell or share children's or teens' personal information in any manner that violates applicable law, nor use uploaded medical records or patient treatment-inquiry content for third-party targeted advertising.

12. Cookies, pixels, SDKs and similar technologies

HaiyiMed and authorized service providers may use cookies, pixels, SDKs, local storage, log files and similar technologies to operate services, remember preferences, measure performance, prevent fraud, understand usage and, where permitted, support advertising or campaign measurement.

Table 5 · Cookies, pixels, SDKs and similar technologies (4 items)

You can manage non-essential technologies via the privacy or cookie settings on the website or app. Browser settings may also allow you to delete or block cookies. Blocking certain technologies may affect some functionality. Where required by law, non-essential cookies are enabled only after corresponding consent.

Where applicable law requires recognition of Global Privacy Control or other approved universal opt-out mechanisms, HaiyiMed will process the signal as requested by the signaling browser/device.

13. AI-assisted and automated features

HaiyiMed may use automated tools or AI to assist search, matching, routing, translation, summarization, customer support, content organization, fraud prevention or service improvement. Where necessary, these systems may process information such as treatment intent, destination preferences, communication records or other case information.

• HaiyiMed does not use AI-assisted tools for medical diagnosis or to replace the clinical judgment of licensed healthcare providers.
• HaiyiMed remains responsible for privacy controls over personal information submitted to AI service providers.
• AI vendors processing personal information on our behalf must comply with contractual and security restrictions consistent with the services and applicable laws.
• We do not permit AI vendors to use uploaded medical records or treatment-inquiry content for independent targeted advertising.
• Where applicable law grants rights relating to fully automated decisions with legal or similarly significant effects, HaiyiMed will provide the required information and rights.

14. Email, SMS, WhatsApp, phone and marketing communications

If you provide contact details, we may contact you about your inquiry, provider replies, bookings, account, security, support requests, service updates and other transactional or service matters. Depending on the features you use and your choices, we may communicate by email, phone, SMS, WhatsApp or in-platform messaging.

Where your consent is required for our marketing or messaging channels, we will request it as required. You may unsubscribe from marketing emails via the unsubscribe link and opt out of marketing SMS or message threads per the instructions in the message or applicable messaging terms. Opting out of marketing does not prevent us from sending necessary service, security, legal or account notices.

15. Mobile app information and device permissions

If you use the HaiyiMed mobile app, it may process device information, app usage data, crash/performance data and account or case information. Some optional features may request device permissions, such as:

• Camera or photo library — to upload photos, documents, medical images or scan codes when you choose to use the feature.
• Microphone — for voice, audio or communication features (when you choose to use them).
• Location — to provide location-relevant content or services when you grant location permission.
• Contacts — only for features you actively use to share or invite, subject to applicable permissions and consent requirements.
• Notifications — to send case, message, booking or service updates.

You can manage device permissions through your operating system settings. Denying a permission may limit features that depend on it, but does not affect other unrelated features.

16. Security

We use administrative, technical and physical safeguards designed to protect personal information from unauthorized access, loss, misuse, alteration or disclosure. Depending on systems and risk, safeguards may include SSL 128-bit encryption, firewalls and intrusion detection, transmission encryption, access controls, authentication, logging, network protection, backups, vendor controls, employee training and incident-response procedures. Only authorized employees may access your personally identifiable information, and only for authorized business purposes.

No internet, mobile, storage or transmission system is absolutely secure. We therefore cannot guarantee absolute security. You are responsible for protecting your account credentials, and if you believe your account or information has been compromised, notify us immediately.

17. Security incidents and breach notification

We investigate suspected security incidents and take measures to contain and remediate them. Where an incident triggers legal notification obligations, we notify affected individuals, regulators, providers or other relevant parties as required by applicable law. Depending on the data and our role, this may include state breach laws, the FTC Health Breach Notification Rule, HIPAA breach requirements where applicable, GDPR/UK GDPR or other laws.

18. International data transfers

HaiyiMed connects users with providers and merchants in multiple countries. Your information may therefore be processed in countries whose privacy laws differ from those of your place of residence.

If GDPR, UK GDPR or other laws restrict international data transfers, we will use an applicable lawful transfer mechanism. Depending on the circumstances, this may include adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, other approved contractual mechanisms, exceptions permitted by law, or reliance on the recipient's valid participation in an approved data-transfer framework (where applicable). We may also take supplementary technical, contractual or organizational measures as appropriate.

Cross-border transfer of personal information under the PRC PIPL: As described in this policy's “Special provisions under Chinese law” section, when your personal information (including sensitive personal information such as health information) is transferred outside China, we proceed via one of the pathways under Article 38 of the PIPL — CAC-organized security assessment, personal information protection certification, or standard contract filing — and obtain your separate consent as required by law. Common overseas recipients and their main countries/regions may include: overseas healthcare providers matched or authorized to serve you (their country being where they practice), cloud storage and hosting providers, analytics tool vendors (e.g., Google Analytics, Microsoft Clarity — mainly in the US) and Cloudflare (mainly in the US). The specific transfer methods (including API, SDK or backend direct transfer) and safeguards are subject to the separate notice we provide to you.

19. Data retention

We retain personal information only as long as reasonably necessary for the purposes described in this policy (including providing services, maintaining appropriate case and security records, complying with law, resolving disputes and enforcing agreements). Because different uses vary, we apply category-specific retention standards rather than a single retention period.

Table 6 · Data retention (8 items)

20. Your privacy rights and choices

Depending on where you live and applicable law, you may have some or all of the following rights:

• To know or confirm whether we process your personal information and to receive information about our processing.
• Access the personal information we hold about you.
• Correct inaccurate personal information.
• Delete personal information, subject to legally prescribed exceptions.
• Obtain a portable copy of certain information.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent, without affecting processing carried out before withdrawal.
• Where applicable, you may opt out of sale, sharing, targeted advertising or certain profiling.
• Where applicable, limit certain uses or disclosures of sensitive personal information.
• Exercise rights relating to consumer health data, such as access, deletion, withdrawal of consent or consent before certain collection/sharing (where applicable).
• Where applicable state law provides a right of appeal, decisions on privacy requests may be appealed.
• Receive equal service without unlawful discrimination for exercising privacy rights.
• Lodge complaints with the relevant privacy or data-protection authorities.

21. How to exercise privacy rights

You may submit a privacy request by emailing info@haiyimed.com (ASCII alternative: legal@haiyimed.com) with the subject “Privacy Request”, or through any privacy request mechanism on the HaiyiMed website or app. Please describe the right you wish to exercise and the information or account involved.

Before processing your request, we may need to verify your identity. Verification may involve comparing information we already hold or asking you for other information reasonably necessary to prevent unauthorized disclosure or deletion. We will not request more information than is reasonably needed for verification.

Where applicable law permits an authorized agent to submit requests on your behalf, we may ask you to provide proof of the agent's authorization and may verify your identity directly. If we deny your request and applicable law gives you a right of appeal, you may appeal by replying to our decision or emailing info@haiyimed.com (ASCII alternative: legal@haiyimed.com) with the subject “Privacy Appeal”.

We respond within the timeframes required by applicable law. Some laws allow extensions for complex or multiple requests, in which case we provide the required notice.

22. US state privacy disclosures

Residents of certain US states (including Colorado and California) may have additional rights relating to personal data. Applicable laws may require disclosures of collected categories, purposes, recipients, sensitive information, sale/sharing/targeted advertising, data retention and request methods. The categories and purposes described in this policy are intended as a general disclosure.

If HaiyiMed's use of advertising or analytics technologies constitutes a “sale” or “sharing” under applicable state law, you may use the website's “Privacy Choices/Cookie Preferences” control or other provided opt-out means. Where necessary, we honor recognized Global Privacy Control or other universal opt-out mechanism signals.

If state law requires consent before processing certain sensitive data (including health data or precise geolocation data), HaiyiMed will obtain the required consent before such processing. Where state law grants the right to limit the use of sensitive personal information, HaiyiMed will provide the means to exercise that right.

23. Consumer health data rights

Some US state laws regulate consumer health data that may fall outside HIPAA. Where such laws apply, HaiyiMed will provide all required consumer health privacy notices before collecting or sharing consumer health data and obtain consent where legally required. Applicable rights may include notice, access, deletion, withdrawal of consent and appeal of denied requests.

Consumer health data may be broader than medical records and may include information or inferences related to health status, treatment, reproductive or sexual health, biometric/genetic information, precise location near healthcare services, or other data specified by applicable law.

24. Children and minor patients' information

HaiyiMed's services are intended for adults capable of conducting or managing healthcare and travel consultations. We do not knowingly invite children to create their own HaiyiMed accounts or independently submit personal information in violation of applicable children's privacy laws.

Parents, legal guardians or other legally authorized adults may submit information about a minor patient when seeking medical services for them and where permitted by law. In such cases, the adult represents that they have the necessary authority to provide the information and request services. We provide special protection for users under 14 in accordance with the Personal Information Protection Law. Without parental or guardian consent, we do not collect, store or disclose personal information of minors under 14; if we learn that a minor under 14 has provided information without authorization, we use it only to notify them of the need for parental or guardian consent and take appropriate deletion measures. Those providing information about patients under 14 must obtain parental or guardian consent and cooperate with guardian identity verification. We handle minors' information with particular care and limit its use to what this policy and applicable law permit.

If you believe a child has directly provided personal information to HaiyiMed without legal authorization, contact us at info@haiyimed.com (ASCII alternative: legal@haiyimed.com) so we can review and take appropriate action.

25. Referral and invitation features

If you use a feature to refer or invite others, provide their contact information only with permission. We use it to send, or help you send, the referral. We do not add referred contacts to ongoing marketing campaigns merely because you provided their contact information; any additional marketing permission will be obtained as required by law.

26. Third-party websites, apps and integrations

HaiyiMed may link to healthcare providers, payment services, travel services, social platforms, video services, app stores or other third parties. If you click third-party links or use external integrations, that third party may collect information under its own privacy policy. HaiyiMed is not responsible for the privacy practices of organizations it does not control.

When using APIs or third-party platform services, HaiyiMed may be subject to additional platform terms or policies. For example, using Google or YouTube API services may require compliance with Google's terms and privacy policy. HaiyiMed will comply with all applicable API data-use restrictions, including applicable restricted-use requirements.

27. Corporate transactions

If HaiyiMed participates in a merger, acquisition, financing, restructuring, bankruptcy, asset sale or similar transaction, personal information may be reviewed or transferred as part of that transaction where permitted by law. We will take appropriate confidentiality and privacy safeguards and provide notice where required by applicable law.

28. Changes to this privacy policy

We may update this policy to reflect changes in our services, technologies, data practices, legal requirements or organizational structure. We will post the updated policy and revise the “last updated” date. If changes materially affect how we use sensitive information or your rights, we will provide additional notice or obtain your consent where required by law. A privacy policy is a transparency statement; where law requires consent for specific processing, we will seek that consent separately rather than treating continued use of the website as consent.

29. Questions, complaints and contact information

For any questions, complaints or privacy requests, contact:

• HaiyiMed LLC, Attn: Privacy Department, Block B, Kai'ai Building, Lianhu District, Xi'an, Shaanxi, China
• Email: info@haiyimed.com (ASCII alternative: legal@haiyimed.com)

If the GDPR or UK GDPR applies to you, you also have the right to complain to a data protection authority in your place of residence, work or where you believe an infringement occurred. Residents of US states may also contact their state attorney general or other designated privacy regulator.