Privacy Policy

Scope and consent

By registering a Yuhox account, signing in to product sites, submitting a contact form, downloading software or using our online services, you confirm that you have read and agree to this policy. If you do not agree, stop using the relevant services. This policy does not apply to business data you manage through Yuhox products and deploy in your own environment (for example device transactions or care records in an on-premises deployment); the controller of that data is your organization.

Roles on Yuhox Uni.The platform is a software tool used by elder care facilities, canteens, schools, communities and similar organizations; the care, meal delivery, course and other services you see on it are provided by specific organizations. For personal information generated there, the processor falls into two cases:
· Information you enter yourself when registering an account, we are the handler and this policy applies in full;
· Records generated while receiving services from an organization(care records, health files, spending ledgers, rosters), the handler isthat organization, and we only provide technical processing on its instructions and do not use the data for any purpose beyond what the organization authorizes.
In either case, you can come to us first: for matters belonging to the organization, we pass on your request, tell you the organization's contact details and processing deadline, and follow up until there is a result. We will not pass you back and forth.

Roles on Yuhox Tongo.Tongo is a collaboration tool. Projects, tasks, progress and discussion are organized by the people using the service. Personal information arising from this has two kinds of processors:
· Information you enter yourself when registering an account, we are the handler and this policy applies in full;
· collaboration content you create in a project(tasks, plans, progress reports, comments, uploaded files, memberships). If the project is organized by your organization or its owner, the handler isthat organization or project lead; we only process it as technically needed to provide the service, and not for any purpose beyond the project's authorization. If you created the project yourself and use it personally, we process it to provide the service you requested.
In either case, you can come to us first: if it belongs to a project or organization, we will forward it, tell you how to reach them and the handling timeline, and follow through until there is a result.

What information we collect

Account information.At registration we collect your email, name and the password you set (stored as an irreversible hash; we cannot see the plain text). Phone number and avatar are optional. If you sign in with WeChat, Alipay or Douyin, we only keep the open-platform identifier needed to recognise you; we do not read friends, feeds or payment records.

Network logs for registration and sign-in.On sign-up, sign-in, sign-out and password change we record the IP address, the browser User-Agent, a device identifier we issue (a long-lived cookie) and the time. Two purposes: session security, abnormal-login investigation and blocking bulk registration; and the log retention and traceability required by the Cybersecurity Law. These logsretained for at least 6 months (see Section 6) and are provided only when cooperating with public security, cyberspace and similar authorities performing their legal duties.

Communication and business information.The name, organization, phone number and requirements you volunteer on the contact page or by email, and the organization names and contact details related to contracts, invoicing and licensing.

Product and order information (once available).Order numbers, items, amounts, payment status, invoicing details and delivery records generated when you buy or subscribe to products. Payments are processed by licensed third-party payment providers; we do not store full bank card numbers.

Technical diagnostic data.When you request technical support or enable diagnostic reporting, we may collect crash logs, version numbers and a summary of the runtime environment, used only to locate problems.

Collaboration content on Yuhox Tongo.After you enter Tongo, we process: project names and descriptions, members and roles, invite-link records, tasks and schedules, progress reports, comments, uploaded files, activity logs, and login IP and User-Agent (for session security and legally required network logs).Project content is not used for advertising, and is not used to train public models without your consent.

Sensitive personal information (Yuhox Uni only, with separate consent for each item).Each of the following has its own prompt and its own checkbox, is unchecked by default, can be withdrawn individually at any time, and declining any item does not affect other features：
· Health data(vital signs, medication, assessment results) are visible only to the care organization within its license;
· Face: used to verify identity in scenarios such as meals and classes,only feature values that cannot be turned back into an image are stored, never photos, and they can be fully deleted with one click; you may decline and use your name, the last four digits of your phone number or a card instead；
· Video surveillance：we do not keep recordings, and video does not pass through our servers: live video goes directly from your organization's cameras to the viewing device over its local network, and recordings are stored on the organization's own recorder, which the organization manages and retains. We only save a single snapshot image when an alert occurs, kept with the corresponding business record. Camera locations are disclosed by the organization; bedrooms require separate consent, you may decline, and declining does not affect other services；
· Call recording: we state the purpose and retention period,you may decline and use written notes instead；
· Position: used only to verify arrival for in-home services,collected only during the service period and stopped when the service ends, with no continuous location tracking;
· ID card number: needed only for real-name business such as long-term care insurance and government subsidies,only an irreversible encrypted value (HMAC) is stored, and we cannot recover the original number from the database; not providing it only affects that service.

What we never do.We never sell or rent your personal information; never use it for ad targeting or give it to advertisers; never use illness labels for any recommendation, filtering or grouping (no "diabetic meal recommendations" or similar features that seem thoughtful but reveal medical conditions); never store original face images; never restrict you from exporting your own data because of unpaid fees or a dispute; never disable unrelated features because you declined a consent. We do not collect religious belief, ethnicity or genetic information, and we do not embed ads or cross-site tracking pixels on the website.

How we use information

Used only to: create and maintain your account and single sign-on; determine your access to each product; perform the contract (delivery, updates, invoicing, support); send service-related notices (such as security alerts, order status, auto-renew results); provide technical support when you ask; improve product stability and compliance controls; and meet legal obligations. Auto-renew charge results and insufficient-balance reminders are delivered only as in-app messages, not by SMS or email. We do not build advertising profiles or sell personal information to third parties.

Sharing, transfer and public disclosure

We do not sell, rent or exchange your personal information. Necessary information is provided to third parties only in the following cases:

· Administrators of your organization can see the account status and product licenses of members of that organization;
· On Yuhox Uni, the organization serving you can see data about you within that organization's scope (care and service records, spending records, your file at that organization), but cannot see any of your information at other organizations；
· On Yuhox Tongo, members of the same project can see collaboration content in that project (tasks, plans, reports, comments, files, member lists), but cannot see other projects you have not joined；
· family members you authorize can only see the items you tick individually; you can withdraw at any time and stop anyone's delegated access at any time；
· Our operations staff access data only when necessary for troubleshooting; every access records who, when, what was viewed and why, the records are kept permanently, and you can ask us to show them; any change to your data must be visible to you;
· To complete payments, SMS and email delivery, we engage qualified service providers and require them to process data only on our instructions and keep it confidential;
· When required by laws and regulations, lawfully requested by administrative or judicial authorities, or necessary to protect personal or property safety;
· In a merger, division or asset transfer, we will require the successor to remain bound by this policy and notify you in advance.

Cookies and similar technologies

We use a necessary session cookie (HttpOnly) to keep you signed in so you do not have to sign in repeatedly across Yuhox subsites. There are no advertising cookies and no third-party scripts for cross-site tracking. You can clear cookies in your browser to sign out; after clearing, you must sign in again to use features that require authentication.

To understand how our websites and software are used, we record the page path, referring site, IP address and its approximate region, browser and device type, and time when you open a page, click a download, or when the software checks for updates. Analytics uses no cookies, does not record URL parameters, and is not used to identify individuals. Raw visit records are kept for no more than 12 months; reports keep only daily totals.

Storage location and retention

Account and website data is stored by default on servers or compliant cloud services within the People's Republic of China.We do not transfer any personal information outside the country.If the organization serving you uses an offline all-in-one deployment, your data exists only on that machine and never leaves the premises. Retention is limited to what is necessary for the purposes described in this policy: account data is kept for the life of the account; orders and financial records are kept as required by accounting and tax regulations; security logs are kept for at least 6 months (Article 21 of the Cybersecurity Law; where the law provides otherwise, the law applies). After expiry, data is deleted or anonymized.

Retention periods on Yuhox Uni: care records and health files are kept for the statutory period required by elder care and medical regulations; bills, invoices and receipts are kept for at least 10 years (Measures for the Administration of Accounting Archives); evidence for long-term care insurance and subsidy claims is kept for the statutory period required by medical insurance regulators; sign-in and operation logs for 6 months (Article 21 of the Cybersecurity Law); face feature values are physically deleted within 30 days after the service relationship ends; all other data without a statutory retention requirement is deleted once its purpose is fulfilled.
Retention on Yuhox Tongo: Projects and collaboration content are kept while the account and project exist; after you delete a project, leave or close the account, we handle them as needed for the service and as the law requires. Security logs are kept for at least 6 months. Please keep your own backups of important content.
Note: after you delete your account, what we delete is "who these records belong to" (de-identification); records that must be kept by law are retained as required. Bills are not de-identified because of tax inspection requirements. What can be deleted is "who you are"; what cannot be deleted is "what happened".

Security measures

We take reasonable technical and organizational measures, including encryption in transit (HTTPS), password hashing, least-privilege access, operation auditing and regular backups. However, no internet transmission or storage can be guaranteed absolutely secure. If a security incident occurs that may affect your rights, we will notify you promptly and take remedial measures as required by regulations.

Minors

Our website and account services are mainly intended for organizations and adults with full civil capacity.Where Yuhox Uni involves minors under 14, a guardian's consent is required; the minor cannot give consent alone；Yuhox Tongo is for adults with full civil capacity; children under 14 must not use it independently. If we find information collected from a child without guardian consent, we will delete it as soon as we can.

Your rights

To the extent permitted by applicable law, you may: view and correct your account details; obtain a copy of your personal information; withdraw non-essential consent; request account deletion and removal of personal account data; and object to automated decisions (we currently make no profiling or advertising decisions). After deletion, account data related to you personally is deleted or anonymized; the handling of organizational business data is decided by your organization. There are two ways to exercise your rights: submit online on the Complaints, reports and personal data requests page (choose "Personal information rights request" or "Delete account"), or email hello@yuhox.com. We generally reply within 15 working days. For security, we may ask you to verify your identity.

On Yuhox Uni, all of the following can be done yourself without contacting support: view and correct under Me > My information; export all your data with one click (not restricted by unpaid fees or disputes); withdraw consent item by item under Me > Consent management, effective immediately; delete your account under Me > Delete account, which can be cancelled at any time during the 7-day cooling-off period. Withdrawing consent does not affect processing carried out before withdrawal.
If using a phone is difficult for you: a family member can act on your behalf, and organization staff can also do it for you, with a full record throughout; you or your guardian can see who did what on your behalf and can stop anyone's delegated access at any time。

On Yuhox Tongo, requests to access, correct, export or delete personal information, and to close the account, are submitted on the Complaints, reports and personal data requests page. We usually reply within 15 business days. Please keep your own backups of important project content.

Files created for you by an organization

If you have no phone number or do not use a phone, the organization may have created a file for you. In that case: the organization must notify you (or your guardian) in writing and obtain consent at admission or enrollment; you will receive a large-print paper notice explaining what information is collected and who can see it; family members you authorize can see all information about you after signing in and can exercise all the above rights on your behalf; you can ask the organization to stop or delete at any time (except for statutory retention).
Not using a phone does not mean you have no right to know. If you did not receive a notice, contact the organization or contact us directly, and we will urge the organization to fulfill its duty to inform.

Policy updates

We may revise this policy from time to time and publish the update date on this page. Major changes will be announced on the website or by email. Continued use of the services constitutes acceptance of the updated policy; if you do not agree, stop using the services and request account deletion.

Contact us

Liaoning Yuhox Intelligent Technology Co., Ltd.
Address: No. 103-2 Xiushui Street, Huanggu District, Shenyang, Liaoning (1-1-1)
Privacy and personal information protection: hello@yuhox.com
Yuhox Uni personal information protection officer: uni@yuhox.com
Technical support: support@yuhox.com