Privacy Policy

Updated Date: February 27, 2025

Effective Date: February 27, 2025

Beijing Chuangying Optoelectronic Medical Technology Co., Ltd. (hereinafter referred to as “we/us/our”) fully recognizes the importance of personal privacy to users (“you/users”). When you use our services, we may collect and use your relevant personal information.

This Privacy Policy applies to all services provided by us. When you use any individual service provided by us, you agree to accept the protection of this Privacy Policy and the specific privacy terms issued for such individual service (hereinafter referred to as “Specific Terms”). In such cases, both the Specific Terms and this Policy shall be legally binding on you simultaneously.

For example, users of our online software services shall be subject to both this Privacy Policy and the Privacy Protection and Personal Information Utilization Policy for Network Software Users (Appendix 1); users of our payment services shall be subject to both this Privacy Policy and the Payment Privacy Policy (Appendix 2). If any inconsistency exists between the Specific Terms and this Privacy Policy regarding the same matter, the Specific Terms shall prevail within the scope governed thereby. If any individual service provided by us explicitly excludes the application of this Privacy Policy, such exclusion shall be stated clearly within that service.

We may revise this Policy from time to time, and relevant practices will be adjusted accordingly. We recommend that you regularly review this page to stay informed of the latest version of our Privacy Policy. If you have any questions regarding this Policy or related matters after reading, please contact us via email: gdyl@cftig.com or phone: 400-815-0025.

Your continued use of our services constitutes your consent to our collection, storage, use and sharing of your information in accordance with this Privacy Policy. This Policy will help you understand the following contents:

Table of Contents

1. Information We May Collect

2. How We Collect and Use Information

3. Information We May Share, Transfer and Disclose

4. How We Retain, Store and Protect Information

5. How You May Manage Your Information

6. Your Rights

7. Third-Party Services

8. Age Restriction

9. Notification and Revision

10. How to Contact Us

1. Information We May Collect

1.1 Non-Personal Identifiable Information

During your use of our services, we may collect and aggregate non-identifiable data such as user traffic sources, access sequences, browser types and other anonymous behavioral statistics.

1.2 Personal Identifiable Information

We may collect or request you to provide the following personal identifiable information during your use of our services: personal identification documents (ID card, passport, driver’s license, etc.); date of birth, hometown, gender, hobbies, phone number and facial features; network identification information (system account, IP address, MAC address, email address, passwords and security answers); personal property information (transaction records, account balance, coupons, redemption codes, bank card information); communication records; internet usage logs (browsing records, software usage records, click and operation logs); device information (device model, operating system, device settings, unique device identifiers including IMEI, Android ID, IDFA, OPENUDID, GUID, SIM IMSI); and location information (travel records, precise positioning data, accommodation information, latitude and longitude data).

We collect your information primarily to optimize and improve your service experience and provide safe and reliable internet services for all users. Collected data helps us deliver standardized, secure and user-friendly services.

Please note that any personal information you voluntarily publish in public areas of our platform or disclose in public interactions with other users may be collected and used by third parties. If you discover improper collection or misuse of personal information on our platform, please contact us promptly.

2. How We Collect and Use Information

2.1 Information Collection Channels

(1) Information provided voluntarily by you

Including information submitted during account registration, information shared with third parties via our platform, and data saved during your use of services.

(2) Information shared by third parties

Information about you provided by other users during their use of our services.

(3) Information automatically collected by us

Systematically recorded logs, location data, device information and behavioral data generated during your use of our services.

2.2 Cookies, Log Files and Web Beacons

We and our authorized third-party partners may collect and store user data through Cookies and Web Beacons for log recording and service optimization purposes.

2.3 Purposes of Information Usage

(1) Account Registration

Basic information such as mobile phone number and email address is required for account registration and password creation. Certain basic browsing and search functions are available without registration.

(2) Provision of Products and Services

Collected information is necessary for delivering core services, including but not limited to:

- Delivery information such as recipient name, address, postal code and phone number for order fulfillment;

- Order data display and order management;

- Communication records and contact information for customer support and problem resolution;

- Transaction, payment and logistics information for order status confirmation, after-sales support and dispute resolution.

If you place orders for others through our platform, you must obtain valid authorization from the actual recipient before submitting their personal information.

(3) Message Push and Notification

We may analyze your browsing habits, search preferences, device data, location information and order records to push customized marketing content and service notifications via email, SMS or in-app messages, including our platform services and third-party commercial services.

You may unsubscribe from marketing messages at any time through mobile device settings or SMS unsubscribe instructions, excluding legally required service notifications.

(4) Security Protection and Risk Control

You may submit identity documents and facial biometric data for real-name authentication. We use collected information for identity verification, fraud monitoring, security event detection, data backup, risk assessment and platform security maintenance.

(5) Service Optimization and Upgrade

Data collected from one service module may be used to optimize other services, deliver personalized content, conduct user surveys and support software iteration and updates.

After data desensitization and de-identification, anonymized user data may be used for platform data analysis and commercial optimization without identifying individual users. Any new usage of your personal information beyond the scope specified in this Policy will require your prior consent.

(6) Exceptions to Authorization Consent

We may collect personal information without your authorization under the following circumstances:

- Related to national security and national defense security;

- Related to public safety, public health and major public interests;

- Required for criminal investigation, prosecution, trial and judicial enforcement;

- Necessary to protect major legitimate rights and interests of individuals or third parties where consent cannot be obtained in a timely manner;

- Information voluntarily disclosed to the public by you;

- Information legally disclosed via public channels such as official news releases and government public announcements;

- Necessary for contract performance at your request;

- Necessary to ensure stable and secure platform operation and fault handling;

- Required for legitimate news reporting;

- Academic research based on public interests with de-identified public results;

- Other circumstances stipulated by applicable laws and regulations.

3. Information Sharing, Transfer and Disclosure

3.1 Information Sharing

We will not share your personal information with external third parties without your consent, except in the following cases:

- Necessary for delivering requested services and realizing core functions;

- For platform maintenance, service optimization and targeted service improvement;

- To fulfill obligations and exercise rights under this Policy and user agreements;

- Sharing anonymized statistical data with marketing partners without exposing personal identity;

- Preventing fraud, credit risks and illegal activities within legal scope;

- Assisting in dispute settlement at your legitimate request;

- Providing information at the legal request of your guardians;

- In accordance with signed service agreements and legal documents;

- For legitimate academic research;

- For public interests compliant with laws and regulations.

All third-party partners will sign strict confidentiality agreements and process user data in compliance with legal requirements and this Policy.

3.2 Information Transfer

In the event of corporate merger, acquisition, asset transfer or similar business transactions, your personal information may be transferred as part of business assets. We will require the new entity to continue to comply with this Privacy Policy; otherwise, renewed user authorization will be obtained. We will also transfer your information with your explicit consent.

3.3 Information Disclosure

We will only disclose your personal information under industry-standard security measures in the following circumstances:

- Disclosure explicitly authorized by you;

- Mandatory disclosure required by laws, regulations or judicial/ administrative law enforcement procedures. We will strictly verify legal documents and ensure disclosure complies with legal requirements.

4. Information Retention, Storage and Protection

We retain personal information only for the duration necessary to fulfill the purposes stated in this Policy or as required by applicable laws. All information collected and generated by our domestic operations is stored within the territory of the People’s Republic of China.

4.1 Technical Security Measures

We adopt industry-standard security mechanisms including standardized management systems, SSL encryption, data isolation, data desensitization, access permission control and multi-factor authentication to prevent unauthorized access, modification, leakage, damage or loss of user data.

4.2 Management Security Measures

We implement data classification grading systems, data security management specifications, staff confidentiality agreements, real-time monitoring and audit mechanisms, and regular privacy and security training for employees.

Only authorized personnel and partners with business needs may access user data under strict permission control and confidentiality obligations.

We collect only necessary user information and avoid redundant data acquisition.

Please note that the internet environment is not absolutely secure. We recommend you use complex passwords and properly protect your personal information during online activities.

In the event of security breaches caused by failures in our technical or management protection systems, we will bear corresponding legal liabilities for resulting user rights damages.

4.3 Security Incident Response

We have established complete classification standards and disposal procedures for data leakage, damage and loss, with a dedicated emergency response team to conduct risk control, cause analysis, remedy and traceability handling.

Once a security incident occurs, we will promptly inform users of incident details, impacts, disposal measures, risk prevention suggestions and remedial solutions via email, official announcements or push notifications, and report to competent regulatory authorities as required.

Due to technical limitations and internet environment risks, we cannot guarantee absolute data security for network transmission.

5. How You Manage Your Information

5.1 Access, Update and Deletion

You may access, modify, supplement and delete your personal information independently through platform functions. Identity verification may be required to ensure information security. You may manage Cookie and Web Beacon data through platform settings.

5.2 Public Sharing

Information you publish or share in public platform areas may be permanently cached, stored or reproduced by other users or third parties beyond our control. We are not responsible for information leakage caused by voluntary public sharing by users.

5.3 Account Cancellation

You may cancel your account in accordance with platform service agreements and legal provisions. After account cancellation, all service data under the account will be deleted or processed in accordance with relevant rules.

5.4 Authorization Revocation

You may adjust or revoke your information authorization through device settings or platform functions. Revocation of authorization will disable corresponding service functions but will not affect prior legal data processing based on valid authorization.

5.5 Sensitive Information Reminder

Sensitive personal information including race, religion, health and medical data, biometric information, property information, location tracks and minor information shall be processed strictly in accordance with this Policy. You shall carefully consider before publishing sensitive information on our platform.

6. Your Rights

Subject to legal provisions, you have the following rights to manage your personal information:

6.1 Right to Access Personal Information

You may independently view account information, order records, property data, browsing history and social interaction records via the “Mine - Settings” and “Mine - Orders” platform entries.

6.2 Right to Correct and Supplement Information

You may correct inaccurate personal information independently or submit correction applications to us. We will complete processing within 15 working days.

6.3 Right to Delete Personal Information

You may request deletion of your personal information under the following circumstances:

- You voluntarily cancel your account and stop using our services;

- Our information processing violates legal provisions;

- Information collection and use seriously violates agreed terms without explicit consent;

- We terminate service provision;

- Information processing purposes have been fulfilled or are no longer required.

We will notify relevant third-party data recipients to delete your information upon valid deletion requests, except for legally reserved data. Backup data will be removed during regular backup updates.

6.4 Right to Revoke Authorization

You may revoke non-essential information authorization via device settings or customer service assistance. Authorization revocation will terminate corresponding data processing and service functions without affecting prior lawful processing records.

6.5 Right to Cancel Account

You may submit account cancellation applications via “Mine - Settings - Cancel Account”. After cancellation, we will stop service provision and delete or anonymize your personal information in accordance with laws. Account cancellation means automatic waiver of relevant user rights and benefits.

6.6 Right to Complaint and Feedback

You may submit complaints, suggestions and inquiries through our official contact channels. We will respond within 15 working days after identity verification.

6.7 Right to Obtain and Transfer Data Copies

You may apply for personal information copies and data portability through official contact methods under technically feasible conditions.

6.8 Right to View Privacy Policy

This Policy will be presented to users upon first registration. You may review the full version anytime via “Mine - Settings - Privacy Policy” on our platform.

6.9 Right to Know Service Termination

If platform services are terminated, we will stop collecting user information and issue a 30-day advance termination notice, followed by data deletion or anonymization after service suspension.

6.10 Response to Rights Requests

We will respond to valid user requests within 15 working days after identity verification. Reasonable requests are free of charge; we may charge reasonable costs for excessive repeated requests and reject unreasonable requests that violate rights of others or require excessive technical costs.

7. Third-Party Services

Our platform may contain third-party social media logins, sharing functions, advertisements and external links. Third-party services are independently operated by external providers and governed by their own privacy policies and terms of service.

This Privacy Policy does not apply to third-party services, and we assume no liability for third-party collection and usage of your personal information.

8. Age Restriction

Minors shall use our services only with the consent and guidance of their legal guardians. We strictly protect minor user information in accordance with national laws and encourage guardians to supervise minor online behaviors.

9. Notification and Revision

We may revise this Privacy Policy from time to time. Major revisions will be notified prominently. Your continued use of our services after policy updates constitutes acceptance of the revised terms.

Non-promotional system service notifications cannot be unsubscribed. You shall be solely responsible for the confidentiality of your account and password information.

10. How to Contact Us

For privacy-related complaints, reports, inquiries and suggestions, please contact our Legal Department: Address: Legal Department, No.3 Yuncheng Street, Yizhuang Development Zone, Daxing District, Beijing; Email: gdyl@cftig.com.

Appendix 1: Privacy Protection and Personal Information Utilization Policy for Network Software Users

Formulated in accordance with the Interim Measures for the Administration of Network Software and Mandatory Clauses for Formatted Agreements of Network Software Services, this policy standardizes the protection and utilization of user personal information. By completing registration and using our services, users fully accept all terms of this policy and waive the right of defense for unread content.

We strictly protect user privacy including registered name, ID number, contact information and residential address. We adopt technical and management measures to ensure account security and legally and properly use collected user information.

We may share user registration information with affiliated companies for business needs and shall not disclose personal identity information to external parties except under the following circumstances:

- Authorized by users or their guardians;

- Required by laws and regulations;

- Requested by judicial or administrative authorities via legal procedures;

- Necessary for legal rights protection through litigation or arbitration;

- Requested legally by user guardians.

If any inconsistency exists between this policy, the Account Service Terms and the General Privacy Policy, this Appendix shall prevail for online software service scenarios.

Appendix 2: Payment Privacy Policy

We attach great importance to user privacy protection. This policy specially explains the information collection, usage and protection rules for our payment services. By accepting the Payment Service Agreement, you consent to our collection, storage, use and sharing of your information in accordance with this policy. This policy prevails in case of conflicts with the general group privacy policy.

2.1 Collection of Personal Information

(1) Real-name Authentication and Anti-Money Laundering Management

To complete payment account registration, you must provide your name, nationality, gender, occupation, address, contact information and valid ID information. We will verify relevant information with legitimate institutional channels.

(2) Payment Service Data

Binding bank cards requires card number, cardholder name, ID number and reserved mobile phone number for bank verification. Merchants may view your account name and transaction information during payment processing for transaction confirmation and risk control.

You may voluntarily enable facial recognition and fingerprint verification for secure login and payment confirmation. Fingerprint raw data is only stored on your local device and will not be collected by our system.

We verify your identity information for password recovery and account security purposes.

(3) Complaint Handling

We may submit user identity information and complaint content to consumer protection and regulatory authorities for dispute resolution as legally required.

(4) Anti-Fraud and Risk Control

We record service usage behaviors, IP address, device identifiers, system version, location data and operation logs to identify fraud, phishing and malicious program risks. You may disable location permission without affecting basic payment functions but may reduce risk control accuracy.

(5) Service Notification and Data Archiving

We archive user identity, transaction and behavioral data in compliance with regulatory requirements for transaction inquiry, service notification and compliance supervision.

(6) Device Permission Invocation

Payment services may apply for device permissions including location, device information, phone status, contacts, photos, camera, notification, network, Bluetooth, multimedia and storage to realize functional and security capabilities. You may disable permissions manually, which may affect partial service functions.

(7) Legal Exceptions to Authorization

We may collect information without user consent for national security, public interests, judicial procedures, public disclosed information and platform security maintenance purposes.

2.2 Sharing, Transfer and Disclosure of Personal Information

We only share user information with affiliated companies, technical service providers, financial institutions and cooperative merchants under strict confidentiality agreements and security assessment mechanisms.

Information sharing is limited to service delivery, dispute settlement, promotional activity management, legal compliance, due diligence and authorized third-party inquiry scenarios.

We transfer user information only with explicit user consent or during legal corporate restructuring, merger and acquisition transactions, with mandatory follow-up privacy compliance requirements for new entities.

Information disclosure is only conducted with user consent or mandatory legal law enforcement requirements under standardized verification procedures.

2.3 User Information Management Rights

You may query, manage and unbind payment account information independently. You may adjust device authorization permissions via system settings or customer service channels and apply for account cancellation.

After account cancellation, we stop data collection and usage but retain necessary transaction and identity records per regulatory retention periods.

You may apply for correction or deletion of illegally collected or incorrect personal information through official customer service channels after identity verification.

We may refuse user requests that conflict with national security, public interests, judicial procedures or legitimate rights of third parties, or requests with obvious malicious abuse purposes.

Appendix 3: Third-Party SDK Service Description

To ensure stable operation and functional realization of our products and services, we may access third-party SDKs and conduct strict security evaluation to protect user personal information.

Third-Party Service List:

1. Xiaomi Passport SDK: QQ account login and content sharing | Collects device information

2. Tencent QQ SDK: QQ login and content sharing | Collects device information

3. WeChat Open SDK: WeChat login and content sharing | Collects device information

4. WeChat Payment SDK: In-app WeChat payment function | Collects device information

5. Alipay SDK: In-app Alipay payment function | Collects device, network and location information

6. Xiaomi Push SDK: Message push service | Collects device information

7. Huawei Push SDK: Message push service | Collects device information

8. vivo Push SDK: Message push service | Collects device information

9. OPPO Push SDK: Message push service | Collects device information

10. Jiguang Push SDK: Message push service | Collects device information

11. China Mobile One-Click Login: Mobile number quick login | Collects device information

12. China Unicom One-Click Login: Mobile number quick login | Collects device information

13. China Telecom One-Click Login: Mobile number quick login | Collects device information