English Translation (for reference only). The Chinese version above is the legally binding version. In the event of any inconsistency between the Chinese and English versions, the Chinese version shall prevail.

Compound Personal Information Processing Rules

(i.e., Privacy Policy)

Introduction

These Personal Information Processing Rules (these "Rules" or this "Policy") apply to all scenarios in which you use the Compound website, applications, and mini-programs, and participate in health testing events organized by Compound.

If you have any questions about these Rules, you may contact us using the contact information listed in Article 13 of these Rules.

Article 1 — Persons to Whom These Rules Apply

These Rules apply to:

1. users who register an account through the Compound platform;
2. users who sign up for and participate in health testing events organized by us through the Compound platform;
3. users who browse, make inquiries, or use any service through the Compound platform.

If you are a minor or do not have full capacity for civil conduct, please do not use this service or participate in our events; see Article 11 for details.

Article 2 — Types of Personal Information We Process

Depending on the services you use and the events you participate in, we may process the following types of personal information:

(1) Basic Registration and Contact Information

1. name, gender, date of birth, mobile number, email address;
2. event registration number, order number, and necessary identity-verification information.

(2) Identity Information

If the blood-collection service provider or testing laboratory genuinely requires it for real-name management, sample matching, or report issuance, we may collect your identity document number or document photo. Where not strictly necessary, we will preferentially use methods such as name, contact information, date of birth, gender, and sample number for identity matching, following the principle of minimum necessity.

(3) Health Questionnaire Information

1. height, weight, past medical history, allergy history, medication history, family history;
2. lifestyle habits, exercise status, dietary habits, sleep status;
3. information related to blood-collection contraindications or precautions (such as coagulation status, current fever or infection, pregnancy/lactation, etc.).

(4) Biological-Sample-Related Information and Testing Data

1. the number of the blood sample collected on this occasion, collection time, and collection-site records;
2. testing items, testing results, reference ranges, laboratory reports, and related indicator data;

Compound does not retain the blood sample itself. The sample is handled by the blood-collection service provider and the testing service provider in accordance with their respective standards.

(5) Health Analysis Data Generated by Compound

1. health scores, biological age, risk indications, and lifestyle recommendations generated based on testing data;
2. interpretive reports, trend analysis, goal-setting, and tracking data.

(6) Usage Logs and Technical Information

1. your access, viewing, download, and operation records on the Compound platform;
2. device model, operating system, browser type, IP address, and unique device identifier;
3. information generated by Cookies and similar technologies (see Article 9 of these Rules for details).

(7) Transaction and Payment Information

1. order information, payment status, payment time, and payment channel;
2. invoice application information (if you proactively apply for an invoice).

Among the above, identity document information, medical and health information, biological-sample-related information, and testing data are sensitive personal information as defined in Article 28 of the Personal Information Protection Law. We will obtain your separate consent for processing sensitive personal information and adopt strict protective measures.

Article 3 — Purposes and Means of Processing Personal Information

(1) Completing This Service

1. verifying your identity, completing registration, arranging on-site blood collection, sample matching, laboratory testing, data transmission, report display, and health information analysis;
2. sending you event notifications, reminders, report-generation prompts, and other messages necessary for the service;
3. handling your inquiries, complaints, refund applications, dispute resolution, and other customer service matters.

(2) Security and Quality Control

1. necessary security, quality control, and risk monitoring during and after the event;
2. identifying abnormal behavior, preventing fraud, and protecting account security;
3. compliance record-keeping and log auditing.

(3) Product Research and Improvement

Statistical data that has been anonymized so that it cannot identify a specific individual and cannot be restored may be used for product research, statistical analysis, model improvement, and service quality enhancement. If only de-identification is performed but a specific individual may still be re-identified, we will process it within the scope permitted by law, based on a clear purpose and a necessary scope, and adopt additional security measures; where the use exceeds the scope necessary for this service, we will separately obtain your consent.

(4) Requirements of Laws and Regulations

Processing or provision in accordance with laws and regulations, regulatory requirements, or the lawful requests of judicial or administrative authorities.

Article 4 — Sharing, Entrusted Processing, and External Provision of Personal Information

To complete this service, we may share or entrust the processing of your personal information with the following parties. We will strictly follow the principle of minimum necessity, providing only the minimum information necessary to accomplish the corresponding purpose.

(1) The Personal-Information-Processing Roles of Each Party

1. Compound is the personal information handler of registration information, platform account information, order information, report display data, health analysis data, and platform service data.
2. Beijing Tonghe Clinic (Limited Partnership) ("Tonghe Clinic"), as the blood-collection service provider, may, with respect to information such as pre-collection inquiries, on-site nursing records, blood-collection safety management, blood-collection consumables, and sample-handover records, independently bear the responsibility of a personal information handler, or, within the scope agreed in the cooperation agreement, process the information necessary to complete blood collection as Compound's cooperating service provider.
3. Guangzhou KingMed Medical Laboratory Center Co., Ltd. ("Guangzhou KingMed"), as the testing service provider, may, with respect to information such as sample receipt, testing, laboratory records, testing reports, and quality control, independently bear the responsibility of a personal information handler.
4. Suppliers such as cloud storage, SMS, payment, customer service, electronic signature, logistics, or sample transport typically act as entrusted parties or necessary service providers, processing personal information only within the minimum scope necessary to accomplish the corresponding service.

(2) Scope of Information Shared with the Blood-Collection Service Provider

We may provide Beijing Tonghe Clinic (Limited Partnership) with:

1. name, gender, age/date of birth, mobile number;
2. event session and registration number;
3. necessary identity-verification information;
4. key information from the pre-collection inquiry (such as coagulation status, medication history, allergy history, and other information that may affect the safety of blood collection).

Purpose: to dispatch medical personnel who meet practice requirements, complete on-site identity verification, and conduct pre-collection risk assessment and the blood-collection procedure.

(3) Scope of Information Shared with or Entrusted to the Testing Service Provider

We may provide Guangzhou KingMed Medical Laboratory Center Co., Ltd. with:

1. name, gender, age/date of birth;
2. sample number, collection time, testing items;
3. necessary identity information (for report issuance and sample matching);
4. the blood sample itself (handed over and transported by the blood-collection service provider in accordance with standards).

Purpose: to complete the laboratory testing items agreed for this occasion and to transmit the testing data back to Compound.

(4) Scope of Information Shared with Necessary Service Suppliers

We may provide payment channels, SMS platforms, cloud service providers, electronic signature platforms, customer service systems, and other suppliers with the minimum information necessary to complete their services. We have signed data processing agreements with the above suppliers, requiring them to process personal information in accordance with these Rules and applicable law.

(5) Other Sharing Situations

Except for the situations set out in these Rules, situations to which you separately consent, or as otherwise provided by laws and regulations, we will not provide your personal information to other third parties.

Where permitted by law, we may also disclose relevant information to authorized authorities, and will inform you to the extent permitted by law.

Article 5 — Separate Consent for Sensitive Personal Information

When you check "I agree" to these Rules or the corresponding Informed Consent Form, you are deemed to separately and expressly consent that:

Based on the necessity of this event and subsequent services, Compound, Tonghe Clinic, Guangzhou KingMed, and their respective necessary service suppliers may, within the purposes and scope agreed in these Rules and the corresponding Informed Consent Form, collect, store, use, transmit, provide, and process your sensitive personal information, specifically including:

1. identity document information (such as ID number and document photo);
2. medical and health information (medical history, medication history, allergy history, health questionnaire, etc.);
3. biological-sample-related information (the blood sample and the testing data derived from it).

Processing the above sensitive personal information is necessary to complete this event; if you do not agree, we will be unable to provide this service to you.

Article 6 — Data Retention Period, Location, and Security

(1) Retention Period

1. testing data will, in principle, be retained until deleted or anonymized within 6 months after you proactively deregister your account, except where laws and regulations provide for a mandatory retention period or where dispute resolution or regulatory requirements apply;
2. accounting vouchers and tax-related information will be retained for the retention periods prescribed by the relevant laws;
3. blood samples are handled, retained, or destroyed by the blood-collection service provider and/or Guangzhou KingMed in accordance with medical-testing and sample-management standards; Compound does not retain the blood sample itself;
4. where immediate deletion is not possible due to technical limitations, compliance record-keeping, backup systems, or dispute-handling needs, we will cease all processing other than storage and necessary security protection until deletion or anonymization is possible.

(2) Storage Location and Cross-Border Transfer

Your personal information will be stored within the territory of the People's Republic of China and will, in principle, not be transferred abroad. If, in the future, a cross-border transfer of personal information becomes necessary for business reasons, we will obtain your separate consent and perform the corresponding procedures in accordance with the Personal Information Protection Law and relevant provisions.

(3) Security Measures

We adopt the following measures to protect your personal information:

1. encryption of data in transit and encryption of sensitive information in storage;
2. role-based access control and the principle of least privilege;
3. operation logging and regular auditing;
4. permission isolation and separation of production and development environments;
5. supplier security assessments and contractual constraints;
6. employee confidentiality obligations and regular training.

If a security incident such as a leak, tampering, or loss of personal information occurs or may occur, we will promptly notify you and report to the regulatory authorities in accordance with the law.

Article 7 — Your Rights

In accordance with the Personal Information Protection Law and other relevant laws and regulations, you have the following rights with respect to your personal information:

1. Right to access and copy: you have the right to access and copy the personal information you submitted and the personal information we generated.
2. Right to correct and supplement: if you find that information is inaccurate or incomplete, you may request that we correct or supplement it.
3. Right to delete: under statutory circumstances, you may request that we delete your personal information.
4. Right to withdraw consent: you may withdraw consent previously given to us; withdrawal does not affect the validity of processing activities already carried out based on your consent before withdrawal.
5. Right to deregister your account: you may apply to deregister your Compound account.
6. Right to explanation: you have the right to request that we explain the personal information processing rules.
7. Rights regarding automated decision-making: for automated analysis results such as health scores and risk indications, you have the right to request human review or an explanation.
8. Right to complain and report: you have the right to complain or report to the competent authorities such as cyberspace administration and market regulation authorities.

You may exercise the above rights using the contact information listed in Article 13 of these Rules. We will respond within 15 business days, except as otherwise provided by laws and regulations.

Article 8 — Automated Decision-Making and Algorithm Disclosure

8.1 Based on your testing data, and combining publicly available scientific literature, a health knowledge base, and algorithmic models, the Compound platform outputs health scores, biological age, risk indications, and lifestyle recommendations to you.

8.2 Compound will not make any decision that has a material impact on your personal rights and interests based solely on automated decision-making. The above scores and indications are health information displays only and are not used as a basis for decisions that may have a material impact on you or third parties, such as medical diagnosis, insurance underwriting, employment assessment, or credit assessment.

8.3 You have the right to refuse a decision that has a significant impact on you made by us solely through automated decision-making, and may request that we provide human review or an explanation.

Article 9 — Cookies and Similar Technologies

9.1 The Compound platform may use technologies such as Cookies, local storage, and device identifiers to:

1. recognize your login status and maintain your session;
2. remember your preference settings;
3. analyze platform usage and improve user experience;
4. safeguard platform and account security.

9.2 You may manage or refuse Cookies through your browser settings or device settings; refusal may affect your use of certain functions.

9.3 We will not use Cookies to collect your testing data or sensitive personal information.

Article 10 — Updates to These Rules

10.1 We may revise these Rules in response to changes in laws and regulations, business development, technical upgrades, and the like. Material changes will be notified to you by means such as a prominent announcement on the Compound platform, in-app message, SMS, or email.

10.2 For changes that have a material impact on your rights and interests (such as substantive changes to the processing purpose, the scope of sensitive-personal-information processing, the sharing recipients, or the means of exercising user rights), we will notify you in a more prominent manner and obtain your consent again.

10.3 You may view the latest version and historical versions of these Rules on the Compound platform.

Article 11 — Protection of Minors

The Compound platform and health testing events are intended only for adults who are at least 18 years old and have full capacity for civil conduct. We do not proactively provide services to minors, nor do we proactively collect minors' personal information.

If we discover that we have collected a minor's personal information without the consent of their legal guardian, we will immediately delete the relevant data and take corresponding measures. If you are a legal guardian and discover that a minor has used our services or provided their personal information without your consent, please contact us using the contact information listed in Article 13 of these Rules.

Article 12 — Relationship with Other Documents

These Rules, together with the User Service Agreement and the event-specific Informed Consent Form published or separately signed by Compound at the same time, constitute the complete agreement. In the event of any conflict:

1. personal-information-processing matters are governed by whichever of these Rules and the corresponding Informed Consent Form more fully protects the user's rights and interests;
2. matters concerning the processing of sensitive personal information specific to a particular event are governed by that event's Informed Consent Form;
3. other matters are governed by the User Service Agreement.

Article 13 — Contact Information and Complaint Channels

If you have any questions, comments, suggestions, or complaints regarding the processing of personal information, you may contact us by:

Company name: Shanghai Compound Technology Co., Ltd. (上海康庞得科技有限公司)

Registered address: Building 1, No. 5500 Yuanjiang Road, Minhang District, Shanghai (上海市闵行区元江路5500号第1幢)

Personal information protection officer email: siyu@compoundlife.ai / terry@compoundlife.ai

Customer service email: hello@compoundlife.ai

↑ 返回中文版顶部 · Back to top