Privacy Policy

Introduction

ReGrowth Biotech Limited ("ReGrowth," "we," "us," or "our") is committed to protecting your privacy and handling your personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO") and other applicable privacy laws.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at www.regrowthbio.com (the "Website"), use our services, or otherwise interact with us. Please read this Privacy Policy carefully. By accessing or using our Website or services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

Information We Collect

Personal Data You Provide

We collect personal data that you voluntarily provide to us when you:

• Submit enquiry or contact forms
• Request information about our treatments or services
• Subscribe to our newsletter or marketing communications
• Register for webinars, events, or consultations
• Apply for partnership or business development opportunities
• Communicate with us via email, telephone, or other channels

This personal data may include:

• Name and title
• Contact information (email address, telephone number, postal address)
• Company name and position (for business enquiries)
• Country or region of residence
• Medical history or health information (when provided for consultation purposes)
• Communication preferences
• Any other information you choose to provide

Automatically Collected Information

When you visit our Website, we automatically collect certain information about your device and browsing activity, including:

• IP address and geolocation data
• Browser type and version
• Operating system
• Referring website addresses
• Pages viewed and time spent on pages
• Access times and dates
• Device identifiers
• Cookie data and similar tracking technologies

Sensitive Personal Data

In some circumstances, we may collect sensitive personal data such as health information when you provide it for the purpose of treatment consultation or enquiry. We will only collect such data with your explicit consent and will handle it with heightened security measures in accordance with applicable law.

How We Use Your Information

Service Delivery and Communication

• To respond to your enquiries and provide information about our treatments and services
• To schedule and conduct consultations
• To provide customer support and assistance
• To communicate with you about appointments, treatment protocols, or service updates
• To send you requested information about our D.P.G. technology and cellular therapies

Marketing and Business Development

• To send you newsletters, promotional materials, and marketing communications (where you have consented)
• To inform you about new treatments, research developments, and company news
• To conduct market research and analyse customer preferences
• To evaluate and develop partnership opportunities

Website Improvement and Analytics

• To monitor and analyse Website usage and trends
• To improve our Website functionality, content, and user experience
• To diagnose technical problems and maintain security
• To conduct data analytics and business intelligence

Legal and Compliance

• To comply with legal obligations under Hong Kong law and other applicable jurisdictions
• To enforce our Terms of Use and other agreements
• To protect our rights, property, and safety, and those of our users and the public
• To respond to lawful requests from public authorities

Research and Development

• To conduct scientific research and develop improved cellular therapies (using anonymised or aggregated data only)
• To participate in collaborative research with academic and medical institutions

Legal Basis for Processing

Under the PDPO and other applicable privacy laws, we process your personal data on the following legal bases:

• Consent: Where you have provided explicit consent for specific processing activities
• Contractual Necessity: Where processing is necessary to perform our services or respond to your requests
• Legitimate Interests: Where we have legitimate business interests that do not override your privacy rights
• Legal Obligation: Where processing is required to comply with applicable laws and regulations

How We Share Your Information

We do not sell, rent, or trade your personal data. We may share your information in the following circumstances:

Service Providers and Business Partners

We may share your personal data with trusted third-party service providers who assist us in operating our Website, conducting our business, or providing services to you, including:

• IT service providers and hosting companies
• Email marketing platforms
• Customer relationship management systems
• Analytics providers
• Payment processors (for partnership or service transactions)
• Professional advisors (legal, accounting, consulting)

All third-party service providers are required to maintain appropriate security measures and use your personal data only for the purposes we specify.

Business Transfers

In the event of a merger, acquisition, reorganisation, asset sale, or similar corporate transaction, your personal data may be transferred to the acquiring entity or successor organisation. We will notify you of any such change and provide options regarding your personal data.

Legal Requirements

We may disclose your personal data where required or permitted by law, including:

• In response to lawful requests from courts, law enforcement, or regulatory authorities
• To enforce our legal rights or defend against legal claims
• To protect the safety, rights, or property of ReGrowth, our users, or the public
• To investigate fraud, security issues, or violations of our Terms of Use

With Your Consent

We may share your personal data with third parties where you have provided explicit consent for such disclosure.

International Data Transfers

ReGrowth operates globally, and your personal data may be transferred to, stored, or processed in countries outside Hong Kong, including jurisdictions that may not provide the same level of data protection as Hong Kong law.

When we transfer your personal data internationally, we implement appropriate safeguards, including:

• Standard contractual clauses approved by relevant data protection authorities
• Ensuring recipients are located in jurisdictions with adequate data protection laws
• Obtaining your explicit consent where required
• Implementing technical and organisational security measures

By using our Website or services, you acknowledge and consent to the international transfer of your personal data as described in this Privacy Policy.

Cookies and Tracking Technologies

Our Website uses cookies and similar tracking technologies to enhance your browsing experience and collect information about how you use our Website.

Types of Cookies We Use

Essential Cookies: Necessary for Website functionality and cannot be disabled. These enable core features such as security, network management, and accessibility.

Analytics Cookies: Help us understand how visitors interact with our Website by collecting and reporting information anonymously. We use services such as Google Analytics.

Functional Cookies: Enable enhanced functionality and personalisation, such as remembering your preferences and settings.

Marketing Cookies: Track your browsing activity across websites to deliver relevant advertisements and measure campaign effectiveness.

Managing Cookies

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may impact Website functionality and your user experience.

Most browsers allow you to:

• View what cookies are stored and delete them individually
• Block third-party cookies
• Block cookies from specific websites
• Block all cookies
• Delete all cookies when you close your browser

For more information about cookies and how to manage them, visit www.allaboutcookies.org.

Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• Encryption of data in transit and at rest
• Secure server infrastructure with regular security updates
• Access controls and authentication mechanisms
• Regular security assessments and vulnerability testing
• Employee training on data protection and confidentiality
• Incident response and breach notification procedures

However, no method of transmission over the Internet or electronic storage is completely secure. Whilst we strive to protect your personal data, we cannot guarantee absolute security.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Enquiry and Consultation Data: Retained for up to 7 years from last contact to maintain continuity of communication and comply with medical record-keeping requirements
• Marketing Communications: Retained until you unsubscribe or withdraw consent
• Website Analytics Data: Typically retained for 26 months
• Legal and Compliance Records: Retained as required by applicable law, typically up to 7 years

When personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention and disposal procedures.

Your Privacy Rights

Under the PDPO and other applicable privacy laws, you have the following rights regarding your personal data:

Right of Access

You have the right to request access to the personal data we hold about you and obtain a copy of such data.

Right to Correction

You have the right to request correction of inaccurate, incomplete, or outdated personal data.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, subject to legal retention requirements.

Right to Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.

Right to Object

You have the right to object to processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent before withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Privacy Commissioner for Personal Data in Hong Kong or other relevant supervisory authority if you believe your privacy rights have been violated.

Exercising Your Rights

To exercise any of these rights, please contact us using the details provided in the "Contact Us" section below. We will respond to your request within one month, or inform you if we require additional time (up to two additional months for complex requests).

We may request additional information to verify your identity before processing your request. There is no fee for exercising your rights unless your request is manifestly unfounded, excessive, or repetitive.

Third-Party Websites

Our Website may contain links to third-party websites, including social media platforms, research institutions, and partner organisations. This Privacy Policy applies only to our Website and services. We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any third-party websites you visit.

Children's Privacy

Our Website and services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately, and we will take steps to delete such information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated Privacy Policy on our Website with a new "Last Updated" date
• Sending you an email notification (where we have your email address)
• Displaying a prominent notice on our Website

Your continued use of our Website or services after such changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

ReGrowth Biotech Limited
Email: privacy@regrowthbio.com
Website: www.regrowthbio.com

Data Protection Officer
Email: dpo@regrowthbio.com

We will respond to your enquiry within a reasonable timeframe, typically within 30 days.

Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region. Any disputes arising from or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Hong Kong.