Privacy Policy (version 1.1.1 - 19-Feb-2023)

Effective February 19th, 2023

1. Policy Intent

Scribo Limited (hereinafter referred to as “Scribo”, “We”, “Our”, “we”, “our” or “us”) respects and is committed to protect the privacy of all individuals that provide Personal Data to us through compliance with this privacy policy (hereinafter referred to as “Privacy Policy”), including the data recorded by Scribo Users that relates to their clients, patients or other individuals. References herein to Sections are to the sections of this Privacy Policy. This Privacy Policy applies to the Website, associated software, including but not limited to the Scribo® software application, and other applications and services that specifically state that this Privacy Policy applies to them, including but not limited to the Scribo Services and Additional Services. It excludes services that have separate privacy policies that do not incorporate this Privacy Policy.

This Privacy Policy explains what data we collect from you as a natural person or a legal person who uses the Scribo Services, Additional Services or Website (hereinafter referred to as the “Licensee”, “You”, “Your”, “you” or “your”), how we use that data, how you can review or change the Personal Data you provided to us, when this policy is effective, how we may change this policy, and the steps we take to ensure that the Personal Data we collected is protected. We share your Personal Data only with your consent or as described in this Privacy Policy.

By clicking “I agree” (or similar button or checkbox) at the time you register for a Scribo User Account or place an Order, you indicate your assent to this Privacy Policy, which is incorporated in, part of and subject to the Terms of Service available here (hereinafter referred to as the “Terms”). Capitalised terms stated herein, which are not otherwise defined, shall have the meanings set forth in the Terms.

2. Definitions used in this Privacy Policy

“Anonymised Data” means information (or any portion thereof) that has been anonymised such that that it does not or no longer renders an individual identifiable and with respect to which there is no reasonable basis to believe that the information could be used to identify an individual, either directly or together with additional information available through legal means from third parties.

“Patient Data” means a type of Personal Data concerning the health of a patient and including in particular any related data from electronic medical record systems, patient radiological images, digital pathology images, pathology reports, sequencing reports, and other information systems, that is collected, recorded and used by you, your Affiliate and/or an Eligible Person. The categories of Patient Information include but not limited to demographic details, comorbidities, smoking status, alcohol history, social economic status, quality of life details, genetic, genomic data, biometric data, clinical data, and treatment details.

“PDPO” means the Personal Data (Privacy) Ordinance of the Hong Kong Special Administrative Region.

“Personal Data” means information, whether true or not, that we collect from and/or about a natural person, that can be used to identify the person, or that is combined with information that can identify the person directly or indirectly (in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person), or as defined by the PDPO.

3. Collection of Personal Data

You acknowledge and consent to Scribo in collecting Personal Data about you or from you in different ways, either directly and indirectly, as described in the following, and use such per Section 4.

Scribo directly collect your Personal Data if you send an enquiry to us from our Website, use the Scribo Services, or get in touch with us by chat, email, phone or any other reasonable means of communication. We may also collect your Personal Data if you engage with us through social media. These data can include but not limited to your name, gender, date of birth, country of birth, addresses, telephone numbers, email addresses, and credit and banking details.

Scribo also does not directly collect any special categories of Personal Data about you. These include but not limited to details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions and trade union membership. Neither does Scribo collect any information about criminal convictions and offences.

We indirectly collect Personal Data collected by you, your Affiliate and/or an Eligible Person about a natural person other than yourself and/or himself (hereinafter referred to as “Client Data”) when you, your Affiliate and/or an Eligible Person use the Scribo Services to host, record and/or process such data. This includes but not limited to the situation when you, your Affiliate and/or an Eligible Person record Personal Data about a patient, including but not limited to Patient Data of the patient, using the Scribo Services.

Other Personal Data we may collect when you, your Affiliate and/or an Eligible Person use the Scribo Services are as follows:

Account Information. Upon creating an account to become a user of the Scribo Services or Additional Services, you must provide Scribo with a certain amount of personal information so that we can provide our services to you including but not limited to your name, email address and/or phone number, occupation, title, and a password. If you choose to authenticate using a third-party account, such as Google, you authorise us to obtain account information from the respective third-party platform.

Payment Information. In order to gain access to and use specific features of the Scribo Services, you must provide Scribo, or a designated third-party payment processor acting on our behalf, with payment information, including but not limited to your credit or debit card number, card expiration date, CVV code, and billing address.

Support Information. The Scribo Services also include our customer support, where you may choose to submit information regarding a problem you are experiencing upon using the Scribo Services. For example, if you designate yourself as a technical contact, open a support ticket, speak to one of our representatives directly or otherwise engage with our customer support team, you will be asked to provide contact information, a summary of the problem you are experiencing, and any other documentation, screenshots or information that would be helpful in resolving the issue.

Survey Information. From time to time, we may ask our users of the Scribo Services and/or visitors of the Website to participate in surveys. These surveys are optional. If you choose to participate, any information you provide to us, including personal information, will be linked with your Scribo User Account(s) or Scribo Clinic Account(s) that you created or joined on the Scribo® software application and related platform. If you would not like your information to be used in this way, you have the option to not participate in surveys or, if you do participate, to provide us only with information you consent to our use of in accordance with this Privacy Policy.

Service usage information. When you visit the Website, sign in your Scribo User Account, interact with the Scribo Services or Additional Services, or visit a third-party service that includes content from the Scribo Services or Additional Services, we may receive information about you, or combine such information with other Personal Data about you. This service usage information can include but not limited to data such as your IP address, browser type, operating system, the referring web page, pages visited within our Services, location, your mobile carrier, device information (including device and application IDs), search terms, and cookie information.

4. Use of Personal Data

You acknowledge and consent to Scribo and/or its Affiliates in using Personal Data collected per Section 3 is to operate, optimize, maintain, expand, develop and/or provide the Scribo Services to you, your Affiliate and/or an Eligible Person, including but not limited to using Personal Data for billing, identification, authentication, assisting you with any inquiries you may have, monitoring usage or traffic patterns, gathering demographic information about the user base of Scribo Services as a whole, and analyse trends, administer and/or optimise the Scribo® software application. Scribo may also use Personal Data collected per Section 3 to detect, investigate and/or prevent activities that may violate the Terms, this Privacy Policy, other policies of Scribo or Applicable Laws. Scribo may, only under consent from the respective Scribo User(s), use email addresses to share news, tips, updates and special offers. After you have consented to our use of your Personal Data for these specific purposes, you have the right to change your mind at any time, but this will not affect any data processing that has already taken place. Scribo use or process your Personal Data in compliance with our legal obligations and with this Privacy Policy.

Scribo and/or its Affiliates mainly use Personal Data, including but not limited to Patient Data, collected and stored in the Scribo® software application by you, your Affiliate and/or an Eligible Person for providing support and technical assistance to you, your Affiliate and/or an Eligible Person as part of the Scribo Services.

You acknowledge and consent to Scribo and/or its Affiliates in using and processing Personal Data, including but not limited to Patient Data, collected per Section 3 into Anonymised Data for deriving insights and/or information to create sets of secondary data (hereinafter referred to as “Datasets”), and own these Datasets and use them for (i) enhancement, development and/or commercialization of the Scribo Services and/or other products or services provided by Scribo and/or its Affiliates, and (ii) statistical, research, commercial and/or scientific purposes. The right of Scribo and/or its Affiliates to own and use the Datasets shall survive any expiration or termination of the Terms or of your access to the Scribo Services (or Additional Services).

We may use other data for a range of different purposes, provided we comply with Applicable Laws and our contractual commitments. In member states of the European Union (EU), European Economic Area (EEA), and Switzerland (hereinafter collectively referred to as the “Designated Countries”), local legal regimes may require us to treat some or all of other data as “personal data” under applicable data protection laws. Where this is the case, we will process other data only for the same purposes as Personal Data under this Privacy Policy.

If you have any questions about the lawful bases upon which we collect and use your Personal Data collected per Section 3, you may contact us at [email protected].

5. Disclosure of Personal Data

Except as described in this Privacy Policy, Scribo and/or its Affiliates will not share, sell or rent any of your Personal Data or Client Data with any third-party without your permission or unless as required by law.

Scribo may work with its Affiliates and/or third-party services, including but not limited to our web host, data backup and payment provider, that we allow access to Personal Data we collected, and may use it on our behalf strictly for the purposes for which they are engaged. We minimise the amount of Personal Data that is utilised by third-party services, and we have ensured that these services process Personal Data in accordance with the appropriate regulations. We do not authorise third-party services to use or disclose your Personal Data or Client Data except in connection with providing the services we request from them.

The Scribo Services and/or Additional Services may contain links to or allow you to interact with and make use of Third-Party Sites, Products and Services. These Third-Party Sites, Products and Services fall outside of this Privacy Policy and we have no control over the data they collect. We may receive your Personal Data and/or Client Data when you integrate or link Third-Party Sites, Products and Services with the Scribo Services and/or Additional Services, including Personal Data from the third party who provides the linked Third-Party Sites, Products and Services. Once using Third-Party Sites, Products and Services, your data may be collected by others, and we encourage you to read the privacy policies of such before using them.

In rare circumstances, we may be obliged to disclose Personal Data if disclosure is required to comply with the law, if we believe the Terms have been violated, if we believe it is necessary to protect our rights, or if the ownership and assets of Scribo were to be transferred to another party.

6. User Privacy Rights and Choices

You may request by sending an email to [email protected] to exercise the rights below, and we will handle them according to Applicable Laws, and/or within the exercise of our discretion. Please note that we may ask you to verify your identity before taking further action on your request.

Right to review, update, or correct data. You have the right to ask us to correct inaccurate or incomplete Personal Data concerning you or Client Data. You can also edit some of the Personal Data concerning you or Client Data through your Scribo Account. In addition, you can ask us to change, update, or fix such data in certain cases, particularly if it is inaccurate. We strongly recommend you to update your Personal Data as soon as possible after it changes. During the process of editing any Personal Data, we may need to verify the accuracy of the new data you provide to us.

Right to object to, limit, or restrict the use of data. You have the right to ask us to stop using all or some of your Personal Data or Client Data if we have no legal right to keep using it or to limit our use of it if any of your Personal Data or Client Data is inaccurate or unlawfully held.

Right to delete data. You have the right to ask us to erase or delete your Personal Data or Client Data, and we will take all reasonable procedures to do so unless we are required to keep it for legal reasons. In some cases (for example, information previously posted in public areas) it may not be practical or may be unduly burdensome, to delete your Personal Data or Client Data whilst sustaining our provision of the Scribo Services to you.

Right to receive the information and/or take your data. You have the right to receive information whether we process your Personal Data and if such Personal Data is processed, and, where that is the case, access to the Personal Data. You have the right to receive yourself or transfer your Personal Data and/or Client Data to another third party, as the right to data portability. We will provide to you, or the third party that you have selected, such Personal Data in a structured, commonly used, machine-readable format.

Right to lodge a complaint. You have the right to lodge complaints about the data processing activities carried out by Scribo before the competent data protection authorities within your jurisdiction.

Right to object with the processing of data for direct marketing purposes. You have the right to object at any time to processing of your Personal Data for direct marketing purposes.

Right to withdraw the consent. You have the right to withdraw your consent at any time where we are relying on consent to process your Personal Data or Client Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

At any time, you may exercise your rights as described above by sending an email to [email protected]. In the email please provide specific details about the right you are exercising. Once we receive the communication, we will respond as early as possible and without delay. Depending on the request, it might take us some time to respond, but we will endeavor to do so within thirty (30) calendar days of receiving your request. Provided that we only collect and/or process your Personal Data or Client Data that is required, it is likely that revoking your consent will limit the functionality of the Scribo Account(s) or the Scribo Services you are entitled to access. As a consequence of exercising your rights as described above, please note that we may thus not be able to provide all or certain parts of the Scribo Services to you, or may force us to terminate the provision of the Scribo Services to you. This will be notified to you at the time of your request to exercise your rights if applicable.

If you have any questions about the above-mentioned rights or the lawful bases upon which we collect and use your Personal Data, please contact us by emailing [email protected].

7. Control of Data

Scribo will not review, share, distribute, or reference any data you, your Affiliate and/or an Eligible Person provide to the Scribo Services except as provided in the Terms, or as may be required by law. In accordance with this Privacy Policy, Scribo and/or its Affiliates may access Client Data only for the purposes described in Section 3 and Section 4, or as may be required by law. To the extent that the Client Data contains any Personal Data, you shall (i) ensure that your agreements, your privacy policies and the Applicable Laws allow for the delivery of such Personal Data to Scribo and/or its Affiliates, and its use as disclosed to it by Scribo (including the uses contemplated by this Privacy Policy); (ii) secure any required consents to use such Personal Data with the Scribo Services and such uses disclosed to you, your Affiliate and/or an Eligible Person by Scribo (including the uses contemplated in this Privacy Policy); (iii) timely inform Scribo and/or its Affiliates of opt-out requests received after delivery of the Personal Data, in no event less than fifteen (15) calendar days following its receipt thereof; and (iv) secure all necessary rights to allow Scribo and/or its Affiliate to receive and use such Personal Data.

Scribo acknowledges that any person has the right to access his Personal Data. If Personal Data pertaining to a person has been submitted to the Scribo Services by a Scribo User and such person wishes to exercise any rights he may have to access, correct, amend, or delete such data, the person should inquire directly with such Scribo User. If the person wishes to make his request directly to Scribo, he must provide details of the Scribo User(s) who submitted his data to Scribo. We will refer his request to the respective Scribo User(s), and will support the particular Scribo User(s) as needed in responding to his request.

8. Opt-out of Marketing Emails

You may opt-out of receiving marketing emails from us at any time. Information concerning your past behaviour, interactions and/or activities with the Scribo Services may be retained by us as long as necessary in a certain manner and for the purposes set out per Section 9. Although you may opt-out of receiving certain emails, please note that we reserve the right to communicate with you via email regarding specific products and services you have ordered, requested, or inquired about.

9. Data Retention

As a general rule, we retain Personal Data you provide to the Scribo Services for as long as you have a Scribo User Account, and for up to three years thereafter if you are a user from a Designated Country. Otherwise, Scribo may retain a back-up copy of your User Content from all Scribo Account(s) that you are entitled to access, indefinitely. We will only retain your Personal Data or Client Data to the extent it is needed for the purposes per Section 4 or we are required by law to maintain such. We dispose of Personal Data by destroying it, erasing it or anonymising it.

We may retain logs of automatically collected data for internal analysis; your email address; communications with you; and your transactional information for auditing, tax, and financial purposes. When we no longer have a legitimate business interest in retaining such, we will delete or anonymise it.

During the Suspension Period of a suspended Scribo Clinic Account per Section 7.5 of the Terms, the administrator of the account will have the option to use the respective functionality of the Scribo Services under his Scribo User Account to recover and export certain User Content submitted by you, your Affiliate and/or Eligible Person to and stored with the Scribo Services for creating or recording each patient consultation under such Scribo Clinic Account at the time before it became suspended, including treatment prescribed, diagnoses and consultation notes recorded, before they are permanently deleted per Section 7.5 of the Terms.

If we receive legal process pertaining to Scribo Account(s) you are entitled to access or have other legal document retention requirements, we will retain the Personal Data created and stored therein for as long as we in good faith believe is necessary to comply with our preservation obligations. If we believe that such account(s) has been involved in wrongdoing, we may preserve Personal Data created and stored therein to defend or assert our rights.

10. Security and Management of Incidents

In order to protect both the Personal Data and the general information that we receive from you through your use of the Scribo Services or Additional Services, we have implemented various security measures. For example, when you enter Personal Data, such as your contact information, on our online forms, we encrypt that information using transport layer security (TLS). We also follow generally accepted industry standards to protect the Personal Data submitted to us, both during transmission and once we receive it. All Personal Data created, provided to and/or stored on the Scribo Services is encrypted, stored in state-of-the-art facilities with access being restricted to those who have a need to know, and we regularly review our technology to maintain security.

You acknowledge and agree that, whenever you give out Personal Data online, there is a risk that third parties may intercept and use that data. While Scribo strives to protect Personal Data you shared and privacy, we cannot guarantee the security of any information you disclose online. We cannot guarantee the security of any data provided to or received by us through your use of the Scribo Services or Additional Services, and any Personal Data, general information, or other data or information is provided to us at your own risk.

If any of your Personal Data or Client Data is shared privately, those you have shared it with may use it in a manner inconsistent with our Terms and this Privacy Policy, and/or inconsistent with your wishes, including disclosing it publicly. Please exercise discretion concerning those you share your private content with.

In the event of a security breach, Scribo will notify you to the extent required by security breach laws, within seventy two (72) hours of Scribo having actual knowledge of such breach, and subject to any existing confidentiality obligations to any third parties. You will be informed of what information is at risk, steps that we have taken to ensure safety of your Personal Data and Client Data, and what action we are taking or have taken to rectify the breach. You are responsible for providing up-to-date contact information. Scribo is not liable for a security breach for which it would otherwise be liable hereunder if you fail to immediately notify Scribo about misuse of the Scribo Services or issues with authentication credentials. Both Scribo and you agree that the obligation of Scribo to respond to security breaches does not constitute admission of fault or liability. To the extent permissible at law, in the event that there is a breach and indirectly collected information is at risk, we will follow the same protocol, however the affected Scribo User(s) (rather than the individuals) will be notified instead.

11. Contact Information

If you have any questions, comments, or concerns relating to the Scribo Services, the Website, the Programme, Additional Services, No-Charge Products or the Terms, please send an email to [email protected] or write to us at:

Scribo Limited
11th Floor, 52 Hung To Road
Kwun Tong, Kowloon
Hong Kong

We will make every effort to resolve your concerns.