Privacy Policy

1. Who this Policy covers, and where we operate

This Policy applies to you if you have signed up to our waitlist, contacted us, registered for the platform, or are using it.

Pattern is available only to individuals aged 18 or over who are resident in Singapore. Before you begin our health assessment we ask for your date of birth and country of residence. If you are under 18, or resident outside Singapore, we do not proceed and we do not store anything about you.

2. Personal data we collect

"Personal data" means data, whether true or not, about an individual who can be identified from that data, or from that data combined with other information to which we have or are likely to have access.

Depending on how you interact with Pattern, we may collect the following categories of personal data. Each is a category, described by what it includes, not a fixed list:

• Identity and contact information: including your email address, your date of birth, which we take when we check your age, your WhatsApp contact number, your delivery address, and, where you have chosen to receive WhatsApp messages from us, a mobile number for that purpose. We do not hold a name on your account itself. Your first name comes from an answer you give in the questionnaire, and when you reserve a blood panel we collect a first and last name for the clinic booking.
• Account information: including your account record, membership status, preferences, and communication settings.
• Health and wellness information you provide: the health information you choose to share with us, including your self-reported symptoms and how severe they are, your life stage (for example actively trying to conceive, pregnancy, postpartum, or perimenopausal), your cycle tracking (the days you record bleeding and the date each period started), your habit and lifestyle tracking such as nutrition, sleep, stress, and movement, the journal entries you write, your answers in our health assessment, and your health goals.
• Information we derive from what you tell us: including your symptom domains, focus areas, and other outputs we generate from your assessment answers.
• Lab and test data: including test orders you place through Pattern, and the test results and practitioner notes you choose to upload to your account.
• Practitioner information: including the type of support you are looking for, and any message you write when requesting an introduction.
• Payment and billing information: handled by our payment provider. We do not store full payment card details on our systems.
• Usage information: including which screens you open, which features you use, which test panels you view or order, and similar interactions with the platform.
• Device and browsing information on our marketing website: including your IP address, device and browser type, the pages you visit, the site that referred you, and cookie identifiers set in your browser. See Sections 8 and 9.

Health information is treated with heightened care. We collect only what is necessary to deliver the service you have asked for, and it is held in our primary database in Singapore. It is not sent to our analytics or marketing tools. See Sections 8 and 9.

3. How we collect personal data, and when we ask

We generally do not collect your personal data unless you provide it to us voluntarily, after you have been notified of the purposes of collection, or where collection and use without consent is permitted or required under the PDPA.

We tell you what we are doing before we collect it. A notice appears before our health assessment begins, and each point at which we share information with someone outside Pattern has its own separate request for your permission.

Permissions we ask for:

We do not pre-tick any of these. The optional ones never prevent you from proceeding.

We will seek your consent again before collecting additional personal data, or using your personal data for a purpose that has not been notified to you, except where permitted or authorised by law.

4. How we use personal data

• To provide, operate, and maintain the platform and the services you have asked for, including producing your assessment results and your care plan, and tracking your symptoms and habits over time.
• To take and fulfil test orders, including passing the information described in Section 5 to our partner clinic or testing partner.
• To display test results and practitioner notes on your account where you have uploaded them.
• To introduce you to independent care practitioners where this is part of your membership.
• To respond to your queries, requests, complaints, and feedback.
• To manage your account and your relationship with us.
• To process payments and billing.
• To send you service-related communications, such as order updates, consult reminders, account notices, security alerts, and changes to this Policy.
• With your permission, to send you marketing communications, health insights, and product updates.
• To understand how the platform is used and to improve it. See Section 8.
• To comply with applicable laws and lawful requests from authorities.
• To detect, prevent, and address fraud, misuse, and security issues.

5. Who we share personal data with

Our partner clinics. Where you reserve a blood panel, we share your name, email address, and WhatsApp number, the tests you have selected, the date of your order, and an order reference with the partner clinic handling your consult and the reviewing physician, so they can prepare. The clinic uses these details to manage your booking, and updates the progress of your order so that you can see it in your app. Our partner clinics are licensed medical clinics operating in Singapore, and the clinic handling your booking is named to you before you confirm it. The current list is at patternhealth.app/privacy/partners.

If you have separately agreed, we also share your assessment with the clinic before your consult, so the doctor has context. This includes your symptoms and the severity ratings you gave them, your life stage, the health conditions you have told us about, your answers to the other health questions in your assessment, and whether you have had a health screening in the last year and said its results were normal, which is self-reported. It also includes your focus areas, which are Pattern's own grouping of your answers for context and not a clinical assessment. This sharing is optional, you can withdraw it in Profile, which stops any future sharing, and it never affects your booking.

Once the clinic and the reviewing physician hold your order details, and any assessment you have chosen to share, their own retention and privacy practices apply to their copy.

Our testing partners. When you order a test from our functional testing partner, whether a mail-in kit or an in-person blood draw at their location, we share your name, WhatsApp number, and, for a mail-in kit, your delivery address, so they can set up your order. The current list is at patternhealth.app/privacy/partners. You order and pay for the test directly with them, and their own privacy policy governs that order. Pattern does not take payment for these tests.

Independent care practitioners. Where you ask to be matched, we send you a shortlist of suitable practitioners and their details, and you decide whether to contact them. We do not send your information to a practitioner. You can give us permission in advance to share your assessment answers and any test results on file with a practitioner, but only if you later go ahead with an introduction, and never before. That permission shares nothing at the time you give it, it would apply only to an introduction you choose to make in future, and you can withdraw it at any time in Profile. Practitioners are independent third parties who contract directly with you, and their handling of your personal data is governed by their own terms.

Service providers who process personal data on our behalf. We use providers for database hosting and file storage, application hosting, payment processing, product analytics, service email, marketing email, office and collaboration tools, and internal operational alerts. Each is named, with the country it operates in, at patternhealth.app/privacy/partners.

All health information is held in our primary database in Singapore. Our internal operational alerts tell our team when something needs attention, such as a new order, a practitioner match request, or a consent withdrawal or data request. They contain no name, email address, or contact details. They do carry the details of the event itself, such as the tests ordered, the amount paid, the kind of support requested, or the type of request, together with an internal reference that lets us find the right record.

Advertising platforms. Google and Meta receive browsing information from our marketing website, as described in Section 9. They use it for their own purposes as well as ours. They are named, with the country they operate in, at patternhealth.app/privacy/partners.

Professional advisers, such as our legal, accounting, and audit advisers, where necessary.

Governmental, regulatory, or law enforcement authorities, where required or permitted by law.

Third parties in a corporate transaction, such as a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

We do not sell your personal data.

6. Where we rely on an exception rather than consent

In limited circumstances the PDPA permits us to collect, use, or disclose personal data without consent. We rely on two exceptions.

Legitimate interests. For fraud detection and prevention, detection and prevention of misuse of our services, and protection of our platform and data from unauthorised access and security threats. Before relying on this exception we assess the likely adverse effects on you and satisfy ourselves that our legitimate interests outweigh them. These purposes may continue for a reasonable period after your relationship with us ends.

Business improvement. For understanding how the platform is used and improving and developing our services, as described in Section 8.

We do not rely on either exception for advertising. Advertising is dealt with separately in Section 9.

7. Aggregated and anonymised information

We may produce aggregated statistics and insights from the information our users provide, such as how often particular symptoms occur together across our user base. This information is aggregated so that no individual can be identified from it, and it is not personal data once anonymised. We may retain and use it, including after your account is closed.

We do not currently use personal data for research purposes beyond improving our own product. If that changes, we will tell you and seek your consent before doing so.

8. Usage information, analytics, and cookies

We use analytics to understand how people move through the platform: which screens are opened, which features are used, which test panels are viewed or ordered, and where people stop. We use this to decide what to build and what to fix. This is the business improvement exception described in Section 6, and we do not ask for your consent to it.

Our analytics never include your symptoms, symptom domains, focus areas, life stage, assessment answers, test results, journal entries, or the contents of any document you upload. That information stays in our primary database in Singapore.

Additional limits we apply:

• No health-related information is attached to your analytics profile in any form.
• IP addresses are discarded before storage, and location lookup from IP address is switched off.
• Session recording is switched off. We do not record your screen.
• Your email address is never sent to our analytics provider.
• Page addresses are reduced to generic patterns so that no identifier appears in them.
• Analytics information is used for our own product decisions only. We do not send it to advertising platforms or any other third party.

Our analytics provider stores this information in the European Union and retains it for 12 months.

Cookies and similar technologies. We use cookies and browser storage that are necessary to keep you signed in, remember your preferences, and support the analytics described above. Our marketing website also uses advertising cookies, described in Section 9.

9. Advertising

We advertise Pattern on Google and on Meta's platforms, including Facebook and Instagram. To understand which advertising works, our marketing website includes measurement tags supplied by those two companies.

What they receive: the pages you visit on our marketing website, the site that referred you, your device and browser type, your IP address, and a cookie identifier set in your browser.

What they do not receive today: your name, your email address, your telephone number, or any information you have given us. We do not currently use the features that would allow these platforms to match you to an account you hold with them.

What we have excluded. These tags do not appear on our health assessment or on our policy pages. They are present on the pages that carry our waitlist form, but they are not able to read anything you type into it, so nothing you enter into that form is transmitted. No answer you give us about your health is ever associated with an advertising identifier.

Google and Meta use the information they collect for their own purposes as well as ours, which means they are not simply acting on our instructions.

We use these tags to measure how our advertising performs, and we may also use them to show Pattern advertising to people who have visited our website. Where you have agreed to it, we may share a one-way encrypted version of your email address with these platforms so that they can measure whether an advertisement led to a sign-up. We will never share anything that reveals your symptoms, your assessment answers, your results, or anything else about your health.

We tell you here, and in our cookie notice, that these tags are present. You can stop them at any time by:

• Using your browser's cookie settings to block or delete third-party cookies.
• Using the advertising controls in your Google account and your Meta account.
• Using your device's tracking settings.

We do not use these tags inside the Pattern app. The app contains no advertising or third-party tracking of any kind.

10. Marketing communications

We send marketing communications only where you have given permission for that channel. We ask separately for email and for WhatsApp, and each can be turned off independently.

You can withdraw at any time:

• In the app: Profile, then Privacy and data.
• By email: by using the unsubscribe link in any marketing email, or by contacting our Data Protection Officer using the details in Section 20.

Withdrawing marketing permission does not affect service-related communications about your account, orders, or consults. Those are necessary to deliver the service you have asked for and are not marketing.

Our marketing tool holds your email address, first name, your stage in our lifecycle, and the date of your permission. It does not hold any health information.

11. Your choices and controls

The following are available in the app, under Profile, then Privacy and data:

• Turn marketing emails on or off
• Turn WhatsApp marketing messages on or off
• See what you have shared with our partner clinic, and withdraw it
• See your permission for test result storage, and withdraw it
• See your permission to share with a practitioner, and withdraw it
• Request a copy of the personal data we hold about you
• Request a correction
• Request deletion of your account
• See which version of this Policy and our Terms you accepted, and when
• Contact our Data Protection Officer

You can also make any of these requests in writing to our Data Protection Officer at the address in Section 20.

12. Withdrawing your consent

Your consent remains valid until you withdraw it. You may withdraw consent for any or all of the purposes described in this Policy, either using the controls in Section 11 or by writing to our Data Protection Officer.

We will generally process a withdrawal request within ten (10) business days, and we will tell you the likely consequences before completing it.

What withdrawal does and does not do. Withdrawing stops us sharing or using your information from that point onwards. It cannot recall information that has already been shared. For example, if you withdraw permission for us to share your assessment answers with a clinic after they have already been sent, the clinic will already hold them, and their own retention and privacy practices will apply.

Withdrawing consent may mean we can no longer provide some or all of our services to you. We will tell you if that is the case before we act on your request. Withdrawal does not affect our right to continue collecting, using, or disclosing personal data where this is permitted or required by law.

13. Access to and correction of your personal data

You may ask us for:

• A copy of the personal data we hold about you, and information about how we have used or disclosed it in the year before your request.
• Correction of any personal data that is inaccurate or incomplete.

Use the controls in Section 11, or write to our Data Protection Officer.

We will respond as soon as reasonably possible, and generally within thirty (30) days. If we cannot respond within that time, we will tell you in writing when we will. If we are unable to provide the data or make the correction, we will generally tell you why, except where the PDPA does not require us to.

A reasonable fee may be charged for an access request. If so, we will tell you the fee before we proceed.

14. Deleting your account

You may ask us to delete your account at any time, using the control in Section 11 or by writing to our Data Protection Officer. You can see your request and its due date on the same screen. We will confirm and action your request within thirty (30) days.

What we delete. We remove the health information you gave us and everything we built from it:

• your assessment and all of your answers, and the symptom domains and results we derived from them;
• your daily symptom and habit tracking, your cycle tracking, your journal entries, and the tracking choices you set;
• any test results and the files you uploaded, and any practitioner notes on your account;
• any practitioner introductions, matches, and proposals, and the text of any support request you wrote;
• your contact in our marketing tool and your record in our analytics tool;
• your personal details in the order records we share with our partner clinic, which are your name, email address, and WhatsApp number. The order code, date, and the tests ordered remain in those records without them.

What we keep, and why.

• A minimal record of your orders and payments, with health details removed, because tax and accounting law requires us to keep transaction records.
• The record of the permissions you gave and withdrew, the wording you were shown, and any data request you made, because this is our evidence that we handled your data lawfully. Evidence like this has to show who agreed to what, so it keeps an identifiable email address for you.
• Your account record, kept but stripped: we clear the details that identify you and keep only your email address, so that the records above resolve to you and we recognise you if you contact us again.
• Separately, on our marketing suppression list we keep a one-way encrypted version of your email address that cannot be read back, so that we do not contact you again after you have asked us to stop.

Where our reach ends. Some information has already left Pattern, and we cannot delete it for you.

• Your partner clinic. Anything already sent to the clinic and the reviewing physician for a blood order, whether the order details or, where you agreed, your assessment, has been received by a separate organisation. We will ask them in writing to delete what they hold, and we will tell you that we have asked, but we cannot delete it for them. What happens to it afterwards is governed by the clinic's own privacy and retention practices, not ours.
• Our payment processor. Our payment processor keeps its own record of your payments under its own retention. Deleting your account does not reach those records.

Backups. Our systems keep encrypted backups for a limited period as protection against data loss. Deleted information may remain in a backup until that backup expires on its normal cycle. Backups are not used to restore deleted information into the live service.

15. How long we keep personal data

We keep personal data only for as long as it is necessary for the purpose it was collected for, or as required or permitted by law. Our retention periods are:

We will cease to retain your personal data, or remove the means by which it can be associated with you, as soon as it is reasonable to assume that retention no longer serves the purpose for which it was collected and is no longer necessary for legal or business purposes.

16. Transfers of personal data outside Singapore

Pattern is operated from Singapore, and our primary database, which holds your health information, is hosted in Singapore.

Some of our service providers, and some of the categories of recipient described in Section 5, operate outside Singapore. Each is named, with the country it operates in, at patternhealth.app/privacy/partners. Where we transfer personal data outside Singapore, we take reasonable steps to ensure the recipient is bound by legally enforceable obligations to provide a standard of protection at least comparable to that under the PDPA, including through data processing agreements with those providers.

17. How we protect personal data

We have implemented administrative and technical measures to safeguard personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal, and similar risks. These include:

• Collecting only the personal data necessary for the purposes described in this Policy.
• Encryption of personal data in transit and at rest.
• Access controls that restrict each user's information to that user, with access by Pattern personnel limited to those who need it to support your account, to fulfil an order, or to keep the platform safe.
• Records of permissions that cannot be altered or deleted, so that what you agreed to cannot be rewritten.
• Confidentiality obligations on our personnel and our service providers.
• Regular review of our own security practices and those of our service providers.

No method of transmission or storage is completely secure. We continue to review and improve our security measures.

18. Accuracy of personal data

We rely on the personal data you provide. Please keep it up to date, either in your account or by contacting our Data Protection Officer.

19. Children and minors

Pattern is intended for individuals aged 18 and over, and we ask for your date of birth before our health assessment begins. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently done so, please contact our Data Protection Officer and we will delete it.

20. Data Protection Officer

You may contact our Data Protection Officer with any question, request, or complaint about how we handle personal data:

Email: hellopatternhealth@gmail.com

If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore.

21. Changes to this Policy

This Policy applies together with any other notices, contractual clauses, and consent clauses that apply to our collection, use, and disclosure of your personal data.

We may revise this Policy from time to time. Each version carries an effective date, and previous versions remain available at patternhealth.app/privacy/versions so that you can see what you agreed to and what has changed.

The companies we share personal data with change from time to time. The current list is maintained at patternhealth.app/privacy/partners with its own date, and adding a partner of a kind already described in this Policy does not require a new version of it.

We will take reasonable steps to notify you of material changes, for example by email or by a notice in the platform, before they take effect. Where a change introduces a new purpose, a new category of recipient, or a transfer to a country not previously used, we will update this Policy and seek your consent again rather than relying on notice alone.