Privacy Policy

1. About this Privacy Policy

XinoVell Group Limited respects your privacy and is committed to handling personal information responsibly, transparently and in accordance with applicable privacy and data protection laws.

This Privacy Policy explains how we collect, use, store, disclose and otherwise handle personal information when you:

• visit the XinoVell website;
• submit an enquiry;
• communicate with our team;
• use our health journey management or service coordination services;
• become part of the XinoVell member programme;
• make a payment to XinoVell; or
• otherwise interact with us.

For the purposes of this Privacy Policy, “XinoVell”, “we”, “us” and “our” mean:

XinoVell Group Limited
Room 1508, 15/F, Office Tower Two, Grand Plaza
625 Nathan Road
Mong Kok, Hong Kong

Privacy enquiries may be sent to: [email protected]

2. What XinoVell Does

XinoVell is an independent health journey management and service coordination platform for overseas Chinese communities and international clients travelling to China.

Depending on the service requested, we may assist with:

• understanding your health journey goals;
• identifying and coordinating relevant medical and health resources;
• health screening arrangements;
• Traditional Chinese Medicine and wellness services;
• longevity and health management services;
• specialist medical care;
• dental care;
• women’s health services;
• appointment coordination;
• bilingual communication and hospital accompaniment;
• transport and accommodation coordination;
• journey planning;
• insurance-related administrative coordination;
• payment of XinoVell service fees; and
• post-return follow-up coordination.

XinoVell is not a medical institution and does not provide medical diagnosis, treatment plans, prescriptions or medical opinions.

Medical assessment, diagnosis, treatment and other clinical decisions are independently provided by appropriately qualified healthcare institutions and professionals.

3. Who May Use Our Services

XinoVell’s services are intended only for persons aged 18 years or over.

We do not accept customers under the age of 18.

By submitting an enquiry or using our services, you confirm that you are at least 18 years old.

4. Personal Information We Collect

The information we collect depends on your interaction with XinoVell and the services you request.

4.1 Identity and contact information

We may collect:

• name;
• email address;
• telephone or messaging contact details where provided;
• country, province/state or city;
• preferred language; and
• other information reasonably necessary to communicate with you.

4.2 Enquiry and service information

We may collect:

• the source through which you found XinoVell;
• your enquiry;
• the type of service you are interested in;
• your general health or journey goals;
• preferred destination or city;
• intended travel period;
• service preferences;
• whether you already hold relevant medical information;
• enquiry status;
• follow-up history; and
• other information you voluntarily provide to us.

4.3 Approximate location and website information

Our systems may record approximate geographic information such as country, province/state or city based on technical information associated with your visit or enquiry.

We may also process limited technical information required for website operation and security, such as:

• IP address;
• browser or device information;
• page request information;
• security signals; and
• information required to distinguish legitimate users from automated traffic.

We do not currently use Google Analytics, Meta Pixel, Google Ads, HubSpot or Mailchimp on the XinoVell website.

4.4 Communications

We retain communications relating to your enquiry or service, including the content of email correspondence between you and XinoVell.

Telephone calls, WhatsApp calls/messages and WeChat communications are not recorded or automatically transcribed by XinoVell.

Where information from those communications needs to be recorded for service administration, an authorised employee may separately record relevant service notes in our internal system.

4.5 Journey and logistics information

Where reasonably required to provide a service, we may hold:

• itinerary details;
• transport information;
• accommodation information;
• booking information;
• identification details required for travel or service arrangements; and
• other logistics-related documents.

Authorised XinoVell employees may upload encrypted travel or logistics files into our internal system, including items such as itineraries or copies of identification documents where reasonably necessary.

Customers do not currently have a self-service file-upload facility.

These internal uploads are not intended to contain medical records.

4.6 Payments

XinoVell charges its own service fees.

Where online payment functionality is available, payments may be processed through Stripe.

XinoVell does not intend to store full payment card numbers. Payment information required to process a transaction may be collected and processed by Stripe in accordance with its own privacy and security practices.

XinoVell does not collect or process medical treatment fees on behalf of hospitals, doctors or other healthcare providers.

Medical fees are paid separately in accordance with the arrangements of the relevant healthcare provider.

5. Medical Records and Health Information

XinoVell deliberately separates ordinary journey coordination information from clinical medical information.

5.1 XinoVell does not maintain a medical record for you

XinoVell does not maintain your medical record and does not ordinarily store:

• complete medical histories;
• diagnostic reports;
• health screening reports;
• diagnostic imaging;
• laboratory results;
• treatment plans;
• prescriptions;
• medical opinions; or
• clinical assessment records.

Our ordinary enquiry forms, CRM systems and email channels are not intended to receive or store these materials.

5.2 Please do not send medical records through ordinary channels

You should not send complete medical records, imaging, laboratory reports or other detailed clinical information through:

• the general XinoVell website enquiry form;
• ordinary email; or
• other general XinoVell communication channels,

unless we specifically provide an approved process for doing so.

5.3 Professional clinical platform

Where your requested service requires clinical information to be reviewed by a healthcare professional, XinoVell may direct you to a designated independent professional clinical platform.

That platform is an independent XinoVell business partner and is responsible for its own handling of the personal and medical information submitted to it.

The platform may, depending on its service:

• receive medical records;
• receive diagnostic imaging or reports;
• organise clinical materials;
• provide professional medical translation;
• facilitate clinical review;
• connect the information with licensed healthcare professionals;
• facilitate remote consultation or follow-up; and
• support other professional clinical workflows.

The platform’s own privacy policy, terms and consent process will apply to information submitted directly to it.

XinoVell does not provide medical assessment or clinical interpretation of information held on that platform.

6. Information XinoVell May Receive from Healthcare or Clinical Partners

In some cases, XinoVell may receive limited administrative information from a healthcare provider or professional clinical platform where necessary to coordinate your journey.

For example, we may receive:

• confirmation that a professional review has been completed;
• appointment availability;
• hospital or doctor details;
• required attendance date;
• service scheduling information;
• estimated duration of attendance; or
• other non-clinical information necessary to arrange your journey.

We do not require copies of the underlying diagnosis, medical report or clinical opinion merely to perform ordinary travel and service coordination.

Where more detailed information must be disclosed to XinoVell for a specific service, this will be handled according to the applicable purpose, consent and privacy requirements.

7. How We Collect Personal Information

We may collect personal information:

7.1 Directly from you

For example when you:

• submit an enquiry;
• communicate with XinoVell;
• request a service;
• provide information to an employee or journey manager;
• make a payment; or
• participate in our member programme.

7.2 Automatically through our website

Certain technical and security information may be collected when you access our website.

7.3 From service providers or partners

Where reasonably required for a service you have requested, we may receive appropriate information from:

• healthcare providers;
• professional clinical platforms;
• transport or accommodation providers;
• Stripe;
• insurers;
• technology providers; or
• other parties involved in providing the requested service.

8. How We Use Personal Information

We may use personal information to:

8.1 Respond to enquiries

Including to:

• identify your request;
• understand which XinoVell service you are interested in;
• communicate with you;
• maintain follow-up history; and
• respond to questions.

8.2 Provide health journey coordination

Including to:

• identify relevant medical or health resources;
• coordinate appointments;
• communicate with providers;
• plan travel;
• arrange transport or accommodation;
• coordinate bilingual support;
• provide hospital accompaniment;
• manage itinerary changes; and
• provide customer support.

8.3 Maintain service history

We may retain information about previous enquiries, services used, communication history, journey preferences and relevant administrative history, so that future interactions with XinoVell can be handled more efficiently.

8.4 Process XinoVell service fees

Including to:

• process payments;
• confirm payment status;
• issue invoices or receipts;
• manage refunds where applicable; and
• maintain accounting records.

8.5 Maintain website and system security

Including to:

• detect automated or abusive traffic;
• prevent spam;
• maintain system integrity;
• protect our infrastructure; and
• investigate suspected misuse.

8.6 Meet legal and operational requirements

Including to:

• comply with applicable laws;
• maintain business and accounting records;
• respond to lawful requests;
• manage disputes or complaints;
• establish or defend legal rights; and
• protect XinoVell, its customers and service providers.

9. CRM and XinoVell Member Records

XinoVell does not currently provide customers with an online account or login portal.

Customers are maintained internally as CRM records.

A customer may be assigned an XinoVell reference or member number for administrative and service purposes. This number:

• does not constitute an online account;
• does not require a password;
• does not provide direct access to XinoVell systems; and
• is not a medical-record number.

Where you participate in the XinoVell member programme, we may retain relevant information about your previous interactions, service preferences and journey history to support future service continuity.

Membership does not mean that XinoVell creates or maintains a clinical medical record about you.

10. When We Share Personal Information

XinoVell does not sell personal information.

We may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy.

10.1 Medical and health service providers

Depending on your requested service, relevant information may be shared with:

• hospitals;
• clinics;
• doctors;
• dentists;
• TCM institutions;
• health screening providers;
• rehabilitation providers; and
• other health or wellness providers.

We aim to disclose only information reasonably necessary for the relevant purpose.

10.2 Independent professional clinical platform

Where clinical information is required, you may be directed to the independent professional clinical platform described above.

XinoVell does not treat that platform as part of its own internal medical-record system.

10.3 Travel and logistics providers

Information may be provided where necessary to:

• transport providers;
• accommodation providers;
• interpreters;
• hospital accompaniment personnel; or
• other suppliers involved in your journey.

10.4 Technology providers

XinoVell uses third-party technology providers to operate its business. These currently include:

Tencent Cloud
Certain XinoVell application and database infrastructure is hosted using Tencent Cloud infrastructure in Hong Kong.

Microsoft 365
XinoVell uses Microsoft 365 for business email and related corporate services. Our Microsoft 365 tenant is registered in Hong Kong. Microsoft may store or process information according to the service configuration and its applicable data-residency and privacy terms.

Postmark
XinoVell uses Postmark to send transactional and system-generated emails. Information required to send those communications may therefore be processed through Postmark’s infrastructure, including infrastructure located in the United States.

Cloudflare Turnstile
XinoVell uses Cloudflare Turnstile to help protect website forms against automated traffic, spam and abuse. Cloudflare may process device, browser and other technical signals for this purpose in accordance with its applicable privacy notice.

Stripe
When XinoVell’s online payment service is enabled, Stripe may process payment and transaction-related information required to collect XinoVell service fees.

10.5 Professional advisers

Information may also be provided where reasonably necessary to lawyers, accountants, auditors, insurers or other professional advisers, subject to appropriate professional or confidentiality obligations.

10.6 Legal disclosures

We may disclose personal information where required or permitted by applicable law, court order, regulatory requirement or lawful governmental request.

11. Cross-Border Data Processing

XinoVell is a Hong Kong company providing cross-border services.

Personal information may therefore be processed in more than one jurisdiction.

Our core XinoVell application infrastructure and database are hosted through Tencent Cloud in Hong Kong.

However, certain service providers may process information outside Hong Kong. For example:

• Postmark may process transactional email information through infrastructure in the United States;
• Microsoft may process Microsoft 365 information in locations applicable to the relevant Microsoft service and tenant configuration;
• Cloudflare operates a global network and may process technical security signals across its infrastructure;
• Stripe may process payment-related information through its international systems; and
• information required for a requested health journey may be provided to healthcare, travel or other service providers in Mainland China.

Where personal information is transferred outside Hong Kong, XinoVell will take reasonable steps appropriate to the circumstances to protect the information and limit its use to the relevant purpose. Where appropriate, this may include:

• contractual protections;
• service-provider data-processing terms;
• access restrictions;
• security requirements;
• limits on onward disclosure; and
• requirements concerning retention or deletion.

Independent healthcare institutions and the independent professional clinical platform may separately process personal information under their own applicable privacy policies and legal responsibilities.

12. Website Security and Cloudflare Turnstile

XinoVell uses Cloudflare Turnstile on website forms to distinguish legitimate users from automated or abusive traffic.

Turnstile may process technical signals associated with your browser, device, network connection or interaction with the website.

This processing is used for website security and abuse prevention rather than advertising or behavioural marketing.

XinoVell does not currently use advertising pixels or behavioural advertising tools such as Meta Pixel or Google Ads tracking on its website.

13. Email Communications and Postmark

XinoVell uses Postmark to send certain transactional and system-generated emails. This may include:

• enquiry confirmations;
• service notifications;
• operational communications;
• journey-related messages; and
• other communications triggered through XinoVell systems.

For an email to be delivered, information such as your email address, message content and technical delivery information may be processed by Postmark.

Postmark’s email infrastructure includes processing in the United States.

Postmark acts as a technology service provider in connection with email delivery and may use subprocessors as described in its applicable contractual and privacy documentation.

14. Microsoft 365 Email

XinoVell uses Microsoft 365 for corporate email and related business communications.

Accordingly, emails you send directly to XinoVell and XinoVell’s responses may be stored and processed through Microsoft 365.

Our Microsoft 365 tenant is registered in Hong Kong.

The precise data location applicable to individual Microsoft 365 services depends on Microsoft’s service configuration and data-residency arrangements.

15. Payments and Stripe

XinoVell charges fees for its own journey management and service coordination services.

When online payment functionality is enabled, XinoVell intends to use Stripe to process those payments.

Stripe may receive information necessary to:

• process payments;
• authenticate transactions;
• prevent fraud;
• handle disputes or refunds; and
• comply with financial and regulatory requirements.

Stripe’s own privacy terms apply to its independent processing activities.

XinoVell does not process medical-provider fees and does not collect money on behalf of hospitals or treating doctors.

16. Marketing

Service and administrative communications are different from marketing communications.

XinoVell may contact you where reasonably necessary to:

• respond to your enquiry;
• coordinate a service;
• provide appointment or travel information;
• manage payment;
• provide follow-up information; or
• otherwise perform a service you requested.

Where XinoVell sends promotional or marketing communications, we will provide an appropriate unsubscribe mechanism and comply with applicable marketing and privacy requirements.

We do not currently use Meta Pixel, Google Ads, Mailchimp or similar third-party advertising or mass-email marketing tools on the website.

17. Data Security

XinoVell uses administrative, organisational and technical measures designed to protect personal information from unauthorised or accidental access, processing, disclosure, alteration, loss, destruction or misuse.

Our current measures include appropriate access restrictions and separation between publicly accessible website services and internal database systems.

XinoVell’s core database is hosted on Tencent Cloud infrastructure in Hong Kong and is not directly exposed through a public database IP.

Access to internal information is limited according to operational requirements.

Travel and logistics documents uploaded to our internal system by authorised employees are stored using protected internal processes.

No method of electronic storage or internet transmission can be guaranteed to be completely secure.

Customers should therefore not send full medical records or unnecessary sensitive identification information through general email or website enquiry forms.

18. Data Retention

XinoVell retains personal information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate legal, accounting, contractual and operational requirements.

Retention periods may differ according to the type of information. For example, we may retain:

• enquiry and communication history for customer service and relationship management;
• journey and service records for service continuity;
• transaction and accounting records for legal and financial compliance;
• logistics documents for the period reasonably necessary to complete and document a service; and
• information required to resolve complaints, disputes or legal matters.

Where information is no longer reasonably required, XinoVell will take appropriate steps to delete, securely dispose of or de-identify it, subject to applicable legal requirements and reasonable backup or system limitations.

Medical records held by an independent healthcare provider or professional clinical platform are subject to that organisation’s own retention requirements.

19. Accuracy of Information

We take reasonable steps to maintain personal information that is accurate and relevant to the purposes for which it is used.

You should inform us if important information changes, particularly contact, journey or booking information relevant to an active service.

You may request correction of personal information held by XinoVell by contacting [email protected].

20. Your Privacy Rights

Depending on the law applicable to you and the relevant processing activity, you may have rights relating to personal information held by XinoVell. These may include rights to:

• request access to personal information held about you;
• request correction of inaccurate information;
• withdraw consent where processing depends on consent;
• object to certain uses;
• unsubscribe from marketing;
• request deletion in circumstances where applicable; and
• raise a privacy complaint.

Some rights are subject to legal limitations or exceptions.

We may request reasonable information to verify your identity before responding to a privacy request.

21. Access and Correction Requests in Hong Kong

Under Hong Kong privacy law, individuals may request access to and correction of personal data held about them, subject to applicable legal requirements and exceptions.

Requests relating to personal information held by XinoVell may be submitted to:

Privacy Contact
XinoVell Group Limited
Room 1508, 15/F, Office Tower Two, Grand Plaza
625 Nathan Road
Mong Kok, Hong Kong
Email: [email protected]

We may request sufficient information to identify the relevant records and verify the identity of the person making the request.

22. Privacy Complaints

If you believe XinoVell has handled your personal information improperly, please contact [email protected].

We will review the matter and respond as appropriate.

If you are not satisfied with our response and Hong Kong privacy law applies to the matter, you may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.

23. Third-Party Privacy Policies

Hospitals, doctors, professional clinical platforms, Stripe, Microsoft, Postmark, Cloudflare and other independent service providers may maintain their own privacy policies and legal responsibilities.

Where you interact directly with an independent third party, its own terms and privacy policy may apply in addition to this Privacy Policy.

XinoVell is not responsible for the privacy practices of an independent third party acting outside XinoVell’s control.

24. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in:

• our services;
• our technology;
• our service providers;
• our business practices;
• applicable law; or
• regulatory guidance.

The current version will be published on the XinoVell website with an updated effective date.

Where required by law or appropriate because of a material change, additional notice may be provided.

25. Contact Us

For privacy enquiries, access or correction requests, or privacy complaints:

XinoVell Group Limited
Room 1508, 15/F, Office Tower Two, Grand Plaza
625 Nathan Road
Mong Kok, Hong Kong
Email: [email protected]