PRIVACY POLICY

Effective Date: January 1, 2025

Last Updated: November 26, 2025

---

## 1. INTRODUCTION

ATOS Wellness Pte. Ltd. ("ATOS," "we," "us," or "our") is committed to protecting your privacy and handling your personal data with transparency, care, and in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA") and other applicable data protection laws.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you:

- Visit our websites (atoswellness.com.sg and related domains)

- Use our services at our wellness centers

- Book appointments through any channel (phone, WhatsApp, website, walk-in)

- Participate in our wellness programs

- Join our membership programs

- Purchase our products

- Communicate with us through any medium

By using our services or providing us with your personal information, you consent to the collection, use, disclosure, and processing of your personal data as described in this Privacy Policy.

---

## 2. INFORMATION WE COLLECT

### 2.1 Personal Information

We collect personal information that you voluntarily provide to us, including:

Identification Information:

- Full name

- NRIC/Passport/FIN number

- Date of birth

- Gender

- Nationality/Residency status

- Identification documents (copies)

Contact Information:

- Mobile phone number

- Email address

- Home/mailing address

- Preferred contact method (phone, WhatsApp, SMS, email)

- Preferred contact time

Health & Wellness Information:

- Medical history and health conditions

- Current medications and supplements

- Allergies and sensitivities

- Pregnancy status

- Previous injuries or surgeries

- Current health concerns and wellness goals

- Family medical history (where relevant)

- Physical assessment data

- Wellness screening results

- Treatment response and progress notes

- Bio-resonance scan data

- Skin analysis results

- Body measurements and composition data

Service & Treatment Information:

- Treatment history and preferences

- Preferred therapists

- Pressure preferences (light, medium, firm)

- Aroma preferences

- Service feedback and reviews

- Appointment history

- Products purchased

- Package and membership details

Financial Information:

- Payment method details

- Credit/debit card information (processed securely through third-party payment processors)

- Billing address

- Purchase history and transaction records

Marketing & Communication Preferences:

- Subscription to newsletters

- Communication preferences

- Marketing consent status

- Survey responses

- Feedback and testimonials

### 2.2 Automatically Collected Information

Website Usage Information:

When you visit our website, we automatically collect:

- IP address and device information

- Browser type and version

- Operating system

- Pages visited and time spent

- Referral source (how you found us)

- Cookies and similar tracking technologies (see Section 5)

- Geographic location (general)

Communication Records:

- Call recordings (for quality assurance and training purposes, with notice)

- Chat transcripts

- Email correspondence

- WhatsApp message history

- Social media interactions

### 2.3 Information from Third Parties

We may receive information about you from:

- Corporate wellness program partners

- Partnership programs (HomeTeamNS, NTU Alumni, etc.)

- Insurance companies (if applicable)

- Family members or friends who book on your behalf

- Medical professionals (with your consent)

- Public databases and social media platforms

---

## 3. HOW WE USE YOUR INFORMATION

We use your personal information for the following purposes:

3.1 Service Delivery & Treatment

- Providing Wellness Services: Delivering spa, facial, body, wellness, and hair treatments

- Personalized Care: Customizing treatments based on your health profile, preferences, and goals

- Wellness Profiling: Conducting comprehensive wellness assessments and screenings

- Treatment Planning: Developing personalized treatment and wellness programs

- Progress Tracking: Monitoring your wellness journey and treatment outcomes

- Safety & Risk Management: Ensuring treatments are safe and appropriate for your health conditions

- Quality Assurance: Maintaining service quality standards

### 3.2 Booking & Administration

- Appointment Management: Scheduling, confirming, and managing your appointments

- Reminders: Sending appointment reminders via WhatsApp, SMS, or email

- Customer Support: Responding to inquiries, requests, and complaints

- Record Keeping: Maintaining accurate treatment and service records

- Membership Management: Administering membership programs and loyalty benefits

3.3 Payment & Financial

- Payment Processing: Processing payments for services and products

- Invoicing & Receipts: Generating invoices and receipts

- Package Management: Tracking package credits and validity

- Refund Processing: Handling refunds and adjustments (where applicable)

- Credit Control: Managing outstanding payments

### 3.4 Marketing & Communications

- Marketing Materials: Sending promotional offers, newsletters, and wellness tips (with your consent)

- Product Launches: Informing you about new services and products

- Special Offers: Providing exclusive deals and trial packages

- Events & Campaigns: Inviting you to wellness events and campaigns

- Referral Programs: Managing referral rewards and incentives

- Surveys & Feedback: Collecting feedback to improve our services

3.5 Legal & Compliance

- Legal Obligations: Complying with Singapore laws and regulations

- Health & Safety: Meeting health and safety requirements

- Dispute Resolution: Handling complaints, disputes, and legal claims

- Regulatory Requirements: Fulfilling licensing and regulatory obligations

- Insurance Claims: Processing insurance-related matters (if applicable)

3.6 Business Operations & Improvement

- Analytics: Understanding customer preferences and service usage patterns

- Business Intelligence: Improving operational efficiency and service quality

- Research & Development: Developing new treatments and wellness programs

- Staff Training: Training therapists and staff for better service delivery

- Facility Management: Optimizing facility operations and capacity planning

---

## 4. LEGAL BASIS FOR PROCESSING (PDPA COMPLIANCE)

Under Singapore's PDPA, we process your personal data based on:

Consent: You have explicitly consented to our collection, use, and disclosure of your personal data for specified purposes.

Contractual Necessity: Processing is necessary to fulfill our service agreement with you (e.g., delivering treatments you've booked).

Legitimate Interests: Processing is necessary for our legitimate business interests (e.g., improving services, preventing fraud) while respecting your privacy rights.

Legal Obligations: Processing is required by Singapore law or regulations (e.g., health and safety compliance, tax obligations).

You have the right to withdraw consent at any time by contacting us (see Section 13). However, withdrawal may affect our ability to provide certain services.

---

## 5. COOKIES & TRACKING TECHNOLOGIES

### 5.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us recognize you and enhance your browsing experience.

### 5.2 Types of Cookies We Use

Essential Cookies:

- Required for website functionality

- Enable core features like booking and payment

- Cannot be disabled without affecting site functionality

Performance Cookies:

- Help us understand how visitors use our website

- Collect anonymous usage statistics

- Used to improve website performance

Functional Cookies:

- Remember your preferences and settings

- Enable personalized features

- Enhance user experience

Marketing/Targeting Cookies:

- Track your browsing behavior for advertising purposes

- Deliver relevant advertisements

- Measure advertising campaign effectiveness

- Used with your consent

### 5.3 Third-Party Cookies

Our website may use third-party cookies from:

- Google Analytics: For website analytics

- Facebook Pixel: For social media advertising

- Google Ads: For search and display advertising

- Payment Gateways: For secure payment processing

### 5.4 Managing Cookies

You can control cookies through your browser settings:

- Block all cookies

- Delete existing cookies

- Allow cookies from specific websites

- Set preferences for third-party cookies

Note: Disabling cookies may limit website functionality and affect your user experience.

### 5.5 Do Not Track Signals

Our website does not currently respond to "Do Not Track" browser signals, but you can manage cookies as described above.

---

## 6. DATA SHARING & DISCLOSURE

We respect your privacy and do not sell your personal information. However, we may share your data with:

### 6.1 Service Providers & Business Partners

We share information with trusted third parties who assist in our operations:

Technology Providers:

- Website hosting and maintenance providers

- Cloud storage services (secure, encrypted)

- Customer relationship management (CRM) platforms

- Booking and scheduling software

- Email and SMS service providers

Payment Processors:

- Credit card payment gateways

- PayNow/PayLah platforms

- Bank partners

Marketing Platforms:

- Email marketing services

- Social media advertising platforms

- Google/Facebook advertising services

- WhatsApp Business API providers

Professional Services:

- Legal advisors and accountants

- Insurance providers

- Healthcare professionals (with your consent)

- Corporate wellness program partners

All third-party service providers are contractually obligated to:

- Use your data only for specified purposes

- Implement appropriate security measures

- Comply with PDPA and data protection laws

- Not disclose your information without authorization

### 6.2 Corporate Transactions

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. You will be notified of any such change.

### 6.3 Legal Requirements & Protection

We may disclose your information when required by law or to:

- Comply with court orders, subpoenas, or legal processes

- Enforce our terms and conditions

- Protect our rights, property, or safety

- Protect the rights, safety, or property of our clients or the public

- Prevent fraud, illegal activities, or security threats

- Respond to government or regulatory requests

### 6.4 With Your Consent

We may share your information with other parties when you specifically authorize us to do so, such as:

- Medical professionals you're consulting

- Family members or friends (for gift vouchers or shared treatments)

- Corporate HR departments (for corporate wellness programs)

---

## 7. INTERNATIONAL DATA TRANSFERS

While ATOS Wellness primarily operates in Singapore, some of our service providers may store or process data outside Singapore (e.g., cloud storage providers with international servers).

When we transfer data internationally, we ensure:

- The recipient country has adequate data protection laws, OR

- Appropriate contractual safeguards are in place (e.g., Standard Contractual Clauses), AND

- Your data receives protection equivalent to PDPA standards

You have the right to request information about international transfers and the safeguards in place.

---

## 8. DATA SECURITY

We implement comprehensive security measures to protect your personal information:

### 8.1 Technical Security Measures

- Encryption: Data encrypted in transit (SSL/TLS) and at rest

- Secure Servers: Access-controlled, monitored servers

- Firewalls: Network security and intrusion detection systems

- Regular Security Audits: Vulnerability assessments and penetration testing

- Secure Payment Processing: PCI-DSS compliant payment gateways

### 8.2 Organizational Security Measures

- Access Controls: Role-based access to personal information

- Staff Training: Regular data protection and confidentiality training

- Confidentiality Agreements: All staff sign non-disclosure agreements

- Limited Access: Only authorized personnel access personal data

- Secure Facilities: Physical security at all wellness centers

- Document Security: Secure storage and disposal of physical records

### 8.3 Data Breach Response

In the unlikely event of a data breach:

- We will assess the severity and impact

- Notify affected individuals promptly (as required by law)

- Report to the Personal Data Protection Commission (PDPC) if necessary

- Take immediate remedial action to prevent further breaches

- Conduct thorough investigation and implement preventive measures

While we use industry-standard security measures, no system is 100% secure. You should also protect your account credentials and notify us immediately of any unauthorized access.

---

## 9. DATA RETENTION

### 9.1 Retention Periods

We retain your personal information only as long as necessary for the purposes outlined in this policy:

Active Client Records:

- Treatment and health records: 7 years from last treatment (industry standard and potential legal claims)

- Booking and service history: 7 years

- Financial records: 7 years (tax and accounting requirements)

- Marketing consent records: Until consent is withdrawn + 1 year

Inactive Clients:

- After 3 years of inactivity, we will contact you to confirm if you wish to remain in our database

- If no response, records will be anonymized or deleted after 5 years of inactivity

- Exception: Essential records retained for 7 years for legal compliance

Membership Records:

- Duration of membership + 7 years

Marketing Lists:

- Until you unsubscribe or withdraw consent

- Unsubscribe records retained to honor opt-out preferences

### 9.2 Secure Deletion

When data is no longer needed:

- Electronic records are securely deleted using data erasure software

- Physical records are shredded or disposed of securely

- Backups are purged according to retention schedules

---

## 10. YOUR RIGHTS UNDER PDPA

Under Singapore's PDPA, you have the following rights:

### 10.1 Right to Access

You can request:

- Confirmation of whether we hold your personal data

- Access to your personal data

- Information about how we use and disclose your data

- Response time: Within 30 days of request

### 10.2 Right to Correction

You can request correction of inaccurate or incomplete personal data.

- How to request: Contact us with details of corrections needed

- Response time: We will correct verified inaccuracies within 30 days

### 10.3 Right to Withdraw Consent

You can withdraw consent for:

- Marketing communications

- Non-essential data processing

- Note: Withdrawal may affect service delivery for consent-dependent processing

### 10.4 Right to Data Portability

You can request your personal data in a commonly used, machine-readable format for transfer to another service provider.

### 10.5 Right to Deletion

You can request deletion of your personal data, subject to:

- Legal retention requirements (e.g., 7-year record retention)

- Ongoing contractual obligations

- Legitimate business needs

### 10.6 How to Exercise Your Rights

To exercise any of these rights:

1. Submit a written request via email: [email protected]

2. Include your full name, contact information, and NRIC (for verification)

3. Specify which right(s) you wish to exercise

4. Provide details of your request

We will respond within 30 days and may request additional information for verification purposes.

Note: We may charge a reasonable administrative fee for repeated or excessive requests, or deny requests that are manifestly unfounded or excessive.

---

## 11. MARKETING COMMUNICATIONS & OPT-OUT

### 11.1 Marketing Consent

We will only send you marketing communications if you have:

- Explicitly opted in during booking or registration, OR

- Provided consent through our website, OR

- Existing customer relationship (with opt-out option)

Marketing communications include:

- Promotional emails and newsletters

- WhatsApp messages about special offers

- SMS notifications about campaigns

- Direct mail (rare)

- Social media advertising (through platforms you use)

### 11.2 How to Opt-Out (Unsubscribe)

You can stop marketing communications anytime by:

Email:

- Click "Unsubscribe" link at the bottom of any marketing email

- Email us: [email protected] with "Unsubscribe" in subject line

WhatsApp:

- Reply "STOP" to any marketing message

- Block our business number (though this prevents all communications)

SMS:

- Reply "STOP" to any marketing SMS

Phone:

- Call us at 6265-9660 and request removal from marketing lists

In Person:

- Inform any staff member during your visit

Processing Time: Opt-out requests are processed within 10 business days. You may receive already-scheduled communications during this period.

### 11.3 Transactional Communications

Please note: You cannot opt out of essential service communications, including:

- Booking confirmations and reminders

- Treatment-related information

- Important account updates

- Legal or regulatory notices

- Service changes or disruptions

These are necessary for service delivery and your safety.

---

## 12. CHILDREN'S PRIVACY

ATOS Wellness services are designed for individuals 18 years and above. Limited services are available for minors aged 14-17 with adult accompaniment.

We do not knowingly collect personal information from children under 14 without parental consent.

If you are a parent or guardian and believe your child under 14 has provided us with personal information, please contact us immediately at [email protected], and we will delete the information.

For minors aged 14-17:

- Parental/guardian consent is required for service bookings

- Parent/guardian must accompany the minor for treatments

- We may request verification of parental/guardian identity

---

## 13. THIRD-PARTY WEBSITES & LINKS

Our website may contain links to third-party websites, including:

- Social media platforms (Facebook, Instagram, TikTok, LinkedIn, YouTube)

- Partnership programs (HomeTeamNS, NTU Alumni)

- Payment gateways

- Online review platforms

We are not responsible for:

- Privacy practices of third-party websites

- Content on external websites

- Data collection by third parties

We encourage you to review the privacy policies of any third-party websites you visit. Clicking external links means leaving our website and being subject to the third party's policies.

---

## 14. UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect:

- Changes in our business practices

- New legal or regulatory requirements

- Feedback from customers or regulators

- Technological advancements

When we make material changes:

- The "Last Updated" date at the top will be revised

- We will notify you via email or prominent website notice

- For significant changes, we may request renewed consent

Your continued use of our services after changes constitutes acceptance of the updated Privacy Policy.

We encourage you to review this policy periodically. The current version is always available at: www.atoswellness.com.sg/privacy-policy

---

## 15. CONTACT & COMPLAINTS

### 15.1 Data Protection Officer

For privacy-related inquiries, concerns, or to exercise your rights:

ATOS Wellness Data Protection Officer

Email: [email protected]

Phone: 6265-9660

Address: 70 Ubi Crescent, #01-04, Singapore 408570

Operating Hours: Monday–Friday, 9:00 AM – 6:00 PM

### 15.2 Complaints Process

If you believe we have not handled your personal data appropriately:

Step 1: Contact our Data Protection Officer (details above)

- Provide details of your concern

- We will investigate and respond within 30 days

Step 2: If not satisfied with our response, contact:

Personal Data Protection Commission (PDPC)

Website: www.pdpc.gov.sg

Email: [email protected]

Phone: 1800-275-7372

We take privacy concerns seriously and will work with you to resolve any issues promptly and fairly.

---

## 16. SPECIFIC PRIVACY NOTICES

### 16.1 Health Data Privacy

Your health and wellness information is sensitive personal data under PDPA. We apply heightened protection:

- Strict access controls (only treating therapists and necessary staff)

- Enhanced security measures (encrypted storage)

- Confidential handling and storage

- No disclosure without explicit consent (except legal requirements)

We will NEVER:

- Share your health information with marketers

- Disclose your treatments publicly without consent

- Use health data for purposes unrelated to your care

### 16.2 Corporate Wellness Programs

If you access our services through a corporate wellness program:

- Your employer receives aggregate, anonymized usage data only

- Individual treatment details remain confidential

- Your employer will know you attended but NOT what treatments you received

- You can opt out of data sharing with your employer (may affect eligibility)

### 16.3 Photography & Media Release

If we photograph or video your treatments for marketing purposes:

- We will obtain separate, explicit written consent

- You can specify usage limitations (website only, no social media, etc.)

- You can request removal of your image anytime

- Consent can be withdrawn, but already-published materials may remain

### 16.4 Testimonials & Reviews

If you provide a testimonial or review:

- We may use it in marketing materials (with your consent)

- You can request anonymization (first name only or initials)

- You can request removal or modification anytime

- Online reviews (Google, Facebook) are governed by platform policies

---

## 17. CONSENT & ACKNOWLEDGMENT

By using ATOS Wellness services, you confirm that:

1. You have read and understood this Privacy Policy

2. You consent to the collection, use, and disclosure of your personal data as described

3. You understand your rights under PDPA and how to exercise them

4. You agree to provide accurate and complete information

5. You will promptly update us if your information changes

6. You acknowledge that some services require health data processing for safety

For specific consents (e.g., marketing), you will be asked separately during booking, registration, or service delivery.

---

This Privacy Policy is effective as of January 1, 2025, and was last updated on November 26, 2025.

ATOS Wellness Pte. Ltd.

Company Registration No.: [Registration Number]

GST Registration No.: [GST Number]

Locations:

- 25 North Bridge Road, #03-01, Singapore 179104

- 25 North Bridge Road, #03-02 & 03, Singapore 179104 (Inner Harmony)

- 48 Boon Lay Way, #01-10, Singapore 609961

- 70 Ubi Crescent, #01-04, Singapore 408570 (HQ)

Contact: [email protected] | 6265-9660

---

This Privacy Policy is prepared in accordance with Singapore's Personal Data Protection Act 2012 (PDPA) and reflects industry best practices for wellness and healthcare services. If you have questions about this policy or how we handle your data, please contact us.