Privacy Policy

This Privacy Policy explains how Mycoach Health Limited (“Mycoach Health”, “we”, “us”), a company incorporated in Hong Kong with its principal place of business at Unit 539, Building 19W, Hong Kong Science Park, Hong Kong, collects, uses, discloses and safeguards personal data in connection with this website (mycoach.health, the “Site”) and our clinical platform and product suite, including the Clinical Database, Data Capture Automation, the Patient Agent and the Clinical Research Agent (together with the Site, the “Services”). We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”), including the Data Protection Principles in Schedule 1. This policy also serves as our Personal Information Collection Statement in respect of personal data collected through the Services.

1. Our roles

For personal data of Site visitors, enquirers and platform account holders, Mycoach Health is the data user and determines how that data is used. For clinical and patient data processed within our products, we act on behalf of the hospitals, clinics and institutions that deploy them (each an “Institution”): that data is collected and used under the direction and agreements of the treating Institution, and our processing is governed by written data-processing and clinical-collaboration agreements with it. If you are a patient with questions about clinical data held about you, your treating Institution is the primary point of contact; we will assist it in responding to you.

2. Personal data we collect

(a) Enquiry data — when you submit our contact form or correspond with us: your name, email address, organisation and role, and the contents of your message. Providing it is voluntary, but without it we may be unable to respond. (b) Account data — when an Institution provisions platform access: your name, professional role and affiliation, contact details and sign-in credentials. (c) Clinical and patient data — records, laboratory results, imaging, documents, device readings and follow-up or assessment responses (including those submitted through the Patient Agent), collected under the direction of the treating Institution. (d) Technical and log data — IP address, device and browser type, pages requested, timestamps and platform audit logs, used for security and operations.

3. Purposes of collection and use

We collect and use personal data to: provide, operate, secure and support the Services; respond to enquiries and arrange demonstrations; establish and manage business relationships; and comply with legal and regulatory obligations. Clinical and patient data is used only as instructed by the treating Institution and in accordance with applicable patient consents — for example to structure records, run cohort queries, support follow-up and generate reports. Where data is used for research, it is de-identified or aggregated, and used in accordance with the relevant institutional agreements and ethics approvals. We will not use personal data for a new purpose without prescribed consent unless permitted by the PDPO.

4. Direct marketing

We do not use your personal data in direct marketing without your consent, as required by Part 6A of the PDPO. If you have consented, you may withdraw that consent at any time, free of charge, by emailing info@mycoach.health, and we will cease within the time required by law.

5. Disclosure of personal data

We may disclose personal data to the following classes of transferees, and only for the purposes above: (a) the Institution you are affiliated with or treated by; (b) service providers who support the Services (such as hosting, form-delivery and email providers), bound by contract to protect the data and act only on our instructions; (c) professional advisers (legal, accounting, insurance) where reasonably necessary; (d) courts, law-enforcement bodies and regulators where disclosure is required by law; and (e) an actual or proposed acquirer in connection with a merger, acquisition or reorganisation, under obligations of confidentiality. We do not sell personal data. Clinical and patient data is never disclosed except as provided in the relevant institutional agreement, with applicable consent, or as required by law.

6. Cross-border transfers

Some service providers may store or process data outside Hong Kong. Where they do, we take reasonable steps — including contractual safeguards — to ensure the data receives a level of protection comparable to the PDPO. The hosting location of clinical and patient data is determined by the relevant institutional agreement.

7. Security

We apply technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit, role-based access control, audit logging and vendor due diligence. Our clinical platform is designed and operated to align with HIPAA safeguards in addition to the PDPO. No method of transmission or storage is completely secure; in the event of a data breach creating a real risk of harm, we will notify affected individuals, the relevant Institutions and the Office of the Privacy Commissioner for Personal Data as appropriate.

8. Retention

We retain personal data no longer than is necessary for the purposes for which it was collected. As a guide: enquiry correspondence is kept for up to 24 months after our last interaction unless a business relationship continues; server logs are kept for up to 12 months; account data is kept for the life of the account and a short period thereafter. Clinical and patient data is retained, returned, deleted or anonymised in accordance with the relevant institutional agreement, including on termination.

9. Cookies and local storage

The Site uses only the cookies and local storage necessary to remember your language preference and record your cookie choice. The platform uses session cookies necessary for secure sign-in. We do not use advertising or third-party analytics cookies; if that changes, we will update this policy and seek consent where required.

10. Your rights

Under sections 18 and 22 of the PDPO you may request access to, and correction of, personal data we hold about you; we respond within 40 days as the PDPO requires, and may charge a reasonable fee for access requests as permitted. You may also ask us what kinds of personal data we hold and our policies on handling it, and opt out of direct marketing at any time. For clinical data controlled by your treating Institution, we may refer your request to the Institution and assist it in responding. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk) — though we would appreciate the chance to address your concern first.

11. Minors

The Site is intended for professional and institutional audiences and is not directed at persons under 18. The Patient Agent may process the data of minor patients only as part of clinical care under the direction of the treating Institution and with the consent of a parent or guardian where required.

12. Third-party sites

The Services may link to third-party websites and services, which are governed by their own privacy policies. We are not responsible for their content or practices.

13. Changes to this policy

We may amend this policy from time to time. The date above shows when it was last revised; material changes will be highlighted on this page. Your continued use of the Services after a change takes effect constitutes acceptance of the revised policy.

14. Contact

For any privacy question, request or complaint, email info@mycoach.health or write to: Data Privacy Officer, Mycoach Health Limited, Unit 539, Building 19W, Hong Kong Science Park, Hong Kong. This policy is prepared in English with Chinese translations for convenience; the English version prevails in case of inconsistency.