Privacy Policy

Your Privacy Matters to Us.

At LifestyleTech, we are committed to protecting your personal information and ensuring your privacy rights are respected in all our healthcare technology services.

Last Updated: 18 September 2026

Privacy Notice for Website and Application
of
LifestyleTech Solution Co., Ltd.

LifestyleTech Solution Co., Ltd. (hereinafter referred to as the “Company” or “we”) provides the website www.lifestyletechsolution.com (hereinafter referred to as the “Website”) and the LifestyleTech application (hereinafter referred to as the “Application”). This Privacy Notice (the “Notice”) explains how we collect, use, disclose, transfer, store, protect, retain, and otherwise process your Personal Data in connection with the Website and Application. We act as a data controller under the Personal Data Protection Act B.E. 2562 (A.D. 2019) (“PDPA”) where applicable and are committed to protecting your Personal Data and your right to privacy. We process Personal Data only for the purposes described in this Notice or as otherwise permitted or required by applicable law.

1. Definitions

"Personal Data" refers to any information that identifies or can be used to identify you, which is collected by the company as specified in this Notice.
“Sensitive Data” refers to Personal Data classified as sensitive data under the Personal PDPA that the company is permitted to collect, use, disclose and/or transfer with your explicit consent, e.g., the information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, a natural person’s sexual orientation or criminal record, or data concerning health, disabilities, trade union membership, genetic data, biometric data, and other data that affect the Data Subject in the same manner.

2. Personal Data Collected, Used and/or Disclosed by the Company

We will collect, use, and/or disclose your Personal Data which includes, but is not limited to, the following:
  1. 2.1 General Personal Data
    1. Personal information, e.g., first name, middle name, last name, title, date of birth, gender, nationality, photograph, country of residence, national identification card number, and passport number.
    2. Contact information, e.g., address, mobile phone number, home phone number, and email address.
    3. Financial information, e.g., bank account details and account number, credit or debit card information.
    4. Personal information for account login e.g., username, log-in through social media account (such as Line, Facebook, and WhatsApp), including personal data from the social media account that you choose to share with us (such as email, phone number).
    5. Automatically collected data about your use of service, e.g., access time, device ID, or other unique identifiers, IP address, MAC address, overall usage data, usage history, settings, language information, device name and model, location and time zone, network provider, operating system information, and session length.
  2. 2.2 Special Personal Data

    The Company may be required to collect, use, disclose, and/or transfer sensitive personal data, such as race, religion, or blood type, which may appear on a copy of your national identification card or other official documents you have provided. This is for the purposes of identity verification, legal compliance, or the provision of services under the Company’s business contracts. The Company shall process such data in accordance with the criteria prescribed by law, and will obtain your explicit consent or proceed only where permitted by applicable law. If you do not wish the Company to process such sensitive personal data, please redact or strike through the relevant information on the document copies before submitting them to the Company. In the event that you do not redact such sensitive personal data, the Company shall deem that you have given explicit consent for the processing of such data for the purposes stated in this notice. Where processing is not necessary, the Company will mask or obscure such data unless technically infeasible.
    Additionally, the Company may process data related to health services, which may include sensitive personal data such as health information, medical reports, photographs, or video recordings, for the purpose of providing services in accordance with lawful objectives.

3. Source of Your Personal Data

We will receive your Personal Data from the main channels as follows:

  1. 3.1 From the process of creating a user account through registration via the company's Website or Application;
  2. 3.2 From the Personal Data you voluntarily release to us to request our services, whether through filling out a service request form at the company, contacting via social media accounts, phone calls, or other forms filled out through the company's Website and Application such as appointment forms, inquiry forms, product purchase or service request forms, and news subscription forms;
  3. 3.3 From your registration and log-ins through third-party platforms such as Google, Facebook, Twitter and Apple. We may receive your additional Personal Data through these platforms as they are capable of verifying the authenticity of your identity and providing you with the option to disclose your certain Personal Data, e.g., your name, email address and social media accounts, to the company if you have authorized their platforms to share your Personal Data with us; and
  4. 3.4 From devices or other applications, such as Apple Health, that you choose to connect to the LifestyleTech Application, where you can decide which health data will be disclosed to us for providing your health services.
  5. 3.5 Third-Party Data Sharing Notice

    Our platform connects with third-party services to retrieve health and activity data based on your explicit authorization. The types of data that may be accessed from each provider are as follows:

    Provider Access Type Record Type
    Garmin read Health API, Activity API
    Apple Health read ActiveEnergyBurned, HeartRate, DistanceWalkingRunning, StepCount, SleepAnalysis
    Health Connect read READ_STEPS, READ_ACTIVE_CALORIES_BURNED, READ_DISTANCE, READ_HEART_RATE, READ_HEART_RATE_VARIABILITY, READ_SLEEP
    Fitbit read profile, settings, activity, nutrition, heartrate, sleep, weight
    Google Health API read Profile, Steps, Distance, Active Energy Burned, Exercise, Heart Rate, Heart Rate Variability, Daily Resting Heart Rate, and Sleep
    HUAWEI Health read HUAWEI ID, Distance, Altitude, Ascent, Daily Activity, Calories, Heart Rate, Steps, Sleep, Workout Data, Workout Records, Historical Health Data, and Cloud-Synchronized Health Data
    Oura Ring read daily, heartrate
    Samsung Health read STEPS, HEART_RATE, SLEEP, ACTIVITY_SUMMARY

3.5.1 Huawei Health and HUAWEI ID Data Usage

Our Application accesses Huawei Health data and HUAWEI ID information to provide personalized wellness tracking, lifestyle coaching, health analytics, fitness challenges, and corporate wellness services.

HUAWEI ID Information. We access HUAWEI ID information to:

  • Authenticate users securely.
  • Create and manage user accounts.
  • Associate health and wellness data with the correct user profile.
  • Personalize the user experience across devices and services.

Distance, Altitude, and Ascent Data. We use distance, altitude, and ascent information to:

  • Measure users' walking, running, hiking, and other physical activities.
  • Track exercise performance and progress.
  • Calculate activity intensity and movement achievements.
  • Support fitness challenges and wellness programs.

Daily Activity Data. We use daily activity data, including Move, Exercise, Stand, and step count information, to:

  • Monitor daily activity levels.
  • Evaluate achievement of activity goals.
  • Provide personalized lifestyle and physical activity recommendations.
  • Encourage healthy behavior change and increased physical activity.

Calorie Data. We use calorie and metabolic data to:

  • Estimate energy expenditure.
  • Support weight management and wellness goals.
  • Provide health insights and activity reports.
  • Deliver personalized lifestyle recommendations.

Heart Rate Data. We use heart rate information to:

  • Monitor exercise intensity.
  • Assess cardiovascular wellness trends.
  • Generate personalized fitness and recovery insights.
  • Support health coaching recommendations.

Step Count Data. We use step count information to:

  • Track daily movement and physical activity.
  • Measure progress toward activity goals.
  • Support wellness programs, challenges, and rewards.
  • Generate activity summaries and reports.

Sleep Data. We use sleep information to:

  • Analyze sleep duration and sleep quality.
  • Identify sleep behavior patterns.
  • Provide recommendations for improving sleep habits.
  • Support holistic wellness and lifestyle management.

Workout Data. We use detailed workout metrics, including resistance, power, jumping, running form, altitude, and other exercise-related measurements, to:

  • Analyze exercise performance.
  • Provide advanced fitness insights.
  • Support personalized coaching and training recommendations.
  • Monitor workout effectiveness and progression.

Workout Records. We use workout records, including activities such as running, cycling, walking, jump rope, and other supported exercise types, to:

  • Maintain users' exercise history.
  • Track fitness progress over time.
  • Generate workout summaries and achievements.
  • Support wellness challenges and activity-based programs.

Historical Health Data. We access health data from the month prior to authorization to:

  • Establish baseline health and activity trends.
  • Generate meaningful progress comparisons.
  • Provide more accurate wellness analytics and recommendations.
  • Deliver long-term health insights.

Cloud-Synchronized Health Data. We use cloud-synchronized Huawei Health data to:

  • Ensure health information remains accurate and up to date.
  • Synchronize user records across authorized devices.
  • Improve continuity of health and wellness tracking.

3.6 Google Health API User Data Policy

Google User Data. LifestyleTech accesses Google user data through the Google Health API only after you choose to connect your Google account and grant the applicable permissions through Google's OAuth consent process. Access is read-only and is limited to the Google Health API data required to provide the health and fitness features described in this Section.

Google Health API Data We Access and How We Use It. LifestyleTech requests only the Google Health API scopes necessary to provide user-facing health and fitness features. The four read-only Google Health API scopes requested by LifestyleTech, the data they permit us to access, and the purposes for which we use that data are described below:

Google Health API Scope Data Accessed Purpose of Use
https://www.googleapis.com/auth/googlehealth.profile.readonly Google Health profile data To associate authorized Google Health data with the correct LifestyleTech user profile and display the relevant information within the Application.
https://www.googleapis.com/auth/googlehealth.activity_and_fitness.readonly Activity and fitness data, including steps, distance, active energy burned, exercise sessions, activity duration, and other activity or fitness measurements available through this scope. To display daily activity summaries, exercise history, activity progress, health and fitness trends, and other user-facing wellness features within the Application.
https://www.googleapis.com/auth/googlehealth.health_metrics_and_measurements.readonly Health metrics and measurements, including heart rate, heart rate variability, daily resting heart rate, weight, height, and other health measurements available through this scope. To display health metrics, measurement history, trends, and personalized health and fitness insights within the Application.
https://www.googleapis.com/auth/googlehealth.sleep.readonly Sleep history and sleep-related data and metrics. To display sleep history, sleep duration, sleep-related metrics and trends, and personalized health and wellness insights within the Application.

All Google Health API data accessed by LifestyleTech is used only to provide or improve user-facing features within the LifestyleTech Application. All four Google Health API scopes listed above are read-only. LifestyleTech does not use Google Health API data for advertising, marketing, retargeting, data brokerage, resale, credit or lending decisions, insurance eligibility, employment decisions, or independent profiling by third parties.

The exact Google Health data available to LifestyleTech depends on the permissions you grant and the data available in your Google account. We do not request permission through the scopes listed above to write, modify, or delete data in your Google Health account.

Purpose of Access and Use. LifestyleTech uses Google user data only to provide or improve user-facing health and fitness features that you request within the Application. These features include synchronizing authorized health history, displaying health metrics and trends, maintaining exercise and activity history, tracking progress toward health and fitness goals, and generating personalized health and fitness insights for you within LifestyleTech.

Google user data is not used for advertising, marketing, personalized advertising, retargeting, interest-based advertising, determining eligibility for credit, lending, insurance, or employment, selling data to data brokers or information resellers, creating databases for purposes unrelated to the user-facing features described above, or for other purposes unrelated to providing or improving LifestyleTech's user-facing functionality.

Storage and Security. Google OAuth access credentials and Google user data transmitted between Google and LifestyleTech are protected using encrypted connections such as HTTPS/TLS. Google user data stored by LifestyleTech is maintained in access-controlled systems. Access is restricted to authorized personnel and contracted service providers only as necessary to operate, secure, maintain, and support the user-facing LifestyleTech features described in this Section.

Sharing, Transfer, and Disclosure. LifestyleTech does not sell, rent, or trade Google user data. We do not disclose or transfer Google user data to third parties for their own independent advertising, marketing, data brokerage, information resale, or other independent purposes.

We may share Google user data with contracted infrastructure and technology service providers acting on our instructions only when necessary to provide, operate, secure, maintain, or support the user-facing LifestyleTech features described in this Section. Such service providers are required to protect the data and may not use Google user data for their own independent purposes.

Google user data may also be disclosed where necessary for security purposes, including investigating abuse or misuse, or where disclosure is required by applicable law, regulation, legal process, or a valid request from a competent authority.

Limited Use Compliance Requirements. LifestyleTech's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We DO NOT use Google user data for advertising, marketing, personalized advertising, retargeting, or interest-based advertising.
  • We DO NOT sell Google user data to data brokers or provide Google user data to information resellers.
  • We DO NOT use Google user data for determining credit-worthiness, lending, insurance eligibility, or employment eligibility.
  • We DO NOT allow humans to read Google user data unless we have obtained your explicit agreement for specific support or troubleshooting purposes, access is necessary for security purposes such as investigating abuse, or access is required by applicable law.
  • We DO NOT transfer Google user data to third parties except as necessary to provide or improve user-facing LifestyleTech features with your consent, for security purposes, or to comply with applicable law.
  • We DO NOT use Google user data to train, improve, or fine-tune generalized or non-personalized artificial intelligence (AI) or machine learning (ML) models.

Data Retention and Disconnection. Google OAuth access credentials are retained only while your Google Health API integration remains active.

You can stop future access to Google Health data at any time by disconnecting the Google Health integration from Profile > Connect Apps in LifestyleTech or by revoking LifestyleTech's access through Google Account Permissions.

Disconnecting or revoking the Google Health integration stops future access to Google Health data. Google user data previously imported into LifestyleTech may remain in your LifestyleTech health history until you delete your LifestyleTech account or request deletion, unless retention is required by applicable law.

User Data Deletion Request. You may request deletion of Google user data stored by LifestyleTech at any time through the following methods:

  • In-App: Go to Profile > Settings > Delete Account.
  • Email Request: Contact our Data Protection Officer at dpo@bumrungrad.com with the subject "Google Data Deletion Request".

When your LifestyleTech account is deleted or when a valid deletion request is received, associated Google user data stored by LifestyleTech will be permanently deleted or irreversibly anonymized within 24 hours, except where retention is required by applicable law.

Relationship to Other Provisions of this Privacy Notice. Google Health API data is excluded from the general marketing, advertising, employer, affiliate, business-partner, and other independent-use disclosure provisions elsewhere in this Privacy Notice. Google Health API data will not be disclosed to those parties for their own independent purposes. Google Health API data is handled in accordance with the specific terms of this Section 3.6.

4. Purposes and Legal Bases

We will process your Personal Data based on legal bases as provided below:
  1. 4.1 We rely on contractual obligations to process your Personal Data, for instance:
    1. consider registration requests to create user accounts on the Website and Application;
    2. verify your identity when registering to create an account on the Website and Application; To process appointments and manage patient records
    3. proceed with the registration of service with the company through online platforms and contact you for providing the services;
    4. assist you in buying products and services from the company through online platforms such as purchasing vouchers for health check-up programs and other medical treatment programs;
    5. collect payment for products and services, e.g., service packages, purchased products, etc. through the Website.
  2. 4.2 We rely on legal obligations to process your Personal Data, for instance:
    1. submit Personal Data to government agencies as required by law;
    2. comply with court orders or orders of competent authorities as required by law; and
    3. pay legal fees.
  3. 4.3 We rely on legitimate interest to process your Personal Data, for instance:
    1. facilitate your access to the Website and Application;
    2. allow you to access services through the company's online platforms reserved for members with user accounts;
    3. provide assistance, answer questions, respond to inquiries, and accept the request with regard to services;
    4. contact you due to your complaint or comments on the company’s services that you want to improve;
    5. track your use of services to improve the quality of the company’s services;
    6. develop and improve service quality, increase service efficiency, and facilitate the use of services through the company’s systems to the user and customers;
    7. disclose your Personal Data, where it is necessary, to investigate, prevent, or act in reprisal in the event of suspected illegality or fraud, or to safeguard the safety, rights, or property of the company or of another person; and
    8. disclose your Personal Data for the purpose of internal auditing.
  4. 4.4 For the necessity of establishing, exercising, or defending legal claims as permitted by law, for instance, service fee collection, invoice issuance, requesting to pay off the invoice, issuance of receipts, and verification of billing and payment records.
  5. 4.5 The Company may collect, use, disclose, and/or transfer your personal data based on your consent for the purpose of analyzing information related to the purchase of goods and/or services, including health-related information you have voluntarily provided to us through other channels (excluding any data obtained via the Google Health API integration, which is governed exclusively by Section 3.6 and will never be used for marketing purposes), in order to provide or deliver news, notifications, promotions, campaigns, or invitations to participate in various activities organized by the Company that may be beneficial and relevant to your interests, through the communication channels you have provided.

5. Disclosure of Your Personal Data

We will not disclose your personal data to any third party for independent use under any circumstances, except as stated in this Notice or when authorized by you.
However, the Company may disclose your personal data held by the Company to its affiliates, business partners, or external service providers, such as customer relationship management service providers, marketing, advertising and communication service providers, information technology system providers, cloud system providers, document storage providers, debt collection agencies, accounting and legal service providers, auditors, internal auditors, financial auditors, as well as your family members, relatives, close contacts, relevant authorities, or your employer, and any other actions necessary to achieve the purposes specified in this notice for the benefit of the Company’s services. The Company will ensure that such parties handle your personal data in accordance with this Privacy Notice and applicable laws.
The Company may be required to disclose your personal data in order to comply with applicable laws, court orders, or directives issued by governmental or regulatory authorities. This may include sharing personal data of service users with relevant authorities for the purpose of verifying user information and preventing fraud or misconduct, without obtaining your consent, or as otherwise required by law.

6. Cross-border Data Transfer

In certain circumstances, the Company may need to transfer your personal data to a foreign country. Such transfer will be carried out in compliance with the Personal Data Protection Law and under appropriate data protection measures as required by applicable law.
The Company will implement appropriate safeguards in accordance with legal requirements, which may include entering into Standard Contractual Clauses (SCCs) or relying on other lawful data transfer mechanisms, to ensure that your personal data is adequately protected in line with applicable data protection regulations.

7. Collection of Personal Data of Minors, Incompetent Persons, and Quasi-Incompetent Persons

In the event that we must process the Personal Data of minors, incompetent persons, or quasi-incompetent persons, we shall have their parents, legal representative, guardian, or curator, as the case may be, consented on behalf of them. If a minor or a quasi-incompetent person is legally permitted to give consent on their own behalf, we shall require combined consent from them and their legal representative.
If you become aware of the unauthorized collection of Personal Data from minors, incompetent persons, and quasi-incompetent persons without the consent being given in the manner according to the above, you can exercise the rights of the Data Subject as the legal representative under the PDPA.

8. Cookies

We may place cookies on your device and use them to automatically collect your Personal Data when you visit the Website.
Cookies are small pieces of data sent from a website that are stored on your computer. They help record the User’s browsing activities conducted on the company’s website, such as preferred languages, list of favorites, most common use, and other settings, to customize the Website to fit your preference and make internet browsing faster and easier.
You can customize your browser settings to block the use of cookies in order to prevent your browser from automatically accepting new cookies, but it may affect a quality of usage on the Website or difficulty in making any request or entering into any transaction with us on the Website

9. Retention Periods

  1. 9.1 9.1 The Company retains your personal data only as long as necessary to fulfill the purposes stated in this Notice. The retention period will be determined based on appropriateness and aligned with contractual terms, accounting standards, statutory prescription periods, and any legal obligations requiring the continued retention of your personal data for compliance, the establishment of legal claims, or the exercise of such legal claims.
  2. 9.2 9.2 The Company has implemented a system to review and ensure the deletion or destruction of personal data once the retention period has expired, or when the data is no longer relevant or necessary for the purposes for which it was collected.

10. Security Measures

  1. 10.1 10.1 The Company has established appropriate security measures to protect personal data, covering both physical and digital formats, including documents, electronic systems, computers, or other tools, in accordance with international standards. These measures are in place to give you confidence in the security of the Company’s personal data protection system and include safeguards against loss, unauthorized access, use, alteration, modification, or disclosure of personal data, whether accidental or unlawful.
  2. 10.2 10.2 The Company restricts access and uses security technologies to prevent unauthorized access or cyberattacks on its computer and electronic systems. When your personal data is disclosed to external parties for processing or to data processors, the Company will ensure such parties are appropriately supervised and act in compliance with the Company’s instructions.

11. User’s Rights as the Data Subject

  1. 11.1 Under the PDPA you, as the Data Subject, are entitled to
    1. Request access to, or copies of, your Personal Data collected, used and disclosed by the company.
    2. Request receive or transfer of your Personal Data, in a form collected by us and readable, usable, and disclosable in an electronic format, to another party (the company reserves the right to charge you a fee, the amount of which is at our discretion.)
    3. Object to the collection, use, and/or disclosure of Personal Data to the extent permitted by law.
    4. Have your Personal Data deleted, destroyed, or anonymized by any method permitted by law.
    5. Sequester your Personal Data from further use by any method unless the law provides otherwise.
    6. Withdraw your consent given us at any time, unless otherwise restricted by law or contracts. Your withdrawal will not extend to Personal Data to which you have granted consent for processing.
    7. File a complaint with the competent officer authorized under the PDPA in the event that you believe we have violated, or do not comply with, the PDPA.
  2. 11.2 We will endeavor to maintain the accuracy and completeness of your Personal Data. When there is a change or modification to your Personal Data or when you detect that your Personal Data is incorrect, you have the right to make corrections thereto.
  3. 11.3 The exercise of your rights specified above must comply with law. We reserve the right to refuse any request on grounds permitted by law. In the event that we deny your request, the request and reasons for denial will be recorded in the Personal Data processing record as required by law.
  4. 11.4 To exercise your right, you may contact us via the contact information provided hereunder. We will process your request and then inform you of the result within 30 days from the date of receiving your request. Where we refuse your request, you will be informed of the reason accordingly.

12. Notifications, Reminders, and Location Settings

The company may deliver a notification or reminder to your device. You can opt out of receiving these messages at any time by setting up notifications on your device or by adjusting the notification settings on the Application or by changing the notification settings on your mobile in the notification setting and in the Application.

13. Links To Third Parties

Some of the company’s online services may contain links to third-party applications or websites. Access to and usage of such applications or websites shall be governed by the privacy notice of such third party. We refuse to be held liable to the User if such applications or websites do not comply with or operate in accordance with a third party’s privacy notice.

14. Amendment to this Privacy Notice

The Company may review, amend, or update this Privacy Notice from time to time to ensure its consistency with relevant practices, laws, regulations, and legal requirements. In the event of any changes to this Notice, the Company will notify you by publishing the updated version through channels designated by the Company as soon as practicable. Your continued use of the services following the publication of any changes to this Notice shall be deemed as your acceptance of such changes.

15. Contact Information

Should you wish to exercise any of your legal rights under applicable data protection laws as outlined above, or if you have any questions, concerns, suggestions, or complaints regarding this Privacy Notice, you may contact the Company through the following channels:

LIFESTYLETECH SOLUTION CO., LTD.
6th floor, Bumrungrad Academy Building, Sukhumvit Soi 3 (Nana Nua), Sukhumvit Road, Khlong Toei Nua, Vadhana, Bangkok 10110

Data Protection Officer (DPO)
Email: dpo@bumrungrad.com