Privacy Policy

1. About this Privacy Policy

XinoVell Group Limited respects your privacy and is committed to handling personal information responsibly, transparently and in accordance with applicable privacy and data protection laws.

This Privacy Policy explains how we collect, use, store, disclose and otherwise handle personal information when you:

• visit the XinoVell website;
• submit an inquiry;
• communicate with our team;
• use our health journey management or service coordination services;
• become part of the XinoVell member program;
• make a payment to XinoVell; or
• otherwise interact with us.

For the purposes of this Privacy Policy, “XinoVell”, “we”, “us” and “our” mean:

XinoVell Group Limited
Room 1508, 15/F, Office Tower Two, Grand Plaza
625 Nathan Road
Mong Kok, Hong Kong

Privacy inquiries may be sent to: [email protected]

2. What XinoVell Does

XinoVell is an independent health journey management and service coordination platform for international clients traveling to China.

Depending on the service requested, we may assist with:

• understanding your health journey goals;
• identifying and coordinating relevant medical and health resources;
• health screening arrangements;
• Traditional Chinese Medicine and wellness services;
• longevity and health management services;
• specialist medical care;
• dental care;
• women’s health services;
• appointment coordination;
• bilingual communication and hospital accompaniment;
• transport and accommodation coordination;
• journey planning;
• insurance-related administrative coordination;
• payment of XinoVell service fees; and
• post-return follow-up coordination.

XinoVell is not a medical institution and does not provide medical diagnosis, treatment plans, prescriptions or medical opinions.

Medical assessment, diagnosis, treatment and other clinical decisions are independently provided by appropriately qualified healthcare institutions and professionals.

3. Who May Use Our Services

XinoVell’s services are intended only for persons aged 18 years or over.

We do not accept customers under the age of 18.

By submitting an inquiry or using our services, you confirm that you are at least 18 years old.

4. Personal Information We Collect

The information we collect depends on your interaction with XinoVell and the services you request.

4.1 Identity and contact information

We may collect:

• name;
• email address;
• telephone or messaging contact details where provided;
• country, province/state or city;
• preferred language; and
• other information reasonably necessary to communicate with you.

4.2 Inquiry and service information

We may collect:

• the source through which you found XinoVell;
• your inquiry;
• the type of service you are interested in;
• your general health or journey goals;
• preferred destination or city;
• intended travel period;
• service preferences;
• whether you already hold relevant medical information;
• inquiry status;
• follow-up history; and
• other information you voluntarily provide to us.

4.3 Approximate location and website information

Our systems may record approximate geographic information such as country, province/state or city based on technical information associated with your visit or inquiry.

We may also process limited technical information required for website operation and security, such as:

• IP address;
• browser or device information;
• page request information;
• security signals; and
• information required to distinguish legitimate users from automated traffic.

We use Google Analytics 4 and Cloudflare Web Analytics to understand how visitors find and use the XinoVell website, as described in Section 7.2. We do not currently use Meta Pixel, Google Ads advertising tags, HubSpot or Mailchimp on the XinoVell website.

4.4 Communications

We retain communications relating to your inquiry or service, including the content of email correspondence between you and XinoVell.

Telephone calls, WhatsApp calls/messages and WeChat communications are not recorded or automatically transcribed by XinoVell.

Where information from those communications needs to be recorded for service administration, an authorized employee may separately record relevant service notes in our internal system.

Live chat. You can use the live chat on our website only after submitting our inquiry form, so every chat belongs to an inquiry. The messages you type in the chat are stored in our internal system and are visible only to authorized XinoVell staff.

Live chat messages are encrypted when they are stored in our database, and are deleted automatically 30 days after the last message in the conversation, whether sent by you or by us. Opening the chat or an email link does not restart that period. We keep chats for this long so that you can return to a conversation, including from another device. You can also end a chat and delete its messages yourself at any time using the button in the chat window. Your inquiry, and any email correspondence about it, are kept separately as described in this Privacy Policy. Copies of deleted chat messages may remain in our system backups for a limited period until those backups expire.

If a care coordinator replies and you then leave the chat, we may send an email to the address you gave us in the inquiry form, containing a link that lets you reopen the same chat on any device. The email does not contain the chat messages. Anyone who has that email can open the chat, so please keep it private.

The live chat does not accept file attachments. Please do not send medical records or test results through the chat.

4.5 Journey and logistics information

Where reasonably required to provide a service, we may hold:

• itinerary details;
• transport information;
• accommodation information;
• booking information;
• identification details required for travel or service arrangements; and
• other logistics-related documents.

Authorized XinoVell employees may upload encrypted travel or logistics files into our internal system, including items such as itineraries or copies of identification documents where reasonably necessary.

Customers do not currently have a self-service file-upload facility.

Documents that an authorized employee chooses to share with you may be made available for you to download after you sign in to your XinoVell account (see section 9).

These internal uploads are not intended to contain medical records.

4.6 Payments

XinoVell charges its own service fees.

Where online payment functionality is available, payments may be processed through Stripe.

XinoVell does not intend to store full payment card numbers. Payment information required to process a transaction may be collected and processed by Stripe in accordance with its own privacy and security practices.

XinoVell does not collect or process medical treatment fees on behalf of hospitals, doctors or other healthcare providers.

Medical fees are paid separately in accordance with the arrangements of the relevant healthcare provider.

5. Medical Records and Health Information

XinoVell deliberately separates ordinary journey coordination information from clinical medical information.

5.1 XinoVell does not maintain a medical record for you

XinoVell does not maintain your medical record and does not ordinarily store:

• complete medical histories;
• diagnostic reports;
• health screening reports;
• diagnostic imaging;
• laboratory results;
• treatment plans;
• prescriptions;
• medical opinions; or
• clinical assessment records.

Our ordinary inquiry forms, CRM systems and email channels are not intended to receive or store these materials.

5.2 Please do not send medical records through ordinary channels

You should not send complete medical records, imaging, laboratory reports or other detailed clinical information through:

• the general XinoVell website inquiry form;
• the live chat on our website;
• ordinary email; or
• other general XinoVell communication channels,

unless we specifically provide an approved process for doing so.

5.3 Professional clinical platform

Where your requested service requires clinical information to be reviewed by a healthcare professional, XinoVell may direct you to a designated independent professional clinical platform.

That platform is an independent XinoVell business partner and is responsible for its own handling of the personal and medical information submitted to it.

The platform may, depending on its service:

• receive medical records;
• receive diagnostic imaging or reports;
• organize clinical materials;
• provide professional medical translation;
• facilitate clinical review;
• connect the information with licensed healthcare professionals;
• facilitate remote consultation or follow-up; and
• support other professional clinical workflows.

The platform’s own privacy policy, terms and consent process will apply to information submitted directly to it.

XinoVell does not provide medical assessment or clinical interpretation of information held on that platform.

6. Information XinoVell May Receive from Healthcare or Clinical Partners

In some cases, XinoVell may receive limited administrative information from a healthcare provider or professional clinical platform where necessary to coordinate your journey.

For example, we may receive:

• confirmation that a professional review has been completed;
• appointment availability;
• hospital or doctor details;
• required attendance date;
• service scheduling information;
• estimated duration of attendance; or
• other non-clinical information necessary to arrange your journey.

We do not require copies of the underlying diagnosis, medical report or clinical opinion merely to perform ordinary travel and service coordination.

Where more detailed information must be disclosed to XinoVell for a specific service, this will be handled according to the applicable purpose, consent and privacy requirements.

7. How We Collect Personal Information

We may collect personal information:

7.1 Directly from you

For example when you:

• submit an inquiry;
• communicate with XinoVell;
• request a service;
• provide information to an employee or journey manager;
• make a payment; or
• participate in our member program.

7.2 Automatically through our website

Certain technical and security information may be collected when you access our website.

Analytics. We use Google Analytics 4 (provided by Google) and Cloudflare Web Analytics to understand how visitors find and use our website: for example, which pages are viewed, which country a visit comes from, how the visit began (such as a search engine or a link), what device and browser were used, and whether a visit led to an inquiry. Google Analytics uses cookies and similar identifiers. We have turned off Google signals and advertising features, and we do not send names, email addresses or inquiry content to Google. Cloudflare Web Analytics does not use cookies. Analytics data is kept in aggregated and event form for up to 14 months.

Your choice. If you are in the European Economic Area, the United Kingdom or Switzerland, or we cannot tell where you are, we ask for your permission before loading Google Analytics or Cloudflare Web Analytics. If you choose “Necessary only”, neither runs. In other places they load by default, and you can turn them off at any time. In every case you can review or change your choice at any time using “Cookie settings” at the bottom of each page. If your browser sends a Global Privacy Control signal, we treat it as a request not to load analytics where permission is not otherwise asked. Your choice is stored on your device for up to 12 months. You can also block or delete cookies in your browser settings.

Referral and campaign information. When you arrive through a link that carries a partner referral code or campaign tags (such as “ref” or “utm_” parameters), the website keeps that information in your browser’s local storage for up to 30 days, so that an inquiry you submit can be attributed to the partner or campaign that introduced you.

7.3 From service providers or partners

Where reasonably required for a service you have requested, we may receive appropriate information from:

• healthcare providers;
• professional clinical platforms;
• transport or accommodation providers;
• Stripe;
• insurers;
• technology providers; or
• other parties involved in providing the requested service.

8. How We Use Personal Information

We may use personal information to:

8.1 Respond to inquiries

Including to:

• identify your request;
• understand which XinoVell service you are interested in;
• communicate with you;
• maintain follow-up history; and
• respond to questions.

8.2 Provide health journey coordination

Including to:

• identify relevant medical or health resources;
• coordinate appointments;
• communicate with providers;
• plan travel;
• arrange transport or accommodation;
• coordinate bilingual support;
• provide hospital accompaniment;
• manage itinerary changes; and
• provide customer support.

8.3 Maintain service history

We may retain information about previous inquiries, services used, communication history, journey preferences and relevant administrative history, so that future interactions with XinoVell can be handled more efficiently.

8.4 Process XinoVell service fees

Including to:

• process payments;
• confirm payment status;
• issue invoices or receipts;
• manage refunds where applicable; and
• maintain accounting records.

8.5 Maintain website and system security

Including to:

• detect automated or abusive traffic;
• prevent spam;
• maintain system integrity;
• protect our infrastructure; and
• investigate suspected misuse.

8.6 Meet legal and operational requirements

Including to:

• comply with applicable laws;
• maintain business and accounting records;
• respond to lawful requests;
• manage disputes or complaints;
• establish or defend legal rights; and
• protect XinoVell, its customers and service providers.

9. Customer Accounts, CRM and XinoVell Member Records

XinoVell offers a customer account where you can view your inquiries and services with us. The account does not use a password: to sign in, we send a single-use sign-in link or six-digit code to the email address you have used with us.

Customers are maintained internally as CRM records.

A customer may be assigned an XinoVell reference or member number for administrative and service purposes. This number:

• does not provide direct access to XinoVell systems; and
• is not a medical-record number.

Where you participate in the XinoVell member program, we may retain relevant information about your previous interactions, service preferences and journey history to support future service continuity.

Membership does not mean that XinoVell creates or maintains a clinical medical record about you.

When you are signed in, your account shows the status of your inquiries and services, your payments, invoices and receipts, and documents that XinoVell has chosen to share with you. The account itself holds only your email address(es) and a payment-provider customer reference; it is not a profile of your health information.

For security, sign-in links and codes can be used only once and expire after a short time, and a signed-in session ends after 15 days of inactivity and in any case after 30 days.

10. When We Share Personal Information

XinoVell does not sell personal information.

We may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy.

10.1 Medical and health service providers

Depending on your requested service, relevant information may be shared with:

• hospitals;
• clinics;
• doctors;
• dentists;
• TCM institutions;
• health screening providers;
• rehabilitation providers; and
• other health or wellness providers.

We aim to disclose only information reasonably necessary for the relevant purpose.

10.2 Independent professional clinical platform

Where clinical information is required, you may be directed to the independent professional clinical platform described above.

XinoVell does not treat that platform as part of its own internal medical-record system.

10.3 Travel and logistics providers

Information may be provided where necessary to:

• transport providers;
• accommodation providers;
• interpreters;
• hospital accompaniment personnel; or
• other suppliers involved in your journey.

10.4 Technology providers

XinoVell uses third-party technology providers to operate its business. These currently include:

Tencent Cloud
Certain XinoVell application and database infrastructure is hosted using Tencent Cloud infrastructure in Hong Kong.

Microsoft 365
XinoVell uses Microsoft 365 for business email and related corporate services. Our Microsoft 365 tenant is registered in Hong Kong. Microsoft may store or process information according to the service configuration and its applicable data-residency and privacy terms.

Postmark
XinoVell uses Postmark to send transactional and system-generated emails. Information required to send those communications may therefore be processed through Postmark’s infrastructure, including infrastructure located in the United States.

Cloudflare Turnstile
XinoVell uses Cloudflare Turnstile to help protect website forms against automated traffic, spam and abuse. Cloudflare may process device, browser and other technical signals for this purpose in accordance with its applicable privacy notice.

Cloudflare (website delivery and security)
XinoVell uses Cloudflare to deliver and protect its websites and services, including domain name services, content delivery and handling of encrypted connections. Traffic between your browser and XinoVell’s websites and services, including inquiry submissions and live chat messages, therefore passes through Cloudflare’s network, where Cloudflare processes it on our behalf in accordance with its applicable terms and privacy notice.

Google Analytics
XinoVell uses Google Analytics 4, provided by Google, to measure website traffic as described in Section 7.2. Google may process this information in the United States and other countries in accordance with its applicable terms and privacy policy.

Cloudflare Web Analytics
XinoVell uses Cloudflare Web Analytics to measure website traffic without cookies, as described in Section 7.2. Cloudflare processes this information in accordance with its applicable privacy notice.

Stripe
When XinoVell’s online payment service is enabled, Stripe may process payment and transaction-related information required to collect XinoVell service fees.

10.5 Professional advisers

Information may also be provided where reasonably necessary to lawyers, accountants, auditors, insurers or other professional advisers, subject to appropriate professional or confidentiality obligations.

10.6 Legal disclosures

We may disclose personal information where required or permitted by applicable law, court order, regulatory requirement or lawful governmental request.

11. Cross-Border Data Processing

XinoVell is a Hong Kong company providing cross-border services.

Personal information may therefore be processed in more than one jurisdiction.

Our core XinoVell application infrastructure and database are hosted through Tencent Cloud in Hong Kong.

However, certain service providers may process information outside Hong Kong. For example:

• Postmark may process transactional email information through infrastructure in the United States;
• Microsoft may process Microsoft 365 information in locations applicable to the relevant Microsoft service and tenant configuration;
• Cloudflare operates a global network and may process technical security signals, and the traffic passing between your browser and our services, across its infrastructure;
• Google may process Google Analytics information in the United States and other countries;
• Stripe may process payment-related information through its international systems; and
• information required for a requested health journey may be provided to healthcare, travel or other service providers in Mainland China.

Where personal information is transferred outside Hong Kong, XinoVell will take reasonable steps appropriate to the circumstances to protect the information and limit its use to the relevant purpose. Where appropriate, this may include:

• contractual protections;
• service-provider data-processing terms;
• access restrictions;
• security requirements;
• limits on onward disclosure; and
• requirements concerning retention or deletion.

Independent healthcare institutions and the independent professional clinical platform may separately process personal information under their own applicable privacy policies and legal responsibilities.

12. Website Security and Cloudflare Turnstile

XinoVell uses Cloudflare Turnstile on website forms to distinguish legitimate users from automated or abusive traffic.

Turnstile may process technical signals associated with your browser, device, network connection or interaction with the website.

This processing is used for website security and abuse prevention rather than advertising or behavioral marketing.

XinoVell does not currently use advertising pixels or behavioral advertising tools such as Meta Pixel or Google Ads tracking on its website.

13. Email Communications and Postmark

XinoVell uses Postmark to send certain transactional and system-generated emails. This may include:

• inquiry confirmations;
• service notifications;
• operational communications;
• journey-related messages; and
• other communications triggered through XinoVell systems.

For an email to be delivered, information such as your email address, message content and technical delivery information may be processed by Postmark.

Postmark’s email infrastructure includes processing in the United States.

Postmark acts as a technology service provider in connection with email delivery and may use subprocessors as described in its applicable contractual and privacy documentation.

14. Microsoft 365 Email

XinoVell uses Microsoft 365 for corporate email and related business communications.

Accordingly, emails you send directly to XinoVell and XinoVell’s responses may be stored and processed through Microsoft 365.

Our Microsoft 365 tenant is registered in Hong Kong.

The precise data location applicable to individual Microsoft 365 services depends on Microsoft’s service configuration and data-residency arrangements.

15. Payments and Stripe

XinoVell charges fees for its own journey management and service coordination services.

When online payment functionality is enabled, XinoVell intends to use Stripe to process those payments.

Stripe may receive information necessary to:

• process payments;
• authenticate transactions;
• prevent fraud;
• handle disputes or refunds; and
• comply with financial and regulatory requirements.

Stripe’s own privacy terms apply to its independent processing activities.

XinoVell does not process medical-provider fees and does not collect money on behalf of hospitals or treating doctors.

16. Marketing

Service and administrative communications are different from marketing communications.

XinoVell may contact you where reasonably necessary to:

• respond to your inquiry;
• coordinate a service;
• provide appointment or travel information;
• manage payment;
• provide follow-up information; or
• otherwise perform a service you requested.

Where XinoVell sends promotional or marketing communications, we will provide an appropriate unsubscribe mechanism and comply with applicable marketing and privacy requirements.

We do not currently use Meta Pixel, Google Ads, Mailchimp or similar third-party advertising or mass-email marketing tools on the website.

17. Data Security

XinoVell uses administrative, organisational and technical measures designed to protect personal information from unauthorized or accidental access, processing, disclosure, alteration, loss, destruction or misuse.

Our current measures include appropriate access restrictions and separation between publicly accessible website services and internal database systems.

XinoVell’s core database is hosted on Tencent Cloud infrastructure in Hong Kong and is not directly exposed through a public database IP.

Access to internal information is limited according to operational requirements.

Connections between your browser and XinoVell’s websites and services are protected by HTTPS (TLS encryption).

Live chat messages are encrypted when stored in our database.

The content and subject lines of customer inquiries and of email correspondence with customers, and certain internal staff notes, are encrypted when stored in our database. Backups taken before this protection was introduced may contain unencrypted copies until they expire.

Travel and logistics documents uploaded to our internal system by authorized employees are encrypted when stored.

Access to customer records, documents and live chats by XinoVell staff is recorded in an audit log, and certain sensitive administrative actions require additional verification.

No method of electronic storage or internet transmission can be guaranteed to be completely secure.

Customers should therefore not send full medical records or unnecessary sensitive identification information through general email or website inquiry forms.

18. Data Retention

XinoVell retains personal information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate legal, accounting, contractual and operational requirements.

Retention periods may differ according to the type of information. For example, we may retain:

• inquiry and communication history for customer service and relationship management;
• live chat messages, which are deleted automatically 30 days after the last message in the conversation, or earlier if you end and delete the chat;
• journey and service records for service continuity;
• transaction and accounting records for legal and financial compliance;
• logistics documents for the period reasonably necessary to complete and document a service; and
• information required to resolve complaints, disputes or legal matters.

Where information is no longer reasonably required, XinoVell will take appropriate steps to delete, securely dispose of or de-identify it, subject to applicable legal requirements and reasonable backup or system limitations.

Medical records held by an independent healthcare provider or professional clinical platform are subject to that organization’s own retention requirements.

19. Accuracy of Information

We take reasonable steps to maintain personal information that is accurate and relevant to the purposes for which it is used.

You should inform us if important information changes, particularly contact, journey or booking information relevant to an active service.

You may request correction of personal information held by XinoVell by contacting [email protected].

20. Your Privacy Rights

Depending on the law applicable to you and the relevant processing activity, you may have rights relating to personal information held by XinoVell. These may include rights to:

• request access to personal information held about you;
• request correction of inaccurate information;
• withdraw consent where processing depends on consent;
• object to certain uses;
• request restriction of processing where applicable;
• request a copy of your personal information in a portable format where applicable;
• unsubscribe from marketing;
• request deletion in circumstances where applicable; and
• raise a privacy complaint.

Some rights are subject to legal limitations or exceptions.

You can delete your live chat messages yourself at any time using the button in the chat window.

We may request reasonable information to verify your identity before responding to a privacy request.

21. Access and Correction Requests in Hong Kong

Under Hong Kong privacy law, individuals may request access to and correction of personal data held about them, subject to applicable legal requirements and exceptions.

Requests relating to personal information held by XinoVell may be submitted to:

Privacy Contact
XinoVell Group Limited
Room 1508, 15/F, Office Tower Two, Grand Plaza
625 Nathan Road
Mong Kok, Hong Kong
Email: [email protected]

We may request sufficient information to identify the relevant records and verify the identity of the person making the request.

22. Privacy Complaints

If you believe XinoVell has handled your personal information improperly, please contact [email protected].

We will review the matter and respond as appropriate.

If you are not satisfied with our response and Hong Kong privacy law applies to the matter, you may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.

23. Third-Party Privacy Policies

Hospitals, doctors, professional clinical platforms, Stripe, Microsoft, Postmark, Cloudflare and other independent service providers may maintain their own privacy policies and legal responsibilities.

Where you interact directly with an independent third party, its own terms and privacy policy may apply in addition to this Privacy Policy.

XinoVell is not responsible for the privacy practices of an independent third party acting outside XinoVell’s control.

24. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in:

• our services;
• our technology;
• our service providers;
• our business practices;
• applicable law; or
• regulatory guidance.

The current version will be published on the XinoVell website with an updated effective date.

Where required by law or appropriate because of a material change, additional notice may be provided.

25. Contact Us

For privacy inquiries, access or correction requests, or privacy complaints:

XinoVell Group Limited
Room 1508, 15/F, Office Tower Two, Grand Plaza
625 Nathan Road
Mong Kok, Hong Kong
Email: [email protected]