We are committed to safeguarding your privacy and ensuring that all personal data is handled in strict compliance with Singapore's Personal Data Protection Act 2012 (PDPA) and its subsidiary legislation. This Privacy Policy applies to all users of JaiCare and governs our collection, use, storage, disclosure, and processing of personal data. By registering for, accessing, or continuing to interact with JaiCare, you acknowledge that you have read, understood, and agreed to the terms set out in this Privacy Policy. Where you access or use the service from outside of Singapore, your use may additionally be subject to local statutory rights and requirements set out in the relevant Jurisdiction Addendum, which supplements and forms an integral part of this Privacy Policy.

1. Personal Data We Collect

We collect only the personal data necessary to provide, operate, manage, and optimize JaiCare. Because JaiCare handles your personal data, we are transparent about what we collect and why. The personal data listed below is collected for the specific operational, analytical, administrative and legal purposes detailed in Section 2 (How We Use Your Personal Data) and is retained strictly in accordance with Section 7 (Data Retention Period).

Account and Registration data

• Your phone number (for WhatsApp users) or unique user identifier / display name (for LINE users) — used as your account identifier.
• Your name, preferred language, and time zone — provided during registration.
• Your account number, and a record of your registration consent: the date and time you agreed, the version of this policy and the Terms you agreed to, the channel you used, and the words of your reply.
• Subscription and payment information when you subscribe to a paid plan: the plan you chose, the amount and currency, whether your subscription is active and when its current period ends, and the reference numbers our payment provider returns to us. We never receive your card number, expiry date or security code.
• If you begin registering but do not finish, the identifier you wrote from and what you sent during registration, kept for up to 30 days and then deleted.
• If you delete your account, your account number, a record of your plan and usage costs, and a record of when you agreed to our policies and to which versions — without your name, number or any health information — kept for accounting, billing and as proof of your consent.

Health data (sensitive data)

• Conditions, allergies, and dietary restrictions you share with us.
• Medications (name, dosage, timing, dietary interactions) that you tell us about or that we extract from documents.
• Medical reports you upload (lab results, prescriptions, discharge reports, specialist reports, radiology images, vaccination records), and the text we read from them. A report can also name other people, such as your doctor or laboratory staff; we use their details only as part of your record.
• Lab values extracted from your reports, with trend comparisons against your previous results, and our automated assessment of them (for example, whether a value is outside its reference range).
• Food diary entries automatically extracted from your messages, with our automated estimate of each meal's calories and nutrients.
• Your doctors (name, speciality, clinic, phone).
• Your weight, your weight goal, and each weigh-in you record.

Messages and voice notes

• All text and voice messages you send via WhatsApp or LINE. Voice messages are converted to text and processed in the same way.
• Conversation history, including the topics of our weekly check-ins, is retained to provide continuity of care.

Caregiver and family data

When linking family members or caregivers, we store their names, identifiers, and messages within the shared family conversation. JaiCare supports three roles: primary caregiver (full access), patient, and sibling (read-only via a secure link).

Technical data

• Timestamps, error logs, and basic usage metrics — for service maintenance and quality improvement.
• Notes from our internal quality reviews of the service, which may quote parts of your conversation or records. They are used only to find and fix errors, and are deleted with your account.
• When a message to you cannot be delivered, a short extract of it, kept so that delivery can be retried and the fault investigated.

2. How We Use Your Personal Data

We use your personal data to:

• Operate, deliver, host, maintain, troubleshoot, and optimize the JaiCare service and underlying infrastructure.
• Provide personalised health and nutrition advice based on your conditions, medications, and needs.
• Track your food and alert you to items that may conflict with your conditions or medications.
• Read, store, and track trends in your medical reports and lab results.
• Manage your medication list and send reminders on schedule.
• Relay messages between you, your caregivers, and the bot within the family conversation.
• Manage subscription, billing, and technical support.
• Maintain security, prevent misuse, and improve quality.

We do not sell or rent your personal data, and we do not share it with third parties for marketing purposes. We only share personal data with trusted third party service providers (such as cloud hosting facilities, messaging and communications platforms, AI inference infrastructure vendors, and payment processors) who process information strictly on our instructions and under binding confidentiality and data protection terms, or where disclosure is required by applicable law, regulatory directive, or court order. We do not use your personal data to train AI models. We do not show you advertisements based on your personal data.

3. Consent

We collect, use, store, transfer, disclose and process your personal data on the basis of your explicit consent. Consent is obtained at registration, before your account is established. Your continued access to, use of, and interaction with JaiCare constitutes your ongoing and binding consent to the collection, use, transfer, processing, storage, and disclosure of your personal and health data in the manner and for the purposes set out in this Privacy Policy.

Where a primary caregiver establishes a family plan or links a patient, the caregiver warrants and represents that the patient has given explicit, informed consent for their health and personal data to be accessed, processed, and managed by the caregiver and any linked siblings in the manner described herein, or that the caregiver holds lawful authority to act on the patient’s behalf. When a patient within a family requests data deletion, the caregiver is notified. Where a patient is linked to a family plan, that patient’s continued use of and interaction with the service constitutes their express consent to their health and personal data being accessed, processed and managed by the designated caregiver and any linked siblings.

You may withdraw your consent at any time; doing so may restrict or end the service, as personal data is essential for providing the service.

4. Data Storage and Security

We implement reasonable and appropriate administrative, physical, and technical security arrangements to protect your personal data against unauthorized access, collection, use, disclosure, copying, modification, disposal, loss, or similar risks. These safeguards include industry-standard encryption protocols for data in transit and at rest, strict role-based access restrictions, and secure backup procedures. While we take all reasonable precautions to safeguard your personal data, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

5. Service Providers and Transfers Outside Your Country

To provide the service, we only share personal data with trusted third-party service providers (such as cloud hosting facilities, messaging and communications platforms, AI inference providers, and payment processors) who process data strictly on our instructions and under binding confidentiality and data protection obligations, or where disclosure is required by applicable law, regulatory directive, or court order. We do not use or permit our service providers to use your personal data to train public artificial intelligence models.

Payment information. When you purchase a paid plan, payment is processed by a licensed third-party payment service provider. Your card or payment-instrument details are submitted directly to that provider on a page it hosts; we do not collect, receive or store your full card number, security code or bank credentials. We receive from the provider a record of the transaction, which includes a transaction identifier, the amount and currency, the date, the outcome of the payment, the last four digits and card type where applicable, and the country associated with the payment method. We use that record to provide and support your subscription, to process refunds and disputes, and to meet our accounting, tax and record-keeping obligations. Our payment providers operate internationally and your payment information may be processed outside Singapore; we rely on the contractual and technical safeguards those providers apply. We retain transaction records for the period required by applicable accounting and tax law, even after your account is deleted.

Transfers outside Singapore

To deliver the service, your personal and health data may be transferred to, stored, or processed in countries outside Singapore where our third-party infrastructure and technology providers operate. When personal data is transferred outside Singapore, we take appropriate steps to ensure that the recipient is bound by legally enforceable obligations to provide the transferred personal data a standard of protection comparable to that required under applicable data protection laws.

6. Your Rights

You are entitled to the following rights in respect of your personal data:

• Access: You may request access to the personal data we hold about you.
• Correction: You may request that we correct any error or omission in your personal data in our possession or under our control.
• Withdrawal of consent: You may withdraw your consent for the continued collection, use, or disclosure of your personal data at any time (this may end the service).

To exercise any of these rights, contact our Data Protection Officer at dpo@zetapegasilabs.com with sufficient information for us to verify your identity and locate the requested records. We will respond to your request within 30 days. We also reserve the right to charge a reasonable administrative fee to cover the incremental costs of searching for, retrieving, compiling, and providing copies of personal data pursuant to an access request. Where a fee applies, we will provide you with a written estimate before processing your request and will not proceed until you have agreed to the fee.

7. Data Retention Period

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, to provide the service to you, or as required or permitted by applicable law (including satisfying statutory, accounting, or legal requirements, and resolving disputes). When retention is no longer necessary for the foregoing purposes, we will securely delete or anonymize your personal data in accordance with the PDPA.

8. Data Breach Notification

In the event of a breach affecting your personal data, we will assess the incident and notify the relevant regulatory authority and affected individuals where and in the manner required by the PDPA.

9. Children's Data

JaiCare is designed strictly for individuals aged eighteen (18) years or older. We do not knowingly collect, solicit or process any personal data from anyone under the age of eighteen (18). If we discover that personal data of an individual under 18 has been collected without valid parental or legal guardian consent, or if a parent or legal guardian notifies us of the same, we will delete the data.

10. Changes to This Policy

We may update this policy from time to time. We will notify users of material changes via the bot before they take effect, and continued use after notification constitutes acceptance. If you do not agree to the updated terms, you may cease using the service.

11. Contact

Zeta Pegasi Labs Pte. Ltd.
Private Limited Company, incorporated in Singapore on 11 August 2026 · UEN: 202636586D
Registered office: 152 Beach Road, #23-02 Gateway East, Singapore 189721
Data Protection Officer: dpo@zetapegasilabs.com · Website: zetapegasilabs.com