Privacy Statement

1. Introduction

This Privacy Statement explains how EverBuddy (“EverBuddy”, “we”, “us” or “our”) collects, holds, processes, uses, discloses, transfers and protects personal data when you:

• visit or interact with our website;
• use our CareCall service;
• contact us by telephone, email, web form, SMS or other communication channels;
• communicate with us through WhatsApp where this functionality is available;
• participate in a pilot, research project, programme or other EverBuddy activity to which this Privacy Statement applies; or
• otherwise interact with EverBuddy.

We are committed to handling personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”), including the applicable Data Protection Principles.

Where a particular service, research project or programme has a separate Personal Information Collection Statement (“PICS”), participant information sheet, consent form or privacy notice, that document should be read together with this Privacy Statement.

2. Privacy Officer

Questions, requests or complaints concerning personal data may be directed to:

Privacy Officer: Daven CHU

Email: enquiry.everbuddy@gmail.com

3. Personal Data We May Collect

Depending on the services you use, we may collect:

Identity and profile information

• name;
• preferred name;
• age or age range;
• date of birth where necessary;
• language preference;
• account or participant identifier;
• relationship to a family member, caregiver or service user; and
• information voluntarily provided through your profile.

Contact information

• telephone or mobile number;
• email address;
• address where relevant;
• WhatsApp contact details;
• nominated contact or caregiver information; and
• communication preferences.

CareCall and communication information

Depending on the configuration of the service, we may process:

• telephone numbers;
• call dates and times;
• call duration;
• routing information;
• call status;
• technical and service logs;
• information you provide during conversations;
• transcripts or summaries where the relevant functionality is enabled;
• voice or acoustic information where specifically notified; and
• records of consent, withdrawal or requests to cease contact.

Not every CareCall interaction is necessarily recorded.

If a service records a call, generates a transcript, performs voice analysis or otherwise processes the contents of a communication, we will provide an appropriate notice where required.

Wellbeing and care-related information

Where relevant to the service, information may include:

• daily routines;
• wellbeing or mood;
• social activities;
• sleeping or eating patterns;
• appointments;
• reminders;
• care preferences;
• support needs; and
• other information voluntarily discussed with EverBuddy.

Specific health-related, research or assessment data will be subject to an appropriate service-specific notice and, where required, consent.

Website and device information

We may collect:

• IP address;
• browser type;
• device type;
• operating system;
• pages viewed;
• access dates and times;
• cookie identifiers;
• referral information; and
• diagnostic or security information.

Enquiries

If you use our Contact Us function, we may collect:

• name;
• contact details;
• organisation;
• enquiry;
• attachments;
• correspondence history; and
• information reasonably required to respond.

4. Whether Providing Data Is Voluntary

Unless otherwise stated, the provision of personal data is voluntary.

However, certain information may be necessary to:

• provide CareCall;
• respond to your request;
• contact you;
• authenticate an account;
• provide a requested service;
• ensure security; or
• comply with applicable legal obligations.

If required information is not provided, we may be unable to provide the relevant service.

5. How We Use Personal Data

We may use personal data for:

Providing our services

Including:

• providing CareCall;
• making or receiving communications;
• providing agreed reminders;
• responding to enquiries;
• maintaining service preferences;
• customer support; and
• administering accounts or programmes.

Personalisation

Including:

• remembering communication preferences;
• maintaining continuity between interactions;
• adapting authorised functions to user needs; and
• improving accessibility.

AI-supported functions

Our technology may use artificial intelligence for purposes including:

• speech-to-text conversion;
• natural-language processing;
• conversation summarisation;
• extracting reminders or relevant events;
• categorising information;
• identifying permitted interaction patterns;
• service quality review; and
• supporting human review.

Unless expressly stated otherwise, EverBuddy's AI services do not constitute medical diagnosis or treatment.

Safety, security and service quality

We may process information to:

• identify technical problems;
• investigate complaints;
• prevent fraud or misuse;
• protect users and systems;
• conduct security monitoring; and
• maintain quality standards.

Research and improvement

Subject to applicable notices, consent requirements and governance procedures, we may use appropriately minimised, pseudonymised, aggregated or anonymised information for:

• product development;
• statistical analysis;
• service evaluation;
• research;
• model evaluation;
• reliability testing; and
• improving our services.

6. CareCall and Twilio

CareCall may use services provided by Twilio Inc. and/or its affiliates (“Twilio”).

Depending on how CareCall is configured, Twilio may process:

• telephone numbers;
• communication routing information;
• call or messaging metadata;
• service logs;
• communications information; and
• communication content where necessary for an activated service feature.

Information may be processed or stored outside Hong Kong.

Where Twilio or another service provider processes personal data on our behalf, EverBuddy will seek to apply appropriate contractual, organisational and technical safeguards.

7. WhatsApp

EverBuddy may offer communication through WhatsApp.

Use of WhatsApp is optional unless expressly stated otherwise.

If you communicate with us through WhatsApp:

• your telephone number and messages may be processed through WhatsApp;
• WhatsApp and Meta entities may process information in accordance with their own policies;
• information may be processed outside Hong Kong;
• authorised EverBuddy personnel may access messages where necessary to respond; and
• WhatsApp's own terms and privacy policies will apply.

Consent to use EverBuddy services does not automatically constitute consent to receive marketing communications through WhatsApp.

8. Disclosure and Transfer of Personal Data

Personal data may be disclosed where reasonably necessary to:

• EverBuddy personnel;
• Twilio or other communications providers;
• cloud and hosting providers;
• IT and cybersecurity providers;
• messaging providers;
• professional advisers;
• authorised research or academic partners;
• authorised care or service organisations;
• regulators, courts or law-enforcement authorities where legally required; and
• other persons specifically notified to you or authorised by you.

EverBuddy does not intend to sell personal data as a standalone commercial product.

9. Cross-Border Processing

Some of our service providers may operate infrastructure outside Hong Kong.

Personal data may therefore be stored or processed in other jurisdictions.

Where appropriate, EverBuddy will seek to use safeguards such as:

• contractual protections;
• confidentiality obligations;
• access controls;
• data minimisation;
• encryption;
• vendor due diligence; and
• security requirements.

10. Consent

Where consent is required, EverBuddy aims to ensure that consent is:

• clear;
• sufficiently specific;
• understandable; and
• separated from unrelated optional purposes where appropriate.

In particular:

• marketing consent should be optional;
• WhatsApp contact may be optional;
• research participation should be separately addressed; and
• call recording or additional analysis should be separately notified where applicable.

11. Withdrawal and Exit Mechanisms

CareCall

You may end a CareCall interaction at any time by hanging up.

Where supported, you may also state that you wish to stop the conversation.

Stopping future calls

Where future calls are optional, you may request that EverBuddy stops contacting you through CareCall by contacting:

Daven CHU, Privacy Officer

enquiry.everbuddy@gmail.com

Withdrawal of optional consent

You may withdraw optional consent by contacting us.

Withdrawal applies prospectively and does not automatically invalidate processing already carried out lawfully before withdrawal.

WhatsApp

You may stop WhatsApp communications by:

• asking EverBuddy to stop;
• ceasing the conversation;
• using WhatsApp controls; or
• blocking the relevant account.

Account or service closure

Where applicable, you may request account or service closure by contacting us.

EverBuddy will delete, anonymise or restrict information when it is no longer required, subject to applicable legal, security, operational and record-retention requirements.

12. Direct Marketing

EverBuddy will comply with applicable requirements under the PDPO concerning direct marketing.

Acceptance of our Terms and Conditions does not by itself constitute consent to receive direct marketing.

Where required, we will inform you of:

• the personal data to be used;
• the types of products, services or subjects to be marketed;
• the communication channels; and
• your right to refuse or withdraw consent.

You may opt out at any time without charge.

13. Cookies

Our website may use cookies or similar technologies for:

• essential website functionality;
• security;
• user preferences;
• analytics;
• service improvement; and
• other disclosed purposes.

Where appropriate, users may be provided with cookie preference controls.

14. Data Retention

EverBuddy will not retain personal data longer than reasonably necessary for the relevant purpose or a directly related purpose, subject to:

• legal requirements;
• security requirements;
• operational needs;
• dispute resolution;
• research obligations; and
• record-keeping requirements.

Where data is no longer required, we may:

• securely delete it;
• anonymise it; or
• restrict access to it.

15. Security

EverBuddy takes reasonably practicable steps to protect personal data.

Measures may include:

• authentication;
• role-based access controls;
• encryption;
• secure cloud configuration;
• confidentiality obligations;
• monitoring;
• logging;
• backups;
• vulnerability management; and
• incident-response procedures.

No information system can be guaranteed to be completely secure.

16. AI and Automated Processing

EverBuddy may use AI and automated processing.

We aim to apply appropriate governance concerning:

• intended use;
• data minimisation;
• data quality;
• reliability;
• human oversight;
• security;
• transparency; and
• risk management.

AI-generated information should not be regarded as a medical diagnosis, clinical conclusion or emergency decision unless expressly stated otherwise by an appropriately authorised service.

17. Emergencies

EverBuddy and CareCall are not emergency services.

Do not rely on EverBuddy, CareCall, AI tools, WhatsApp or our website for emergency assistance.

In an emergency, contact the appropriate local emergency service or qualified professional.

18. Access and Correction Rights

Subject to the PDPO, you may request:

• confirmation as to whether EverBuddy holds personal data about you;
• access to personal data held about you; and
• correction of inaccurate personal data.

Requests may be submitted to:

Daven CHU

Privacy Officer, EverBuddy

Email: enquiry.everbuddy@gmail.com

We may request sufficient information to verify your identity.

19. Deletion Requests

Hong Kong law should not be interpreted as providing an unlimited GDPR-style right to erasure.

However, you may ask EverBuddy to delete information concerning you.

We will consider whether the information:

• remains necessary;
• must be retained by law;
• is needed for security or dispute purposes;
• is part of an authorised research record; or
• may appropriately be anonymised.

20. Changes to This Statement

We may update this Privacy Statement from time to time.

The latest version will be published on our website.

Where a proposed change materially affects the intended use of previously collected personal data, EverBuddy will take additional steps where required by applicable law.

21. Contact and Complaints

For privacy questions, data access or correction requests, consent withdrawal, opt-out requests or complaints:

Privacy Officer: Daven CHU

Email: enquiry.everbuddy@gmail.com

You may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong where appropriate.