InnoDrug Group Limited

I Definition and Scope of Collection of Personal Data

1. Definition of Personal Data

Pursuant to the Ordinance, “personal data” means any data relating directly or indirectly to a living individual, from which it is practicable to identify the individual, and which is in a form accessible and processable, including but not limited to your name, contact telephone number, email address, etc.

2. Types of Data Collected

1. Data voluntarily provided through the “Feedback” form: Including your name, contact telephone number, email address, message content, etc., which are used to respond to your inquiries, opinions or suggestions.
2. Data automatically collected during website browsing: Including non-identifiable technical data such as browser type, operating system version, IP address, visited pages and duration of stay. Such data is only used for website operation optimization and traffic statistics, and will not be used alone to identify individuals.
3. Data not collected: The Group will not collect your sensitive personal data, including racial origin, political opinions, religious beliefs, health conditions, criminal records, etc., unless voluntarily provided by you and in compliance with the relevant requirements of the Ordinance.

II Purposes of Collecting Personal Data

The Group collects your personal data solely for the following legitimate purposes and strictly adheres to the principle of “purpose limitation”:

1. To respond to your inquiries, opinions, suggestions or complaints and provide relevant information and assistance;

2. To send you the Group’s business information, technical updates, service notifications and related communications (only upon your explicit consent);

3. To optimize website functions and user experience, and statistics on website access data and usage;

4. To comply with the laws, regulations and regulatory requirements of Hong Kong and fulfill relevant compliance obligations.

III Use, Disclosure and Transfer of Personal Data

1. Limitation on use: The Group will only use your personal data within the scope of the aforementioned collection purposes. Without your prior written consent, it will not be used for other unrelated purposes.

2. Limitation on disclosure: The Group will not sell, lease or provide your personal data to any third party free of charge, except in the following circumstances:

1. With your explicit consent;
2. To disclose to the Group’s authorized service providers (such as IT technical support, customer service outsourcing institutions) for the purpose of fulfilling the obligation to respond to your needs, provided that such providers have committed to complying with the requirements of the Ordinance and strictly keeping the data confidential;
3. Mandatory disclosure required by laws, regulations, court orders or regulatory authorities.

3. Cross-border transfer: If it is necessary to transfer your personal data outside Hong Kong for business purposes, the Group will ensure that such transfer complies with the requirements of the Ordinance and relevant guidelines. It will guarantee that the data receives a level of protection equivalent to that in Hong Kong by signing model contract clauses, etc., and inform you in advance.

IV Retention and Protection of Personal Data

1. Retention Period

The Group will retain your personal data for the shortest period necessary to achieve the collection purposes: data used to respond to inquiries will be retained for 1 year after the completion of the relevant business; data used to send information will be immediately stopped from being used and destroyed upon your withdrawal of consent or request for deletion, unless laws and regulations require an extended retention period.

2. Protection Measures

The Group has adopted reasonable and practicable security measures to protect your personal data from unauthorized access, use, disclosure, modification or destruction, including but not limited to:

1. Encrypting website data and restricting internal personnel’s access rights to data;
2. Regularly conducting training on the Ordinance and privacy protection for employees to enhance compliance awareness;
3. Regularly inspecting and updating data security systems to prevent network security risks.

V Your Rights

Pursuant to the Ordinance, you have the following rights with respect to your provided personal data, and the Group will respond to your reasonable requests free of charge:

1. Right to access and request a copy: You have the right to inquire whether the Group holds your personal data and request a copy of the relevant data;
2. Right to correction: If your personal data is inaccurate or incomplete, you have the right to request the Group to correct it;
3. Right to stop use and deletion: You have the right to request the Group to stop using or delete your personal data (unless required by law to retain it);
4. Right to withdraw consent: If you have previously agreed to receive information from the Group, you may withdraw your consent at any time, and the Group will immediately stop sending such information.

To exercise the above rights, you may contact the Group through the methods specified in the “Contact Us” section of this Statement, and the Group will respond and handle your request within a reasonable time.

VI Cookie Usage Policy

The Group’s website may use Cookie technology to store website browsing preferences, optimize page loading speed and statistics on access data. Cookies will not collect your personally identifiable information.

You may disable Cookies through browser settings, but this may affect the normal use of some website functions. The Group will not use marketing Cookies, which do not require your prior consent and are only stated in this Privacy Policy.

VII Disclaimer and Statement Updates

1. Third-party links: The Group’s website may contain links to third-party websites. The privacy policies of such websites are independent of the Group, and the Group shall not be liable for their privacy protection measures. It is recommended that you carefully read the privacy policies of third parties before accessing them.
2. Statement updates: The Group may revise this Statement from time to time in accordance with changes in laws and regulations, business adjustments or regulatory requirements. The updated version will be posted at the bottom of the website’s homepage and shall take effect on the date of posting. It is recommended that you review this Statement regularly to understand the latest content.

VIII Contact Us

If you have any inquiries or complaints about this Privacy Policy, or need to exercise your rights related to personal data, you may contact the Group through the following methods: