Compliance and trust
Health data needs more care than other data. Here is how we protect it, and the rules we follow in each market.
Data protection laws
| Singapore | Personal Data Protection Act 2012 (PDPA). We have a Data Protection Officer you can contact at privacy@chathealth.com.sg. |
|---|---|
| Mainland China | Personal Information Protection Law (PIPL), Data Security Law and Cybersecurity Law. Service in mainland China is operated by a Chinese entity. |
Where your data lives
Each market runs on its own cloud system. Data does not move between them automatically.
| Singapore users | Alibaba Cloud, Singapore region |
|---|---|
| Mainland China users | Alibaba Cloud, mainland China regions, in a separate account |
AI requests that contain personal or health data go only to AI models that run in your region. Our AI providers may not use your data to train their models.
Your rights
In the app, under Me → Privacy & Security, you can:
- see and withdraw your consents
- see and delete what the assistant remembers about you
- download a copy of your data
- correct or delete your data, or close your account
AI and medical safety
- ChatHealth does not diagnose, prescribe or treat. It explains information and connects you with licensed professionals.
- Words that suggest an emergency skip the AI and show local emergency numbers straight away.
- Every doctor and clinic is licence-checked before they appear.
- Features that may be regulated as medical software, such as lab report explanations, stay switched off in a market until the relevant regulator's requirements are met (HSA in Singapore, NMPA in mainland China).
- The assistant never books, shares or pays without your explicit approval.
Security
- Data is encrypted in transit and at rest. Health records and uploaded reports use additional encryption keys.
- Staff access to health data is limited, approved and recorded in a tamper-resistant audit log.
- Independent penetration tests and compliance reviews take place before each market launches.
- In mainland China, our system follows the Multi-Level Protection Scheme (MLPS 2.0).
Report a vulnerability
If you find a security issue, email security@chathealth.com.sg with the steps to reproduce it. Please do not access other people's data or disrupt the service. We will confirm receipt within 2 working days and keep you updated until it is fixed.
Data breaches
If a breach affects you, we notify you and the authorities as the law requires — in Singapore, the Personal Data Protection Commission within 3 calendar days of confirming a notifiable breach.