LYTE User Privacy Policy
FitSloth Co., Ltd. (the “Company”), as the developer and provider of the LYTE website and application (collectively, “LYTE”), values and respects the right to privacy and the rights in personal data of all of the Company’s users, and is mindful of their privacy. The Company has therefore prepared this Privacy Policy to explain the processing of personal data of persons who visit and/or use the services (each, a “User”), which the Company needs to carry out for the sale of the products and services of the Company and/or its affiliates (the “Services”).
Acceptance of this Policy
When a User (a) contacts the Company through any communication channel and/or (b) registers an account to use the Services, the User shall be deemed to have immediately agreed to and accepted this Policy. If the User does not agree to the terms of this Policy or any amended version thereof, the Company reserves the right to prohibit or not permit the User from using the Services, since the processing of personal data under this Policy is necessary for the Company to perform its obligations to provide the Services directly to the User.
Scope of this Policy
This Policy applies only to the processing of personal data carried out by the Company insofar as it relates directly to the provision of the Services (as defined above). It does not apply to the processing of personal data by any other third party, even where such processing follows on from or is linked to LYTE. In such cases, the Company recommends that the User separately review the personal data policy of the relevant third party.
Updates to this Policy
The Company may update this Policy from time to time to keep it consistent with the scope of the Services and applicable laws. The Company will inform the User of any changes by publishing the updated Policy through the communication channels the Company may have with the User, and the User’s continued use of the Company’s Services shall always be deemed acceptance of this Policy.
Minors
The Company’s Services are intended for persons aged twenty (20) years or older. The Company does not intend to collect personal data from minors below that age. Where the Company specifically permits a minor to use the Services, the Company will collect and process such data only after obtaining the consent of the person exercising parental power as required under the applicable personal data protection law. If the Company becomes aware that it has collected personal data of a minor without valid consent, the Company will delete or destroy such data without delay.
Sources of personal data
The Company may obtain Users’ personal data from several sources, as follows: (a) directly from the User, when the User contacts the Company, registers for and uses any of the Company’s Services through LYTE; (b) from the Company’s business partners, where the User has consented to the partner forwarding and disclosing the User’s personal data to the Company for the use of LYTE and other services; and (c) automatically collected from the use of LYTE. Where the Company obtains the User’s personal data through a channel other than directly from the User, the Company will inform the User of the source of such data.
Personal Data the Company Needs to Collect and Process
The personal data of Users that the Company needs to collect and process in order to provide LYTE and other services to Users is as follows:
1. Information about the User and contact information, namely first name, last name and mobile phone number, used to verify the User’s identity when using the Company’s Services, as well as an image of the User’s national ID card, from which the Company will read and record the ID card details in its system.
2. User health data, namely (a) height, weight, age, body measurements, occupation, address and weight-loss goals; (b) daily nutrition, activity and mood data (which may be recorded as text, images or voice, and may be automatically transcribed by the LYTE system), or data obtained by linking LYTE with the User’s other health-tracking devices (e.g., Apple Health or Google Health Connect); (c) with the User’s consent, health data, in particular information on underlying diseases and medicines and dietary supplements regularly used, including data collected from consultations between the User and an advisor (Coach) or physician; (d) other information the User may provide for clarity in using the Services; and (e) health assessment results that the Company, physicians and/or advisors may process or generate from all data received from the User through LYTE.
3. Service usage data, namely (a) system usage data (including booking data and data on consultations with advisors or physicians via telemedicine; every consultation will be recorded for subsequent review and assessment of service quality), data on the services selected by the User, and the User’s complete log and transaction history; (b) online identifiers the User receives from using the Company’s Services, such as user account, password and any other authentication codes; and (c) history of purchases of, and payments for, goods and other add-on services (including purchases of medicines, dietary supplements and other products), including delivery addresses for goods and products and proof of payment.
4. Technical data, namely technical specifications and unique identifiers (such as location, logs, device ID and device type, network, connection data, access data, date and time of access, duration of use, cookies (or other forms of usage-tracking tools), search history, browsing data, and the mobile phone’s IMEI number or other unique device identifiers).
5. Other data, including but not limited to additional survey and questionnaire data, records of interactions and communications between the Company and the Company’s advisory service providers, in whatever form or manner stored, and service outcome data.
For What Purposes Does the Company Need to Process Personal Data?
1. To perform the Company’s obligations under applicable laws
The Company will use the User’s personal data to perform obligations it may have under applicable laws, which may include compliance with accounting and tax laws, digital platform laws, or other laws applicable to the Company or its Services (which may include laws relating to the management of healthcare facilities).
2. To perform the Company’s obligations to provide the Services to the User
The Company will use the User’s personal data for the following purposes:
a. carrying out the User’s requests, including providing advice, answering questions and handling matters relating to the Services, as well as any complaints or other inquiries the User may have;
b. verifying the User’s identity and the User’s entitlement to use the Company’s Services;
c. providing the Services and carrying out all transactions made by the User through LYTE, in particular to carry out the User’s instructions (e.g., providing guidance, and following up on guidance, about various behaviors for weight-loss goals);
d. communicating with the User before the Services are used, while the Services are being provided, and to follow up on satisfaction after the Services have been provided;
e. maintaining the User’s account and carrying out operations relating to the User’s account.
3. For the Company’s legitimate interests, without unduly affecting the User’s rights as a service user
a. collecting results, segmenting Users and analyzing other data collected from LYTE in order to understand feedback on the Company’s Services, to develop the Company’s Services to suit each User group, and to plan marketing strategies; in using such data, the Company will endeavor to use identifiable data only to the extent necessary;
b. using service usage data, which may include photographs or videos from the User’s use of the Services, to produce publicity materials for the Services and for the Company’s various activities; the Company will request further specific consent for any specific use of data that may include the User’s health data;
c. collecting results and contacting Users to review the quality of services provided by advisors or physicians in order to further improve the Services, and to manage the relationship between the Company and Users;
d. collecting and using data for the Company’s business continuity management, internal audits, handling of claims and disputes, litigation and related legal proceedings.
4. Where consent has been obtained from the data subject The Company will process the User’s personal data for other purposes to which the User may consent on a case-by-case basis, namely:
a. using cookie data to improve the LYTE Services. The User may change their web browser settings to block cookies; however, if the User refuses cookies, the User may be unable to use or access certain key features of the Services via online channels;
b. receiving information about activities or other news of interest in the form of direct marketing communications.
Retention period of personal data
For all of the purposes of processing personal data stated above, the Company needs to retain the User’s personal data for as long as necessary, within the following timeframes: (a) user account data and general service usage data: for as long as the User maintains a LYTE user account and for no more than one (1) year after the date the account is closed; (b) medical records and records of medical services, including consultation records, prescriptions and follow-ups: for no less than five (5) years from the date of the last service, as required by the law on healthcare facilities and professional laws; (c) accounting, tax and payment documents and data: for no less than five (5) years from the end of the relevant accounting period; (d) records of the giving and withdrawal of consent: for as long as the Company continues to process data based on such consent and for no more than five (5) years thereafter, to demonstrate legal compliance; (e) where such personal data has been incorporated into the Company’s publicity materials, the Company reserves the right to use such data to the extent necessary for business purposes, while guaranteeing respect for the rights of the relevant data subjects; and (f) data necessary for the establishment, compliance with or exercise of legal claims: for the applicable statute of limitations, even after the User’s account has been cancelled or closed. Upon expiry of the above periods, the Company will delete, destroy or anonymize such personal data.
Account closure and the meaning of data deletion
When a User closes their account or exercises the right to request deletion of data, the Company will: (a) immediately disable access to the account and cease processing data for the provision of the Services and for marketing; (b) delete or anonymize data that is not subject to any legal retention obligation; and (c) in respect of medical records and data that the Company is required by law to retain, restrict access to necessary personnel only, and solely for the performance of legal obligations or the exercise of legal claims, until the expiry of the periods specified under the retention period section. The User’s remaining Credit balance will continue to be recorded in accordance with the Terms of Service.
Will the Company Disclose Personal Data to Any Other Person, and How?
In principle, the User’s personal data will be kept confidential. However, where necessary, the Company may need to disclose the User’s personal data to third parties, in particular those listed below. Every such disclosure will be made within a specific scope, limited to what the relevant person needs to know.
1. Service providers that are partners of the Company, including but not limited to advisors, physicians providing advice in connection with the User’s use of the Services, and other related service providers (which may include product distributors and logistics service providers), to whom the Company needs to forward the User’s personal data solely for the provision of the services the User wishes to use through the Company’s LYTE.
2. Providers managing the operation of the LYTE system, consultants and auditors under the Company’s contracts with such persons, for the completeness and efficiency of the Company’s Services, which may include but are not limited to cloud and data storage providers, providers converting national ID card images into text, providers of teleconferencing systems used for physician consultations, providers of communication applications used by the Company as a channel to contact Users, providers of speech-to-text transcription and artificial intelligence systems used to prepare draft consultation notes, providers of customer relationship management systems, and payment system providers and financial institutions for receiving service fees, making refunds and verifying transactions.
3. Where the Company has a legal obligation or is subject to a court judgment or an order of a government authority, the Company may need to disclose data to the relevant government authority, strictly as required.
4. Relevant persons in the event of a restructuring or merger of the Company, where the Company needs to share data for such purpose.
5. Any other agency or person to which the User may specifically consent to the Company disclosing data.
Undertaking to Implement Appropriate Data Security Measures
The Company undertakes to put in place appropriate security measures to prevent unauthorized or unlawful access to, use, alteration, modification or disclosure of personal data, commensurate with the risks that may arise from the processing of personal data. In particular, the Company has established internal practices defining rights of access to and use of data subjects’ personal data in order to maintain the confidentiality and security of the data. The Company will review such measures periodically to keep them in line with industry standards and in accordance with applicable laws.
In addition, in the event of a personal data breach, the Company will notify the Office of the Personal Data Protection Committee without delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach. Where the breach is likely to result in a high risk to the rights and freedoms of Users, the Company will also notify the affected Users of the breach, together with remedial measures, without delay.
Rights of Users as Data Subjects
The Company acknowledges and respects Users’ legal rights in respect of their personal data under the Company’s control, subject to the conditions set out in the personal data protection law, namely: the right to access and obtain a copy of personal data; the right to request correction of personal data so that it is accurate and up to date; the right to receive personal data where the Company has made such data available in a format that is readable or commonly usable by automated tools or devices, and the right to request that such data be sent or transferred to another data controller; the right to object to the processing of personal data; the right to request deletion, destruction or anonymization of personal data when the data is no longer necessary or when the data subject withdraws consent; the right to request restriction of the use of personal data where such personal data is to be deleted or destroyed or is no longer necessary; and the right to withdraw consent previously given for the processing of data for the stated purposes.
Users may contact the Company’s staff to submit a request to exercise any of the above rights. The Company will consider the request and notify the User of the outcome within the timeframe prescribed by applicable law.
In addition, Users have the right to lodge a complaint with the Personal Data Protection Committee if they believe that the Company, its employees or its contractors have violated or failed to comply with the personal data protection law.
How to Contact the Company
If a User has any questions or would like further details about the Company’s Privacy Policy, please contact the Company through the following channels:
FitSloth Co., Ltd. (Head Office)
1114 Soi Sukhumvit 101/1, Bang Chak Subdistrict, Phra Khanong District, Bangkok 10260
Email: support@fitsloth.co.th