IOOELI Privacy Policy
Release Date: July 30, 2024
Effective Date: July 30, 2024
Thank you for trusting and using the IOOELI online platform.Hangzhou ChohoTech Co., Ltd. and its related entities (referred to as “ChohoTech”, “we”, or “us”) specialize in producing and distributing orthodontic devices, leveraging clear aligner technology. We collaborate with medical professionals and clinics to design and provide custom products for patients in the European Economic Area and Swizerland.
ChohoTech fully respects your privacy rights.We hereby develop IOOELI Privacy Notice,which includes how we collects, utilize, disclosure, protect, transmit and store your personal data. This Privacy Notice is intended to inform you about what personal data we will collect, why we collect them, how we utilize and protect them. It’s important to exercise your individual rights and protect your personal data to know the above.
Therefore, please read carefully and understand fully the contents of this privacy Notice, in particular the terms highlighted in bold and black,before visiting and using this website or the products and/or services provided by us.By clicking on the “Confirm” button or checking the “Agree”,you indicate that you fully understand and agree this Privacy Notice. If you have any question, comments or suggestions, please contact us for free and we are very willing to provide you with feasible assistance.
This Privacy Notice applies to these services and products((including but not limited to IOOELI hereinafter the “Service”) provided by ChaohoTech(Registered Address:Room 405, F4, Building 5, No.188 Lianchuang Street, Wuchang Subdistrict, Yuhang District, Hangzhou, Zhejiang, China;Registration number: 91330183MA2GMNXP2D).
Personal Data: any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.Aggregated data is considered non-personal data for the purposes of this Privacy Policy.
Data Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Data Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller.
2.1 Collected personal data as a Data Controller
We, as a Data Controller collect information about you when you provide it to us, when you use our Services, and when other sources provide it to us, as further described below:
Information you provide to us: We collect information about you when you register for an account, create or modify your profile, and use our Services, including:
Identification data: name, username;
Contact details: mobile phone number, email address;
Verification information: your password, verification code;
Orthodontic medical information: your frontal photo, intraoral photo, lateral photo, smiling photo, panoramic radiograph, lateral cephalometric radiograph, CBCT, 3D model, historical case records uploaded by you or your HCP;
Customer support related information: The Services also include our customer support, where you may choose to submit information regarding a problem you are experiencing with a Service.
Subscription Address: When you purchase hardware, you are required to provide a shipping address.
Information we collect automatically when you use the Services: We collect information about you when you use our Services, including browsing our websites and taking certain actions within the Services:
Device and connection information: for example, IP address, device identifier, latitude and longitude, etc.;
Event tracking information: We keep track of certain information about you when you visit and interact with any of our Services. This information includes the features you use; the links you click on; the type, size and filenames of attachments you upload to the Services; search terms; and how you interact with others on the Services.
Cookies and Other Tracking Technologies: We use cookies and other tracking technologies to provide functionality and to recognize you across different Services and devices. For more information, please see our Cookies Policy, which includes information on how to control or opt out of these cookies and tracking technologies.
2.2 Collected personal data as a Data Processor
The HCP is required to collect and process the personal data of the Patients via the Services, including orthodontic medical information. As such, the HCP guarantees that it processes this data in compliance with the rights and obligations of the applicable data protection laws.
It is therefore expressly agreed as part of the processing implemented by the HCP that we will not perform any data processing operation except on the instruction of the HCP and will use all the means in our possession to ensure the security and confidentiality of the personal data entrusted to us.
3.1 Purposes of the processing
Your personal data will be processed by us acting as a Data Controller for the following purposes:
power our services: we collects personal data necessary to power our services, which may include personal data collected to improve our offerings, for internal purposes such as auditing or data analysis, or for troubleshooting.
for our own internal evaluation and business overview purposes strictly limited to necessary extent, including algorithm training；
to market, promote and drive engagement with the Services;
Communicate with you and process Your Transactions:
to manage our contractual relationship with you and process transactions, we must collect data such as your name, payment information and so on.
to handle disputes and/or litigation with us in which you may be involved if applicable;
Security and Fraud Prevention: for safety and security and to detect, prevent, and respond to potential or actual security incidents
Comply with Law: for us to carry out legal obligations pursuant to which we are
obliged to
process your personal data.For example,Certain laws or regulatory obligations require disclosure of
information.
To comply with such laws,we should disclose this information as required.
3.2 How do we collect and process your personal data?
We collect and process your personal data only where we have legal bases for doing so under applicable EU laws.The legal bases depend on the Services you use and how you use them. This means we collect and use your personal data only where:
We need it to provide you the Services, including to operate the Services, provide customer support and personalized features and to protect the safety and security of the Services;
It satisfies a legitimate interest (which is not overridden by your data protection interests), such as for research and development, to market and promote the Services and to protect our legal rights and interests;
You give us consent to do so for a specific purpose, if your personal data is used for purposes other than those stated in this Privacy Policy, or collected for a specific purpose is used for other purposes, your consent will be sought in advance.
We need to process your data to comply with a legal obligation.
4.1 Cookies
To ensure that the Services work properly, we store small data files called cookies on your computer or mobile device, which usually contain an identifier, the name of the site, and some numbers and characters. Cookies allow us to learn about your interests, preferences and usage habits. We do not use cookies for any purpose other than those described in this policy. You can manage or delete cookies according to your preferences, see our Cookies Policy for details. You can clear all cookies stored on your computer and most web browsers have features to block cookies. However, if you do this, you will need to change your user settings yourself each time you visit our products.
4.2 Do Not Tract
Many web browsers have a Do Not Track feature, which allows Do Not Track requests to be sent to websites. At this time, the major Internet standards organizations have not established policies governing how websites should respond to such requests. However, if your browser has Do Not Track enabled, then all of our websites will respect your choice.
5.1 Some or all of your personal data may be disclosed, for the purposes listed above in this Privacy Policy and on a strict need to know basis, to:
Service Providers: we may engage third parties to act as our service providers and perform certain tasks on our behalf, such as storing data, including personal data, in connection with your use of our services.They are obligated to handle personal data consistent with this Privacy Policy and they cannot use the personal data we share for their own purposes.
Related corporate affiliates: we may disclose the personal data we collect within the ChohoTech related companies to provide the Services to you;
Government authorities, law enforcement agencies or other third parties if required by law or reasonably necessary to protect the rights, property and safety of others or of ChohoTech; and
ChohoTech’s successor in title: ChohoTech may share your personal data with any third party that purchases, or to whom ChohoTech transfers, all or substantially all of its assets and business.
Further, we do not sell your personal data and do not share personal data with third parties for their own marketing purposes.
5.2 In order to continuously improve the performance and user experience of our app, we use DCloud to collect and analyze app operation logs (such as application startup data and error logs). DCloud will collect your device's unique identifiers (IMEI/android ID/DEVICE_ID/IDFA, SIM card IMSI information, OAID) to associate with the collected app operation logs. For more details, please visit the "DCloud User Service Terms."
5.3 To provide you with app push notifications, we use the push technology services provided by Daily Interaction Co., Ltd. We may share your device platform, device manufacturer, device brand, device identifiers, MAC address, application list information, network information, and location-related information with Daily Interaction Co., Ltd. to deliver push notification services. When we send you notifications, we may authorize Daily Interaction Co., Ltd. to adjust the link and reactivate the closed SDK push processes to ensure you receive our notifications in a timely manner. For more detailed information, please visit the "GeTui User Privacy Policy." The SDK name for the push service (GeTui UniPush) module is GeTui Message Push (com.igexin), and we may collect device-related information such as your BSSID and SSID.
6.1 Security of your personal data
ChohoTech is committed to taking appropriate measures to protect the confidentiality of your personal data. We will employ suitable technical and organizational security measures to safeguard your personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.For example:
Pseudonymization: After collecting the personal information you provide, we will pseudonymize the personal information by technical means, and the pseudonymized personal information will not be able to identify the subject without the help of additional information.
Access control: Any personal data collected by us is kept in restricted access servers, available only to authorised staff through adequate IT security measures.
Information security protection: We implement the latest information security management measures to protect patients' personal data and conduct regular penetration tests to detect any vulnerabilities.
6.2 retention of your personal data
Retention period.Once your personal data is no longer necessary for the purposes outlined in this Privacy Notice, ChohoTech will either delete or anonymize it. We may retain your personal data for different periods subject to specific products and scenarios. For example, the retention of your personal data is linked to the duration of the treatment and involves your use of our Services. However, ChohoTech may retain some of your personal data to fulfill legal and regulatory requirements and to respond to inquiries from regulatory bodies or other relevant authorities.
Additionally, ChohoTech may retain certain personal data to establish, exercise, or defend its legal rights and claims, or for other valid business purposes.
Storage location.In principle, we store your personal data within Singapore. However, as we globally operate our business, your personal data related to your account may be processed or transferred outside the Singapore, including to China when you access or use our Services for providing necessary account management to you. Such countries or jurisdictions may have data protection laws that are less protective than the laws of the jurisdiction in which you reside. We transfer the personal data pursuant to Article 49 (1) (b) of the GDPR to provide our Services pursuant to our Terms of Use. Please immediately stop accessing or using the Services if you do not want your personal data transferred to, processed, or maintained outside of the country or jurisdiction where you are located.
ChohoTech outlines your rights concerning your personal data below. If you have queries or wish to exercise any of these rights, please reach out to us using the contact information in Section X of this privacy notice:
Access. You are entitled to information about the personal data we hold on you, how we process it, and to receive a copy of this data.
Rectification. You have the right to have us correct any inaccurate personal data about you and, considering the processing purpose, to complete any incomplete personal data.
Erasure. You can request the deletion of your personal data in certain situations. We may continue to retain your personal data if we are legally obliged or permitted to do so.
Restriction of processing. You can ask us to limit the processing of your personal data under specific conditions. However, we might be legally allowed to continue using your personal data or to deny your request.
Data Portability. You can request to receive your personal data in a structured, commonly used, and machine-readable format or, if technically feasible, have it directly transmitted to a third party. This applies if our use of your data is based on your consent or a contract and the processing is automated.
Object. If we use your personal data based on our legitimate interests, you have the right to object to this usage. There might be cases where we are justified in continuing to process your personal data or in rejecting your objection.
Withdrawal of consent. If our processing relies on your consent, you have the right to withdraw this consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal.
Automated decision-making. You have the right not to be subject to solely automated decision-making in cases where it does not meet legal standards. We do not engage in any automated decision-making processes.
Complaints. We are dedicated to resolving any privacy concerns amicably. However, if you are unsatisfied with our handling of your personal data, you have the right to lodge a complaint with your local data protection authority.
If you are under the age of 16, you may not have an IOOELI account or use IOOELI service. We do not knowingly process any personal data from, or direct IOOELI service to, children under the age of 16. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such data.
IOOELI Privacy Notice may change from time to time. ChohoTech will update this Privacy Notice to reflect changes in the processing of your personal data wherever necessary. We encourage you to review our Privacy Notice whenever you use the Services to stay informed about our data protection practices and the ways you can help protect your privacy.
If you disagree with any changes to this Privacy Notice, you will need to stop using the Services and deactivate your account(s), as outlined above.
If you have any questions or concerns about our Privacy Policy or how we use your personal data, please get in touch with us. You can contact us at iooelisupport@chohotech.com.
We takes your privacy questions seriously.In most cases, all substantive contacts receive a response within 15 workdays. In other cases, we may require additional information or let you know that we need more time to respond.