Privacy Policy

1. Who this Policy covers, and where we operate

This Policy applies to you if you have signed up to our waitlist, contacted us, registered for the platform, or are using it.

Pattern is available only to individuals aged 18 or over who are resident in Singapore. Before you begin our health assessment we ask for your date of birth and country of residence. If you are under 18, or resident outside Singapore, we do not proceed and we do not store anything about you.

2. Personal data we collect

"Personal data" means data, whether true or not, about an individual who can be identified from that data, or from that data combined with other information to which we have or are likely to have access.

Depending on how you interact with Pattern, we may collect:

• Identity and contact information: name, email address, date of birth, contact number, delivery address, and where you have chosen to receive WhatsApp messages from us, a mobile number for that purpose.
• Account information: your account record, membership status, preferences, and communication settings.
• Health and wellness information you provide: self-reported symptoms and symptom severity, symptom history, life stage, habit and lifestyle tracking (including nutrition, sleep, stress, and movement), your responses to our health assessment, journal entries, and health goals.
• Information we derive from what you tell us: your symptom domains, root system results, and related outputs generated from your assessment answers.
• Lab and test data: test orders you place through Pattern, and test results or practitioner notes you choose to upload to your account.
• Practitioner information: the type of support you are looking for, and any message you write when requesting an introduction.
• Payment and billing information: handled by our payment provider. We do not store full payment card details on our systems.
• Usage information: which screens you open, which features you use, which test panels you view or order, and similar interactions with the platform.
• Device and browsing information on our marketing website: IP address, device and browser type, the pages you visit, the site that referred you, and cookie identifiers set in your browser. See Sections 8 and 9.

Health information is treated with heightened care. We collect only what is necessary to deliver the service you have asked for, and it is held in our primary database in Singapore. It is not sent to our analytics or marketing tools. See Sections 8 and 9.

3. How we collect personal data, and when we ask

We generally do not collect your personal data unless you provide it to us voluntarily, after you have been notified of the purposes of collection, or where collection and use without consent is permitted or required under the PDPA.

We tell you what we are doing before we collect it. A notice appears before our health assessment begins, and each point at which we share information with someone outside Pattern has its own separate request for your permission.

Permissions we ask for:

We do not pre-tick any of these. The optional ones never prevent you from proceeding.

We will seek your consent again before collecting additional personal data, or using your personal data for a purpose that has not been notified to you, except where permitted or authorised by law.

4. How we use personal data

• To provide, operate, and maintain the platform and the services you have asked for, including producing your assessment results and your care plan, and tracking your symptoms and habits over time.
• To take and fulfil test orders, including passing the information described in Section 5 to our partner clinic or testing partner.
• To display test results and practitioner notes on your account where you have uploaded them.
• To introduce you to independent care practitioners where this is part of your membership.
• To respond to your queries, requests, complaints, and feedback.
• To manage your account and your relationship with us.
• To process payments and billing.
• To send you service-related communications, such as order updates, consult reminders, account notices, security alerts, and changes to this Policy.
• With your permission, to send you marketing communications, health insights, and product updates.
• To understand how the platform is used and to improve it. See Section 8.
• To comply with applicable laws and lawful requests from authorities.
• To detect, prevent, and address fraud, misuse, and security issues.

5. Who we share personal data with

Our partner clinics. Where you reserve a blood panel, we share your name, contact number, and the tests you have selected with the partner clinic handling your consult and the reviewing physician, so they can prepare. Our partner clinics are licensed medical clinics operating in Singapore, and the clinic handling your booking is named to you before you confirm it. The current list is at patternhealth.app/privacy/partners. If you have separately agreed, we also share your assessment answers. That is optional and never affects your booking.

Our testing partners. Where you order a mail-in test kit, we share your name, delivery address, and contact number with the testing partner so they can set up your order. The current list is at patternhealth.app/privacy/partners. You order and pay for the kit directly with them, and their own privacy policy governs that order. Pattern does not take payment for mail-in kits.

Independent care practitioners. Where you ask to be matched, we send you a shortlist of practitioners and their details, and you contact them directly. We do not send your information to any practitioner. Practitioners are independent third parties who contract directly with you, and their handling of your personal data is governed by their own terms.

Service providers who process personal data on our behalf. We use providers for database hosting and file storage, application hosting, payment processing, product analytics, service email, marketing email, and internal operational alerts. Each is named, with the country it operates in, at patternhealth.app/privacy/partners.

All health information is held in our primary database in Singapore. Our internal operational alerts contain an order reference only and no information about you.

Advertising platforms. Google and Meta receive browsing information from our marketing website, as described in Section 9. They use it for their own purposes as well as ours. They are named, with the country they operate in, at patternhealth.app/privacy/partners.

Professional advisers, such as our legal, accounting, and audit advisers, where necessary.

Governmental, regulatory, or law enforcement authorities, where required or permitted by law.

Third parties in a corporate transaction, such as a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

We do not sell your personal data.

6. Where we rely on an exception rather than consent

In limited circumstances the PDPA permits us to collect, use, or disclose personal data without consent. We rely on two exceptions.

Legitimate interests. For fraud detection and prevention, detection and prevention of misuse of our services, and protection of our platform and data from unauthorised access and security threats. Before relying on this exception we assess the likely adverse effects on you and satisfy ourselves that our legitimate interests outweigh them. These purposes may continue for a reasonable period after your relationship with us ends.

Business improvement. For understanding how the platform is used and improving and developing our services, as described in Section 8.

We do not rely on either exception for advertising. Advertising is dealt with separately in Section 9.

7. Aggregated and anonymised information

We may produce aggregated statistics and insights from the information our users provide, such as how often particular symptoms occur together across our user base. This information is aggregated so that no individual can be identified from it, and it is not personal data once anonymised. We may retain and use it, including after your account is closed.

We do not currently use personal data for research purposes beyond improving our own product. If that changes, we will tell you and seek your consent before doing so.

8. Usage information, analytics, and cookies

We use analytics to understand how people move through the platform: which screens are opened, which features are used, which test panels are viewed or ordered, and where people stop. We use this to decide what to build and what to fix. This is the business improvement exception described in Section 6, and we do not ask for your consent to it.

Our analytics never include your symptoms, symptom domains, root system results, life stage, assessment answers, test results, journal entries, or the contents of any document you upload. That information stays in our primary database in Singapore.

Additional limits we apply:

• No health-related information is attached to your analytics profile in any form.
• IP addresses are discarded before storage, and location lookup from IP address is switched off.
• Session recording is switched off. We do not record your screen.
• Your email address is never sent to our analytics provider.
• Page addresses are reduced to generic patterns so that no identifier appears in them.
• Analytics information is used for our own product decisions only. We do not send it to advertising platforms or any other third party.

Our analytics provider stores this information in the European Union and retains it for 12 months.

Cookies and similar technologies. We use cookies and browser storage that are necessary to keep you signed in, remember your preferences, and support the analytics described above. Our marketing website also uses advertising cookies, described in Section 9.

9. Advertising

We advertise Pattern on Google and on Meta's platforms, including Facebook and Instagram. To understand which advertising works, our marketing website includes measurement tags supplied by those two companies.

What they receive: the pages you visit on our marketing website, the site that referred you, your device and browser type, your IP address, and a cookie identifier set in your browser.

What they do not receive today: your name, your email address, your telephone number, or any information you have given us. We do not currently use the features that would allow these platforms to match you to an account you hold with them.

What we have excluded. These tags do not appear on our health assessment or on our policy pages. They are present on the pages that carry our waitlist form, but they are not able to read anything you type into it, so nothing you enter into that form is transmitted. No answer you give us about your health is ever associated with an advertising identifier.

Google and Meta use the information they collect for their own purposes as well as ours, which means they are not simply acting on our instructions.

We use these tags to measure how our advertising performs, and we may also use them to show Pattern advertising to people who have visited our website. Where you have agreed to it, we may share a one-way encrypted version of your email address with these platforms so that they can measure whether an advertisement led to a sign-up. We will never share anything that reveals your symptoms, your assessment answers, your results, or anything else about your health.

We tell you here, and in our cookie notice, that these tags are present. You can stop them at any time by:

• Using your browser's cookie settings to block or delete third-party cookies.
• Using the advertising controls in your Google account and your Meta account.
• Using your device's tracking settings.

We do not use these tags inside the Pattern app. The app contains no advertising or third-party tracking of any kind.

10. Marketing communications

We send marketing communications only where you have given permission for that channel. We ask separately for email and for WhatsApp, and each can be turned off independently.

You can withdraw at any time:

• In the app: Profile, then Privacy and data.
• By email: by using the unsubscribe link in any marketing email, or by contacting our Data Protection Officer using the details in Section 20.

Withdrawing marketing permission does not affect service-related communications about your account, orders, or consults. Those are necessary to deliver the service you have asked for and are not marketing.

Our marketing tool holds your email address, first name, your stage in our lifecycle, and the date of your permission. It does not hold any health information.

11. Your choices and controls

The following are available in the app, under Profile, then Privacy and data:

• Turn marketing emails on or off
• Turn WhatsApp marketing messages on or off
• See what you have shared with our partner clinic, and withdraw it
• See your permission for test result storage, and withdraw it
• Request a copy of the personal data we hold about you
• Request a correction
• Request deletion of your account
• See which version of this Policy and our Terms you accepted, and when
• Contact our Data Protection Officer

You can also make any of these requests in writing to our Data Protection Officer at the address in Section 20.

12. Withdrawing your consent

Your consent remains valid until you withdraw it. You may withdraw consent for any or all of the purposes described in this Policy, either using the controls in Section 11 or by writing to our Data Protection Officer.

We will generally process a withdrawal request within ten (10) business days, and we will tell you the likely consequences before completing it.

What withdrawal does and does not do. Withdrawing stops us sharing or using your information from that point onwards. It cannot recall information that has already been shared. For example, if you withdraw permission for us to share your assessment answers with a clinic after they have already been sent, the clinic will already hold them, and their own retention and privacy practices will apply.

Withdrawing consent may mean we can no longer provide some or all of our services to you. We will tell you if that is the case before we act on your request. Withdrawal does not affect our right to continue collecting, using, or disclosing personal data where this is permitted or required by law.

13. Access to and correction of your personal data

You may ask us for:

• A copy of the personal data we hold about you, and information about how we have used or disclosed it in the year before your request.
• Correction of any personal data that is inaccurate or incomplete.

Use the controls in Section 11, or write to our Data Protection Officer.

We will respond as soon as reasonably possible, and generally within thirty (30) days. If we cannot respond within that time, we will tell you in writing when we will. If we are unable to provide the data or make the correction, we will generally tell you why, except where the PDPA does not require us to.

A reasonable fee may be charged for an access request. If so, we will tell you the fee before we proceed.

14. Deleting your account

You may ask us to delete your account at any time, using the control in Section 11 or by writing to our Data Protection Officer. We will confirm and action your request within thirty (30) days.

What we delete: your assessment and questionnaire answers, symptom and habit logs, the results we derived from them, any test results or practitioner notes you uploaded, any message content you wrote, and your record in our marketing tool.

What we keep, and why:

• A minimal record of your orders and payments, with health details removed and identifying details anonymised, because tax and accounting law requires us to keep transaction records.
• A record of the permissions you gave and withdrew, and the wording you were shown, because this is our evidence that we handled your data lawfully.
• A one-way encrypted version of your email address on our suppression list, so that we do not contact you again after you have asked us to stop.

Backups. Our systems keep encrypted backups for a limited period as protection against data loss. Deleted information may remain in a backup until that backup expires on its normal cycle. Backups are not used to restore deleted information into the live service.

15. How long we keep personal data

We keep personal data only for as long as it is necessary for the purpose it was collected for, or as required or permitted by law. Our retention periods are:

We will cease to retain your personal data, or remove the means by which it can be associated with you, as soon as it is reasonable to assume that retention no longer serves the purpose for which it was collected and is no longer necessary for legal or business purposes.

16. Transfers of personal data outside Singapore

Pattern is operated from Singapore, and our primary database, which holds your health information, is hosted in Singapore.

Some of our service providers, and some of the categories of recipient described in Section 5, operate outside Singapore. Each is named, with the country it operates in, at patternhealth.app/privacy/partners. Where we transfer personal data outside Singapore, we take reasonable steps to ensure the recipient is bound by legally enforceable obligations to provide a standard of protection at least comparable to that under the PDPA, including through data processing agreements with those providers.

17. How we protect personal data

We have implemented administrative and technical measures to safeguard personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal, and similar risks. These include:

• Collecting only the personal data necessary for the purposes described in this Policy.
• Encryption of personal data in transit and at rest.
• Access controls that restrict each user's information to that user, with access by Pattern personnel limited to those who need it to support your account, to fulfil an order, or to keep the platform safe.
• Records of permissions that cannot be altered or deleted, so that what you agreed to cannot be rewritten.
• Confidentiality obligations on our personnel and our service providers.
• Regular review of our own security practices and those of our service providers.

No method of transmission or storage is completely secure. We continue to review and improve our security measures.

18. Accuracy of personal data

We rely on the personal data you provide. Please keep it up to date, either in your account or by contacting our Data Protection Officer.

19. Children and minors

Pattern is intended for individuals aged 18 and over, and we ask for your date of birth before our health assessment begins. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently done so, please contact our Data Protection Officer and we will delete it.

20. Data Protection Officer

You may contact our Data Protection Officer with any question, request, or complaint about how we handle personal data:

Email: hellopatternhealth@gmail.com

If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore.

21. Changes to this Policy

This Policy applies together with any other notices, contractual clauses, and consent clauses that apply to our collection, use, and disclosure of your personal data.

We may revise this Policy from time to time. Each version carries an effective date, and previous versions remain available at patternhealth.app/privacy/versions so that you can see what you agreed to and what has changed.

The companies we share personal data with change from time to time. The current list is maintained at patternhealth.app/privacy/partners with its own date, and adding a partner of a kind already described in this Policy does not require a new version of it.

We will take reasonable steps to notify you of material changes, for example by email or by a notice in the platform, before they take effect. Where a change introduces a new purpose, a new category of recipient, or a transfer to a country not previously used, we will update this Policy and seek your consent again rather than relying on notice alone.