Health Data Processing Notice

This notice supplements the Privacy Policy and applies to health data processed through Compound. If this notice conflicts with the Privacy Policy for health data processing, this notice controls for that processing activity.

Health data includes information that identifies or can reasonably relate to your physical or mental health, test results, biomarkers, reports, symptoms, goals, clinical context, and health management preferences.

Compound may process the following health data when you use the service or when a clinic uploads a report connected to your booking.

• Uploaded health reports and source files, including PDF, TXT, and CSV files.
• Biomarker names, values, units, lab reference ranges, report dates, test dates, report status, and row-level extraction details.
• Questionnaire responses, health goals, symptoms, lifestyle context, medication or supplement notes, and preferences you provide.
• Appointment, concierge, booking, order code, clinic upload, and report handoff information.
• AI-generated or system-generated summaries, trends, classifications, explanations, protocols, and health management insights.

Because health data is sensitive personal information, Compound will request separate consent before processing it where required by Chinese law. This includes report upload, health questionnaire submission, report ingestion, and health data analysis workflows.

You may withdraw consent at any time through your account settings or by emailing hello@compoundlife.ai, but doing so may prevent Compound from providing health report parsing, biomarker dashboard, protocol suggestions, concierge coordination, or clinic report upload features.

We process health data only for specific and necessary product purposes.

• Store and organize your health reports in Records.
• Extract biomarkers and show current and historical results in the Data dashboard.
• Generate personalized health management explanations, summaries, and protocol drafts.
• Coordinate appointments, concierge support, and authorized clinic uploads.
• Detect ingestion errors, preserve audit trails, improve extraction accuracy, and maintain service safety.
• Use only aggregated, de-identified, or anonymized information for product quality, service reliability, safety, and research-like analysis where legally permitted; anonymized information that cannot be re-identified is no longer personal information.

Compound may use automated and AI-assisted processing to read reports, map biomarkers, explain results, and produce health management suggestions. AI output may be incomplete, inaccurate, or not suitable for your personal medical situation.

Compound's AI output is health management information only. It is not medical diagnosis, treatment, prescription, emergency guidance, or a substitute for a licensed physician or qualified healthcare professional. AI-generated content is labelled as required by applicable rules on generative AI and deep synthesis.

Where a decision is made solely through automated means and significantly affects your rights or interests, you may request an explanation and may refuse such a decision. We use only de-identified or anonymized data to improve extraction accuracy and the service; if we ever need to use identifiable health data to train models, we will obtain your separate consent first.

When you book testing or authorize a report handoff, clinic staff may upload reports connected to your Compound booking or order code. Compound uses those reports to populate Records and Data for your account.

Clinics, laboratories, and medical institutions remain responsible for the medical services, sample collection, test performance, and original laboratory reports they provide. Compound organizes and explains data but does not operate as the testing laboratory or treating medical institution. Compound does not hold a Medical Institution Practice License, does not provide internet diagnosis or treatment, and does not issue diagnostic conclusions.

Compound does not share your health data with employers, insurers, advertisers, marketing companies, or public databases without your separate authorization or another valid legal basis.

Where we provide health data to an independent processor such as a clinic or laboratory, we will inform you of the recipient's name, contact information, processing purpose and method, and the categories involved, and obtain your separate consent where required. Entrusted service providers process health data only on our instructions under confidentiality and security obligations.

Compound stores and processes health data within mainland China. Health and medical data is, in principle, stored within the country; if any cross-border transfer becomes necessary in the future, we will complete the statutory procedures (security assessment, standard contract, or certification) and obtain your separate consent first.

Health data is protected with stricter access controls and security measures than ordinary account information, consistent with the national health/medical data security guidance.

We retain health data only for the time needed to provide the service, comply with law, preserve security and audit records, or protect legal rights. You may request deletion or account cancellation subject to applicable legal and technical limits.

You may access, copy, correct, supplement, delete, and request cancellation of your account in respect of your health data, and you may withdraw consent, in the manner described in the Privacy Policy and subject to applicable law and identity verification.