隱私權條款

【BroadMed Technology Co., Ltd. — IQThrill Privacy Policy】

This application, "IQThrill" (hereinafter referred to as the "Application"), is a software service provided by BroadMed Technology Co., Ltd. (hereinafter referred to as the "Company"). By downloading, installing, registering, logging in to, or otherwise using the Application, the user is deemed to have fully read, understood, and agreed to all contents of this Privacy Policy.

The Company collects, processes, and uses personal data in accordance with Taiwan's Personal Data Protection Act ("PDPA") and other applicable laws and regulations.

I. Consent for Sensitive Personal Data Collection

The Company collects medical-related sensitive personal data (including but not limited to vascular access information, physiological parameters, and image data) as necessary for providing the Application's services. Pursuant to Article 6, Paragraph 1, Item 6 of the PDPA, the Company must obtain your written consent.

Upon initial registration, you must check the consent option: "I have read and agreed to this Privacy Policy, and I consent in writing, in accordance with the PDPA, to BroadMed Technology Co., Ltd.'s collection, processing, and use of my medical-related sensitive personal data within the necessary scope of providing the Application's services." This electronic acknowledgment constitutes valid written consent under Taiwan's Electronic Signatures Act, Article 4.

You may withdraw such consent at any time. Upon withdrawal, the Application's relevant functions will become unavailable, but withdrawal does not affect the validity of data already lawfully collected and processed prior to withdrawal.

II. Categories of Personal Data Collected

For the operation of this Application, the Company may collect the following categories of personal data:

(1) Identification Data

Name, date of birth, contact telephone number, email address.
(Note: Government-issued identification number is collected only if you voluntarily provide it; it is not a required field for registration.)

(2) Medical-Related Sensitive Data

Hemodialysis vascular access information, physiological parameter records (including but not limited to blood flow rate, venous pressure, pre/post-dialysis blood pressure, body weight, hemoglobin, hematocrit), access maintenance records, anatomy diagrams or lesion-related images, physician notes, and anesthesia records.

(3) System and Technical Data

Login records, user operation behavior, IP address, device identifiers, operating system version, error logs, and other technical information.

If the user refuses to provide the aforementioned data, part or all functions of the Application may not operate properly.

III. Purposes of Collection, Processing, and Use

The personal data collected shall be used solely for the following purposes:

• To provide, operate, maintain, and improve the Application's functions (dialysis records, trend visualization, cloud backup, etc.)
• To enable data transmission and health information management between the user and the medical professionals designated by the user
• Identity verification, information security maintenance, system monitoring, error tracking, and risk management
• To fulfill obligations required by applicable laws, competent authorities, or judicial proceedings
• Statistical analysis or system optimization within the scope permitted by law, using de-identified or anonymized data only

The Company shall not use personal data for purposes unrelated to the original purpose of collection, nor for marketing or sale.

IV. Duration, Area, Subjects, and Methods of Use

(1) Duration

From the date of your registration until your account deletion or discontinuation of use, subject to the retention periods specified in Section IX, unless retention is required by applicable laws.

(2) Area

Primarily stored on servers located in Taiwan. For cloud backup services, encrypted data may be transmitted to locations of the Company's outsourced cloud service providers.

(3) Subjects

• The user
• Medical institutions or personnel designated by the user within the Application
• Competent authorities with legal investigative authority
• The Company's outsourced data processors (under contractual confidentiality obligations)

(4) Methods

By automated or non-automated means for collection, storage, processing, transmission, analysis, or use.

V. Third-Party Service Providers

To provide the Application's full functionality, the Company uses the following third-party services:

• Cloud Storage: Amazon Web Services / Google Cloud Platform
• Push Notifications: Apple Push Notification Service / Firebase Cloud Messaging
• Customer Service: LINE Official Account
• Application Analytics: [if used, specify the actual analytics tool]

These providers process data according to their respective privacy policies. The Company requires them to use data only within the contractual scope and to maintain confidentiality. For cross-border transfers, the Company ensures the receiving jurisdiction has adequate data protection standards.

VI. Protection and Security Measures

To protect personal data, the Company implements technical and administrative measures compliant with legal requirements, including:

• TLS 1.2 or higher encryption for data transmission
• AES-256 encryption for data at rest
• Access control and account authentication
• Comprehensive operation and access logs
• Regular system backup and recovery mechanisms
• Protection against malicious attacks, regular vulnerability scanning and penetration testing
• Employee data protection training

VII. Data Breach Notification

In accordance with Article 12 of the PDPA, in the event of theft, leakage, alteration, or other infringement of personal data, the Company shall, after ascertaining the facts, notify affected users through email, in-app push notifications, or other appropriate means within a reasonable period, and explain the cause of the incident and the Company's response measures.

VIII. User Rights Under the PDPA

Pursuant to Articles 3, 10, and 11 of the PDPA, you may exercise the following rights regarding your personal data:

• Inquire about or request access
• Request copies
• Request supplementation or correction
• Request cessation of collection, processing, or use
• Request deletion

You may exercise these rights through:

• In-app: Profile > Account Settings
• Email: broadmed.tw@gmail.com
• In-app LINE Customer Service

The Company will respond within 15 days of receiving your request and process it according to law. Extensions of up to 15 additional days may apply, with written notice of the reason for extension.

IX. Data Retention and Account Deletion

• You may submit a deletion request at any time via "Profile > Delete Account" within the Application, or via the customer service email.
• The Company will complete primary database deletion within 30 days of receiving the request; backup system deletion will be completed within 90 days.
• Where retention is required by applicable laws (e.g., medical records retention under the Medical Care Act, tax regulations), the Company will retain necessary data only within the scope of such legal obligations and delete it upon expiration.
• Fully de-identified statistical data does not constitute personal data, and the Company may continue to retain it for research and system optimization purposes.

X. Protection of Minors

• The Application is recommended for use by adults aged 18 or above.
• Minors under 18 wishing to use the Application must have their legal representative (parent or guardian) read, understand, and agree to this Policy, and register and operate the Application on their behalf.
• The Company does not knowingly collect personal data from children under 13 (in compliance with COPPA, if marketed in the United States).

XI. Amendments to This Policy

The Company may revise this Privacy Policy at any time due to operational needs or changes in laws and regulations. Revised contents shall be announced within the Application; significant changes will be additionally notified via push notification or email. Continued use after the effective date of changes constitutes acceptance of the revised Policy.

XII. Contact Information

For any questions regarding this Policy or personal data matters, please contact:

• BroadMed Technology Co., Ltd.
• Data Protection Officer: 宋柏毅 (Po-Yi Sung)
• Customer Service Email: broadmed.tw@gmail.com

XIII. Governing Law and Jurisdiction

This Policy and any disputes arising between you and the Company in connection with the Application shall be governed by the laws of the Republic of China (Taiwan), with the [Company location] District Court as the court of first instance.