Bodycheck Care Privacy Policy

This Privacy Policy explains how AXONMED Co., Ltd. ("AXONMED", "we", "us") handles personal information when you use the global version of the Bodycheck Care app, its Apple Watch and Wear OS companion apps and related services (the "Service"). The global version is offered outside the Republic of Korea. If your account was created in the Korean version, the Korean-language privacy policy applies to you.

Language versions. The app is available in English, French, Spanish, Japanese and Traditional Chinese. This policy is written in English and is also published in French (for Canada, section 14) and in Spanish (for Mexico, Chile and Panama, sections 22 to 24). A Japanese notice about the information the app sends to other companies is linked from section 21.

1. Who is responsible for your information

AXONMED is responsible for (is the "controller" of) the personal information described here.

• AXONMED Co., Ltd., Unit 217, 2F, Commercial Bldg., 85 Haemil 3-ro, Sejong-si 30092, Republic of Korea. Chief Executive Officer: Seungho Shin. Business registration number 786-81-04109. Mail-order sales business report number 2026-Sejong-0575.
• Privacy Officer: Seungho Shin, Chief Executive Officer. He is also our data protection officer under Singapore law and under Brunei Darussalam's Personal Data Protection Order, 2025, the individual accountable for our compliance under Canadian privacy law and the person in charge of the protection of personal information under Québec law. Email: develop@axonmed.io. Telephone: +82-70-5236-0724.

2. Summary

• We use your photos, measurements and logs only to give you posture analysis, body-composition estimates, workouts and your history.
• Body landmarks and the body-composition estimate are calculated on your phone and, if you have logged body-composition results from other devices, adjusted on our server using only your own entries. We store your scan photos and results in your account, in private storage, so you can see and compare them later.
• Data we read from Apple Health or Health Connect stays on your phone and is not sent to our servers. The only exception is the heart-rate summary of a workout you record with our watch app.
• We do not sell personal information, do not share it for targeted advertising, have no ads or ad trackers in the app, and never use health information for advertising.
• We do not use your personal information or photos to train AI models, and we do not send them to AI providers.
• Our servers are in Seoul, Republic of Korea (Amazon Web Services). A few service providers in the United States process limited information for us (section 7).
• You can delete your account and data in the app at any time, and you can ask us for a copy of your data.

3. Information we collect

3.1 Account information (required)

• Email address, name, birth date and sex.
• If you sign up with email: the email address, confirmed with a 6-digit code we send to it, and a password you choose (we store only a one-way hash of it).
• If you use Sign in with Apple: Apple's identifier for you in our app, the email address Apple shares (this may be a private relay address), whether Apple says the email is verified, and your name if you choose to share it. We also keep a token from Apple so that we can revoke Sign in with Apple when you delete your account.
• If you use Google sign-in: your Google account identifier, email address, whether Google says it is verified, and the name on your Google account. We ask only for basic profile and email access.
• The record of what you agreed to at sign-up: which items, when, the version of the text you saw, your platform (iOS or Android), the app language and how you signed up (email, Apple or Google).
• Language, region, time zone and unit settings (for example English and imperial units), taken from your device and your choices.
• Age range from your app store (United States): where Apple or Google provides it, the app reads the age range your store account declares (Apple's Declared Age Range, Google Play Age Signals) and your store country, at sign-up, before a purchase and from time to time while you are signed in, to check that you are old enough. This is used on your device and is not sent to our servers.

3.2 Body scan photos and results

• The front and side full-body photos you take with the camera for a body scan. Your photos may show your face.
• A copy of each photo with the landmarks and alignment lines drawn on it (annotated photos).
• Results calculated from the photos: body landmark positions (17 points: five on your face, for your nose, eyes and ears, and points for your shoulders, elbows, wrists, hips, knees and ankles), alignment angles, centre-of-gravity (balance) values, part scores, the body score and grade, findings, and an outline (silhouette) of your body used for the body-composition estimate.
• The analysis runs on your phone. We receive the photos, the annotated photos and the calculated results so you can see your results again and compare scans.
• We do not use your photos or body points to recognize or identify you, and we do not create face templates or faceprints. The five points on your face are used only to measure the position of your head. How long we keep photos and body points is in section 9. Please take photos of yourself only.

3.3 Body measurements and the body-composition estimate

• Height, weight and waist circumference you enter.
• The body-composition estimate calculated on your phone (for example body-fat percentage, lean mass, and waist, hip and chest circumference).
• If you have logged body-composition results from another device (section 3.4), our server adjusts (calibrates) the body-fat estimate of your later scans using those results. The adjustment uses only your own entries, and we keep both the adjusted and the unadjusted value.

3.4 Health values you enter

• Values you type in yourself, such as blood pressure, blood glucose, HbA1c, weight and results of body-composition tests from other devices. Body-composition results you log are also used to adjust your later photo-based estimates (section 3.3).

3.5 Workout records

• Training place name and equipment you register, exercises done, duration, estimated calories, sets, weights and repetitions, how hard it felt, feedback you give after an exercise (for example that it felt too hard or caused discomfort), and the maximum heart rate you set.

3.6 Apple Health, Health Connect and watch data

• Read on your phone only (not sent to us): if you connect Apple Health (iOS) or Health Connect (Android), the app reads steps, active energy, sleep and heart rate to show them in the app.
• Workouts recorded with our watch app: when you record a workout with the Bodycheck Care Apple Watch or Wear OS app, the workout's average and maximum heart rate, time in each heart-rate zone and the maximum heart rate used for the zones are saved with that workout record in your account. On Apple Watch, if you allow it, the workout is also saved to Apple Health, where it stays under your control. On Wear OS, the watch and your phone pass the workout record to each other through Google Play services (section 7).

3.7 Subscription information (Premium)

• Your subscription status: plan (monthly or annual), store (App Store or Google Play), whether you are in a free trial, start, renewal and expiry dates, whether it will renew, subscription events (for example started, renewed, cancelled, billing issue), the store's transaction identifiers, and the price and currency you paid (with RevenueCat's conversion of it to US dollars). We receive this from RevenueCat, which checks store receipts for us.
• What the app showed you just before you subscribed: the plan, the displayed price, the length of the free trial, the version of the paywall text, and your platform and app language.
• We do not receive your payment card or billing details. Apple or Google handles payment.

3.8 Notifications and messages

• Your device's push notification token (an Expo push token and the Apple or Google device token behind it), your notification settings, and the notifications and service emails we have sent you.

3.9 How you use the content in the app

• Which suggestions and articles were shown to you and which you opened, used to choose relevant content.

3.10 Technical information

• Server access records: time, IP address, the user-agent string sent by your device, your account number, and the request path and result. Used to keep the Service secure and fix problems.
• App updates: each time the app starts, it asks Expo (section 7) whether an update of the app is available. The request carries an identifier for your installation of the app, your IP address, your device platform and the app version.
• Subscription checks: when the app starts, the RevenueCat software in the app connects to RevenueCat (section 7) to show Premium plans and check whether Premium is active. Before you sign in it uses a random ID that the app creates; after you sign in it uses your account number and links the two. RevenueCat also receives your IP address, device, operating system and app version, language and store country.
• The app does not use cookies, advertising identifiers, or third-party analytics, tracking or advertising tools.
• Our website. Our Bodycheck Care pages on www.axonmed.io (every page under /axon-care/, in English, French and Korean, including this policy and the account deletion pages) do not load analytics, advertising or tracking tools. Other pages of www.axonmed.io are about AXONMED's other products and use Google Analytics (Google LLC) and NAVER Analytics (NAVER Corp.), which set cookies and record the pages visited, browser and device information and IP address to measure visits. They are not loaded when your browser sends a Global Privacy Control signal, and you can also block them in your browser settings.

3.11 Messages you send us

• Your emails to support or to the Privacy Officer and our replies.

3.12 Information we do not collect in the global version

• Precise or approximate location, phone number, contacts, microphone audio, browsing history and payment card details.
• The global version does not ask for optional marketing or research consents and does not send marketing messages.

3.13 Where the information comes from

• From you (what you enter, the photos you take, your feedback).
• From your device (on-device analysis, our watch app, your settings).
• From Apple or Google, when you use their sign-in, and, in the United States, the age range your app store account declares.
• From RevenueCat, Apple and Google, about your subscription.
• From the Service itself (scores, estimates, adjustments and recommendations we calculate).

3.14 Using the app before you sign up

You can try a body scan before creating an account. Until you sign up, those photos and results stay on your device and are not sent to us; the app processes them on your device only to show you the result you asked for. When you sign up, they move to your account. Even before you sign up, the app checks for updates with Expo and for Premium plans with RevenueCat (section 3.10); these checks contain no photos, results or health information.

4. Health information and your consent

Health information is sensitive. In the global version it includes: your body scan photos and results (annotated photos, landmarks, angles, centre-of-gravity values, scores, grade, findings, silhouette), your body measurements and body-composition estimates, the health values you enter (blood pressure, blood glucose, HbA1c, weight, body-composition test results), your workout records and feedback (including effort and discomfort), and heart-rate summaries of workouts recorded with our watch app.

What you agree to at sign-up. We ask for your separate consent to the health information item before you create an account. It is a separate checkbox that is not ticked in advance and is not included in "Agree to all", and you tick it yourself. By giving it, you agree that:

• what: we collect and keep the health information listed above;
• why: we use it only to provide the features you ask for: analysing your photos to estimate your posture and body composition, adjusting body-composition estimates with body-composition results you log, recommending and adjusting exercises, and keeping and showing your history, comparisons and trends. You specifically authorise us to analyse your photos automatically for these purposes;
• who receives it: our hosting provider, Amazon Web Services, which stores it for us in Seoul, Republic of Korea. Our other service providers (RevenueCat for subscriptions, and Expo, Apple and Google for notifications; section 7) receive identifiers such as your account number or device token and the fact that you use Bodycheck Care, but no scan results, measurements or health values. We do not sell health information, do not share it with third parties for their own use, and never use it for advertising. We disclose it to authorities only if we are legally compelled to (section 7);
• how long: we keep it until you delete it or your account, and we delete scan photos and landmarks sooner if you stop using your account (section 9);
• if you refuse: you can refuse. If you do, you cannot create an account, because the Service cannot work without this information; you can still try a body scan that stays on your device (section 3.14);
• how to withdraw: you can withdraw your consent at any time by deleting your account in the app or by emailing develop@axonmed.io (section 11). Because the Service cannot work without this information, withdrawing consent means we delete your account and the health information. Withdrawing consent or deleting your account does not cancel a store subscription: cancel it separately (in the app, My account > Subscription > Manage or cancel subscription, or follow the steps on our support page). If a paid period is running when you withdraw, we refund the unused part of it on request (Terms of Use, section 6.10).

Before you sign up, and on your device. When you take a body scan before creating an account, or connect Apple Health or Health Connect, the app processes that information on your device only because this is necessary to give you the scan result or the display you asked for, and the app tells you so first. It is not sent to us. Keeping scan information in an account requires the consent above.

We would ask for a new, separate consent before using health information for any other purpose or sharing it with anyone other than our service providers.

Apple HealthKit. Information from HealthKit is used only to provide the app's health and fitness features to you. Activity data read from Apple Health is shown in the app on your device and not sent to us. The heart-rate summary of a workout you record with our Apple Watch app is saved with that workout record (section 3.6). HealthKit information is not used for advertising or similar services, is not sold, and is not disclosed to advertising platforms, data brokers or information resellers. We do not store it in iCloud. The app writes to Apple Health only workouts you record with the Apple Watch app, if you allow it.

Health Connect. The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. Health Connect data is read on your device only and is not sent to our servers.

You can disconnect Apple Health or Health Connect at any time in your device settings (Health app > Sharing > Apps, or Health Connect > App permissions).

Not a medical service. The Service is not a medical device. Its output is wellness information, not a diagnosis, and we do not make decisions about your health.

Consumer health data. If you live in Washington or Nevada, or your consumer health data is collected there, see our separate Consumer Health Data Privacy Policy and Nevada Consumer Health Data Privacy Policy.

5. How we use information

We use personal information only for these purposes or purposes directly related to them. We do not use it for profiling that produces legal or similarly significant effects on you.

6. Automated processing and AI

• The posture analysis and body-composition estimate are produced automatically by models that run on your phone. If you have logged body-composition results from other devices, our server automatically adjusts the body-fat estimate using only your own entries (section 3.3). They are wellness estimates, and we do not use them, or any other computer program, to make decisions that could significantly affect your rights or interests (for example about insurance, employment, credit or access to services).
• These analyses assess physical characteristics such as posture and body composition. They run only when you start a body scan yourself, and the app reads Apple Health or Health Connect only after you connect it. You can stop scanning or disconnect at any time.
• Choosing exercises and content for you is also automated. You can always pick other exercises yourself.
• We do not use your personal information, photos or health information to train AI models, including large language models, and we do not send them to AI providers.

7. How we share information

We do not sell personal information, do not share it for cross-context behavioural or targeted advertising, and do not give it to data brokers.

Service providers. They process information only on our behalf and on our instructions, under contracts that require them to protect it and not to use it for their own purposes:

Notification texts are general reminders (for example "Time for a new body scan") and do not contain your measurements, scores or health values. None of these providers except Amazon Web Services receives your scan results, measurements or health values. If you write health information in an email to us, our email provider Kakao stores that email in Korea.

Platforms you choose to use. When you use Sign in with Apple or Google sign-in, Apple or Google confirms your identity to us. When you buy Premium, Apple or Google processes the payment. If you use our Wear OS watch app, Google Play services on your watch and phone carry the workout record between them; when they are not connected by Bluetooth, Google relays it over the internet with end-to-end encryption, so Google cannot read it. Apple and Google handle that information under their own privacy policies.

Exercise content. Some exercise demonstrations come from a third-party content provider through our servers. We do not send them any information about you.

Legal reasons and safety. We disclose personal information to courts, law enforcement or other authorities only when the law or a legally binding order (such as a court order, subpoena or warrant) requires it, or, for information other than health information, when it is necessary to protect someone's life or safety in an emergency. We disclose health information only when we are legally compelled to (court order, subpoena or warrant), not on voluntary request, and only what is required. Where the law allows, we will tell you about the request before we disclose.

Business transfers. If AXONMED is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction. The recipient must keep protecting it as this policy describes, and we will tell you before it happens.

Partner features. Booking, chat and record sharing with partner businesses exist only in the Korean version and are not part of the global version. We do not share your information with any business partner.

8. International transfers

AXONMED is based in the Republic of Korea, and the Service's servers and storage are in Seoul. If you use the Service from another country, your information is transferred to, stored and processed in the Republic of Korea, and the limited information listed in section 7 is processed in the United States. The privacy laws of those countries may differ from the laws where you live, and your information may be accessible to the courts, law enforcement and national security authorities of those countries under their laws.

We remain responsible for your information after it is transferred. We protect it with contracts that require our service providers to protect it and use it only on our instructions, with encryption in transit and the other measures in section 10, and by sending each provider only the information it needs. You can ask the Privacy Officer for more information about our service providers outside your country and how they handle your information.

Transfers from Korea. Because AXONMED is a Korean company, Korean law (the Personal Information Protection Act) also asks us to describe each transfer of personal information outside Korea. Amazon Web Services stores our data in Seoul, so it is not such a transfer. The transfers are:

You can refuse these transfers. App updates and subscription checks are part of how the app works, so you can refuse them only by not using the app (and deleting your account); if you do, you cannot use the Service. You can refuse the push notification transfers by turning off notifications for Bodycheck Care in your device settings; you then do not receive reminders.

Chile. At sign-up, we ask people in Chile for their explicit consent to the transfers described in this section (section 23).

9. How long we keep information

Scan photos and body landmarks. This is our written policy for keeping and destroying your scan photos and body landmark positions, including the five points on your face (section 3.2). We do not use them to recognize or identify you, and we do not create face templates or faceprints from them. We permanently delete your scan photos (original and annotated) and body landmark positions at the earliest of these times:

• when you ask us to delete that scan, within 7 days;
• when you delete your account, at once;
• if you do not use your account (open the app while signed in) for 12 months. We email you about 30 days before, if we have a confirmed email address for you. This applies even while a Premium subscription is active. Your other results (scores, findings and estimates) stay in your account under the rules above;
• no later than 45 days after we determine that keeping them is no longer necessary for the purpose for which you gave them to us.

If a security incident may have exposed scan photos or body landmarks, we follow our written incident response plan: we contain the incident, investigate what was affected, and notify you and the authorities as the law where you live requires (for Colorado residents, within 30 days after we determine that a breach occurred).

How we delete. We delete electronic records so that they cannot be restored: database records are erased, photo files are removed from storage (older stored versions of a file expire within 6 months), and encrypted backups are overwritten within 6 months. We do not keep paper records of your information.

Data stored in Apple Health or Health Connect is not ours and is not affected by deleting your account. Deleting your account does not cancel a store subscription. When your account is deleted, we also ask RevenueCat to delete its record of your account, apart from the subscription and consent records we keep ourselves as described above.

10. Security

• All connections between the app and our servers are encrypted (TLS), and stored data is encrypted at rest.
• Scan photos are kept in private storage in Seoul. They can be opened only through short-lived links that our server issues to your signed-in account.
• Passwords and verification codes are stored only as one-way hashes.
• Sign-in and verification attempts are limited. Access to production data is limited to the staff who need it, who are bound by confidentiality, and access is logged.
• Our service providers must meet security requirements in their contracts with us.

No system is completely secure. If a data breach affects your information, we will notify you and the authorities as the law of the place where you live requires (for example within the time limits set by the US Federal Trade Commission's Health Breach Notification Rule and by state laws, Australia's Notifiable Data Breaches scheme, New Zealand's Privacy Act 2020, Singapore's PDPA, Brunei Darussalam's Personal Data Protection Order, 2025, Taiwan's Personal Data Protection Act, Japan's Act on the Protection of Personal Information, Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, Chile's Law 21.719 (from 1 December 2026), Panama's Law 81 of 2019 and Canadian law).

11. Your rights and how to use them

Depending on where you live, you have some or all of these rights. We offer them to everyone who uses the global version.

• Access: see your records in the app, and ask us for a copy of the personal information we hold about you, including the scores, estimates and recommendations we have calculated about you.
• Portability: ask for a copy in a structured, commonly used format. We send a ZIP file with your information in JSON and CSV and your original scan photos, to you or, on your instruction, to another organisation.
• Correction: edit your profile in the app, or ask us to correct anything you cannot change yourself.
• Deletion: delete individual health-value entries in the app; delete your whole account at once in the app (My account > Account > Delete account); or ask us by email to delete specific scans or workout records, or your account without using the app (how to delete your account).
• Withdraw consent: delete your account (section 4; this does not cancel a store subscription), disconnect Apple Health or Health Connect in your device settings, or turn off push notifications in your device settings.
• Object or restrict: ask us to stop or limit a particular use of your information.
• A list of who received your information: ask for the names and contact details of the service providers and other parties we have disclosed your information to.

How to make a request. Email develop@axonmed.io from the email address on your account, with the subject "Privacy request" and what you would like us to do. You do not need an account or the app to make a request; if you no longer have access to your account email, tell us and we will verify your identity another way. Someone you authorise may make a request for you with your signed permission; we may ask you to confirm your identity directly. Requests are free.

When we respond. We confirm receipt promptly and respond within 20 working days, or sooner if the law where you live requires it (for Taiwan, Japan, Mexico, Chile and Panama, see the time limits in sections 19 and 21 to 24). If the law allows an extension and we need it, we will tell you why within that time. If we cannot do what you ask, we will explain why and how you can appeal or complain.

Appeals and complaints. If you disagree with our response, reply with the subject "Privacy appeal" and we will review the decision and answer in writing within 45 days. You may also complain to the privacy regulator where you live (sections 13 to 24) at any time. We will not treat you differently for using your rights.

Help in Korea. Because AXONMED is a Korean company, you can also ask the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972 when calling from Korea) or the Privacy Infringement Report Center of the Korea Internet & Security Agency (privacy.kisa.or.kr, 118 when calling from Korea) for help with a complaint about how we handle your information.

12. Children

The Service is for adults aged 18 and over. We check age with the birth date given at sign-up and, in the United States, with the age range from your app store where it is available (section 3.1). The Service is not directed to children or teenagers, and we do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has given us information, we delete it and close the account, and we refund the unused part of any paid period (Terms of Use, section 6.10). If you believe someone under 18 has given us information, contact develop@axonmed.io.

13. United States

This section applies to residents of US states with consumer privacy or health data laws, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and Washington, and other states that adopt similar laws. We follow it for all US users, to the extent each law applies to us.

Notice at collection. The table lists the categories of personal information we collect, why, and who receives it. Retention periods are in section 9 and the purposes in section 5. We do not sell or share personal information.

We do not collect precise geolocation. Sources are listed in section 3.13.

Sensitive personal information. We use sensitive personal information only to provide the Service you request, to keep it secure and for other purposes the law permits, and we do not use it to infer characteristics about you beyond the wellness estimates you ask for. For that reason we do not offer a "Limit the use of my sensitive personal information" option. We collect health information only with your opt-in consent (section 4).

No sale, sharing or targeted advertising. In the past 12 months we have not sold personal information, shared it for cross-context behavioural advertising, used it for targeted advertising, or used it for profiling that produces legal or similarly significant effects. We do not knowingly collect personal information of anyone under 18 and have no actual knowledge of selling or sharing personal information of consumers under 16. We honour Global Privacy Control signals as an opt-out request, although there is nothing to opt out of; on our website a GPC signal also stops the analytics tools described in section 3.10 from loading. We do not offer financial incentives for personal information.

Do Not Track. Our app and our Bodycheck Care web pages (every page under www.axonmed.io/axon-care/) do not respond differently to browser "Do Not Track" signals, because no third party collects personal information about your activities over time and across other websites or apps through them.

Nevada. We do not sell personal information. Nevada residents may still send a request to opt out of sale to develop@axonmed.io.

Your rights. Depending on your state, you have the right to know what personal information we have collected about you (including the categories, sources, purposes and recipients, and the specific pieces of information and the inferences we have drawn), to access and receive a portable copy of it, to correct it, to delete it, to get a list of the specific third parties to which we have disclosed personal information, to opt out of sale, sharing, targeted advertising and significant profiling (we do none of these), to withdraw consent to processing of sensitive data, and not to be discriminated against for using these rights. Make requests as described in section 11. State laws allow 45 days; our commitment in section 11 is 20 working days, which is shorter.

Appeals. If we decline your request, you can appeal as described in section 11. We answer appeals within 45 days; where the law allows an extension, we will tell you before the 45 days end. If we deny your appeal, our answer includes a link to the online complaint page of your state Attorney General.

Consumer health data. If you live in Washington or Nevada, or your consumer health data is collected there, see our Consumer Health Data Privacy Policy and Nevada Consumer Health Data Privacy Policy. Connecticut residents: we process consumer health data only with your consent and only as described in this policy.

California "Shine the Light". We do not disclose personal information to third parties for their own direct marketing.

14. Canada

• We collect, use and disclose your personal information with your consent, which for health information is your express consent given at sign-up. You can withdraw consent at any time, subject to legal or contractual limits; we will tell you what withdrawal means for the Service (section 4).
• The individual accountable for our compliance with Canadian privacy law, including the Personal Information Protection and Electronic Documents Act, is our Privacy Officer, Seungho Shin, Chief Executive Officer (develop@axonmed.io).
• Your information is stored in the Republic of Korea and processed by service providers in the United States (section 8), and may be accessible to the courts, law enforcement and national security authorities of those countries.
• You can get written information about our policies and practices for service providers outside Canada, and ask questions about how they handle your information, by contacting our Privacy Officer at develop@axonmed.io.
• We answer access and correction requests within 30 days at the latest.
• You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Residents of Québec can also complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
• Québec. The person in charge of the protection of personal information is our Chief Executive Officer, Seungho Shin (develop@axonmed.io). We do not use your information to make decisions based exclusively on automated processing. The posture and body-composition analyses assess your physical characteristics; they run only when you start a scan, and the app reads Apple Health or Health Connect only after you connect it (section 6). Before communicating personal information outside Québec, we assessed the privacy impact of doing so, and we protect information stored outside Québec with written agreements with our service providers. On request, we give you your information in a structured, commonly used technological format (section 11).
• Our personal information governance policy. The person in charge approves this policy and oversees how we handle personal information. Only staff who need personal information to do their work can access it; they are bound by confidentiality and their access is logged. We keep and destroy personal information as section 9 describes. We handle questions and complaints as section 11 describes: we acknowledge them promptly, answer within 30 days, and tell you how to take the matter to the regulator. The full policy is published at www.axonmed.io/axon-care/en/governance/.
• French versions. A French version of this Privacy Policy is available at www.axonmed.io/axon-care/fr/privacy/. French versions of our Terms of Use, support page, account deletion page and personal information governance policy are also published under www.axonmed.io/axon-care/fr/.

15. Australia

• We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Health information is sensitive information, and we collect it only with your consent (section 4).
• We are likely to disclose your personal information to recipients in the Republic of Korea (our hosting in Seoul) and the United States (the service providers in section 7). We take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles, and we remain accountable for how they handle it.
• You can ask to access or correct your information (section 11). We respond within 30 days.
• We do not use computer programs to make decisions that could reasonably be expected to significantly affect your rights or interests (section 6).
• To complain, contact our Privacy Officer first. We will acknowledge your complaint within 7 days and respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

16. New Zealand

• We handle personal information in accordance with the Privacy Act 2020. Some information about you comes from other sources (Apple or Google sign-in and the stores, section 3.13); this policy is our notice about that collection.
• Your information is stored in the Republic of Korea and processed by service providers in the United States (section 8). They act on our behalf, and we remain responsible for protecting your information.
• Our analysis of your photos to estimate your posture and body composition is done only with your specific authorisation at sign-up (section 4), and only to provide the Service to you. We do not use it to identify you.
• You can ask to access or correct your information (section 11). We respond as soon as reasonably practicable and within 20 working days.
• You can complain to the Office of the Privacy Commissioner (privacy.org.nz).

17. Singapore

• Our data protection officer is the Privacy Officer in section 1 (develop@axonmed.io).
• We collect, use and disclose your personal data for the purposes in section 5, with your consent or as the Personal Data Protection Act 2012 permits. You can withdraw consent by giving us reasonable notice; we will tell you the likely consequences before acting on it (for health information, see section 4).
• When we transfer your personal data outside Singapore (section 8), we make sure the recipients are bound by legally enforceable obligations that give it a standard of protection comparable to the PDPA.
• You can ask to access or correct your personal data (section 11). We respond within 30 days.
• You can complain to the Personal Data Protection Commission (pdpc.gov.sg).

18. Brunei Darussalam

• We collect, use and disclose your personal data for the purposes in section 5, with your consent or as the Personal Data Protection Order, 2025 (PDPO) permits. You can withdraw your consent by giving us reasonable notice; we will tell you the likely consequences before acting on it (for health information, see section 4).
• Our data protection officer is the Privacy Officer in section 1: Seungho Shin, Chief Executive Officer and Privacy Officer, AXONMED Co., Ltd., Unit 217, 2F, Commercial Bldg., 85 Haemil 3-ro, Sejong-si 30092, Republic of Korea; develop@axonmed.io; +82-70-5236-0724. We answer Monday to Friday, 08:00 to 17:00 Brunei time (GMT+8), except Korean public holidays.
• When we transfer your personal data outside Brunei Darussalam (to the Republic of Korea and the United States, section 8), we make sure the recipients are bound by legally enforceable obligations, such as contracts, to give it a standard of protection comparable to that under the PDPO.
• You can ask to access or correct your personal data (section 11). We respond as soon as reasonably possible and within 30 days. If we need longer, we will tell you within that time when we will respond.
• If we assess that a data breach is likely to cause significant harm or is of a significant scale, we notify the Authority for Info-communications Technology Industry of Brunei Darussalam (AITI) as soon as practicable, and no later than 3 days after that assessment. If the breach is likely to cause you significant harm, we then notify you.
• You can complain to AITI (pdp.aiti.gov.bn).

19. Taiwan

This section applies if you live in Taiwan or are a national of the Republic of China (Taiwan). We handle your personal data under Taiwan's Personal Data Protection Act (PDPA), which applies to us because we collect, process and use personal data of nationals of the Republic of China (Article 51).

• What we tell you under Articles 8 and 9. Collector: AXONMED Co., Ltd. (section 1). Purposes: section 5. Kinds of personal data: section 3. Period: section 9. Area: the Republic of Korea, where all personal and health information is stored, and the United States, where the service providers in section 7 receive only the limited information listed there (identifiers, device, subscription and notification information, and no health information). Recipients: AXONMED and the service providers in section 7. Method: automated and electronic processing, as described in sections 3 to 6. Sources of information you do not give us yourself: section 3.13.
• Health information. Information about your health, physical examinations or medical matters covered by Article 6 of the PDPA (for example scan results and blood pressure, glucose and HbA1c values) is collected only with your written consent. You give it electronically, after the notice in section 4, and you can withdraw it as section 4 explains.
• Your rights. Under Article 3 of the PDPA you may ask to see or review your personal data, get a copy, supplement or correct it, have us stop collecting, processing or using it, or have it deleted. These rights cannot be waived or limited by contract. Email develop@axonmed.io (section 11); we do not charge for requests. We decide on a request to see your data or get a copy within 15 days, and on a request to supplement, correct, stop using or delete your data within 30 days. If we need more time, we will tell you the reason in writing within that period, and we will take no more than 15 or 30 more days.
• If you do not give information. If you do not provide the information marked required, you cannot create an account or use the features that need it (sections 3.1 and 4). Other information is optional.
• Marketing. We do not use your personal data for marketing. If we ever do, we will tell you, the first time, how to object free of charge, and we will stop when you object (Article 20).
• Breaches. If a breach affects your personal data, we will notify you once we have looked into it (Article 12). We will also report it to Taiwan's Personal Data Protection Commission when the law requires.
• Complaints. You can complain to Taiwan's Personal Data Protection Commission (www.pdpc.gov.tw; currently its Preparatory Office) or to the competent authority.

20. Trinidad and Tobago

This section applies if you live in Trinidad and Tobago. We handle your personal information in line with the General Privacy Principles in section 6 of the Data Protection Act, 2011 (Chap. 22:04):

• We collect, use and disclose your personal information only with your knowledge and consent and only for the purposes in section 5. Health information is sensitive personal information: we process it only with your separate, express consent (section 4) and protect it with the safeguards in section 10.
• Your information is stored in the Republic of Korea, where the Personal Information Protection Act provides safeguards comparable to those under the Data Protection Act, 2011. Limited information is processed by our service providers in the United States under contracts that require comparable safeguards (sections 7 and 8).
• You may ask for our policies and practices on personal information and for the documents relating to the existence, use and disclosure of your personal information, and you may challenge their accuracy and completeness (section 11).
• You may challenge our compliance with these principles by writing to develop@axonmed.io. We will respond within 20 working days. When the Office of the Information Commissioner is in operation, you may also complain to it.

21. Japan

This section applies if you are in Japan. We handle your personal information under Japan's Act on the Protection of Personal Information (APPI), which applies to us because we provide the Service to people in Japan (Article 171).

• Business operator. AXONMED Co., Ltd., Unit 217, 2F, Commercial Bldg., 85 Haemil 3-ro, Sejong-si 30092, Republic of Korea. Representative: Seungho Shin, Chief Executive Officer. Our Privacy Officer handles requests and complaints (develop@axonmed.io, section 1).
• Purposes of use. We use your personal information only for the purposes in section 5, and only as far as they require.
• Special care-required personal information. Some health values you enter, for example HbA1c or blood pressure results from a medical check-up, may be special care-required personal information. We acquire it only with your prior consent, which you give with the separate health information consent at sign-up (section 4).
• Provision to third parties. We do not provide your personal data to third parties without your consent, except where the APPI allows it (for example when the law requires it, section 7). We do not use personal data jointly with other companies.
• Providing personal data to third parties in a foreign country. We provide personal data to these service providers in the United States: RevenueCat, Inc. (subscriptions), 650 Industries, Inc. (Expo; app updates and push notifications), and Apple Inc. and Google LLC (delivery of push notifications) (sections 7 and 8). Each of them has a system, set up by its contract with us, to continuously take measures equivalent to those that the APPI requires of a business operator (APPI Article 28(1); Article 16 of the Enforcement Rules of the Personal Information Protection Commission). At least once a year, we check how they take those measures and whether any law of their country may affect them, and we take the necessary steps if there is a problem. On request, we will tell you how each system was set up, what the measures are, how and how often we check them, the name of the country, whether that country has any system that may affect the measures and what it is, and any obstacle to the measures and how we deal with it (Article 28(3)).
• Security control measures. We protect your personal data as follows (see also section 10):
  • Basic policy and rules: this Privacy Policy is our basic policy. Our personal information governance policy (www.axonmed.io/axon-care/en/governance/) sets how personal data is handled at each stage, from collection to destruction, and who is responsible.
  • Organisational measures: our Privacy Officer is responsible for the handling of personal data. Access to personal data is limited to the staff who need it and is logged, and we follow a written procedure for incidents (section 9).
  • Human measures: staff are bound by confidentiality and read the governance policy before they get access to personal data.
  • Physical measures: personal data is kept in Amazon Web Services data centres, which control physical access, and we keep no paper records of it (section 9).
  • Technical measures: connections are encrypted (TLS), stored data is encrypted at rest, scan photos are opened only through short-lived links, passwords and codes are stored only as one-way hashes, and sign-in attempts are limited.
  • Understanding the external environment: your personal data is stored in the Republic of Korea (Amazon Web Services in Seoul, and our company email at Kakao), and limited information is processed in the United States (section 7). We have reviewed the personal information protection systems of the Republic of Korea and the United States, including the Personal Information Protection Commission's survey reports on them, and take our security measures with them in mind.
• Your requests. You may ask us to tell you the purposes of use of your retained personal data, to disclose it to you (including in electronic form, and including the records of its provision to third parties), to correct, add to or delete it, to stop using or erase it, or to stop providing it to third parties (APPI Articles 32 to 35). Email develop@axonmed.io as section 11 explains. We confirm your identity through the email address on your account (or another way if you no longer have access to it), and someone you authorise in writing may make a request for you. There is no fee. We respond without delay, and at the latest within the time in section 11.
• Breaches. If a breach occurs that the APPI requires us to report (for example one involving special care-required personal information), we report it to the Personal Information Protection Commission (a preliminary report promptly, generally within 3 to 5 days, and a final report within 30 days, or within 60 days if the breach was caused by wrongful intent) and notify you (Article 26).
• Information the app sends to other companies. Our notice under Japan's Telecommunications Business Act (Article 27-12) about the information the app sends from your device to Expo, RevenueCat and Apple or Google is published in Japanese at www.axonmed.io/axon-care/ja/external-transmission/.
• Complaints. Contact our Privacy Officer first (develop@axonmed.io). You can also consult the Personal Information Protection Commission of Japan (www.ppc.go.jp).

22. Mexico

This section, together with the rest of this policy, is our full privacy notice (aviso de privacidad integral) under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP) of 20 March 2025. The Spanish version of this policy, at www.axonmed.io/axon-care/es/privacy/, is the notice that applies in Mexico.

• Who is responsible and our address. AXONMED Co., Ltd., Unit 217, 2F, Commercial Bldg., 85 Haemil 3-ro, Sejong-si 30092, Republic of Korea. Our Privacy Officer handles your personal data requests (develop@axonmed.io, section 1).
• Personal data we process. The personal data listed in section 3. Sensitive personal data: the health information listed in section 4 (body scan photos and results, body measurements and body-composition estimates, the health values you enter, workout records and feedback, and heart-rate summaries from our watch app). We process sensitive personal data only with your express and written consent, which you give electronically at sign-up by ticking the separate health information box yourself (section 4).
• Purposes. All the purposes in section 5 are necessary to provide the Service you ask for. We do not use your personal data for secondary purposes such as marketing, advertising or research. If we ever want to, we will tell you first and give you a way to refuse.
• Transfers. We do not transfer your personal data to third parties for their own purposes. The service providers in section 7, in the Republic of Korea and the United States, process it only on our behalf and on our instructions, as our processors (encargados), which the LFPDPPP allows without your consent. We disclose personal data to authorities only when the law or a court order requires it (section 7). If AXONMED is involved in a merger, acquisition or sale of assets (section 7), we will tell you first and ask for your consent where the LFPDPPP requires it.
• Your ARCO rights. You may access your personal data, rectify it, cancel it (have it deleted) and oppose its processing, including processing by automated means alone (we make no decisions that way, section 6). To exercise these rights, email develop@axonmed.io with the subject "Privacy request" (or "Solicitud ARCO") and include: your name and the email address where we should answer; a way to confirm your identity (writing from the email address on your account is enough; otherwise, a copy of an official identification) and, if someone acts for you, proof of their authority; a clear description of the personal data and the right you want to exercise; and anything that helps us find the data. For a rectification, also tell us what to change and send any document that supports it. We tell you our decision within 20 days after we receive your request and, if your request is granted, carry it out within 15 days after that. If we need more time, we may extend each period once, for the same length, and we will tell you why. Requests are free, and we send copies of your data electronically at no cost.
• Withdrawing consent and limiting use. You can withdraw your consent at any time as section 4 explains; withdrawal does not affect processing already done. You can limit the use of your data by turning off notifications or disconnecting Apple Health or Health Connect in your device settings (section 11), or by asking us to stop a particular use. The global version sends no marketing messages.
• Tracking technologies. The app uses no cookies, web beacons or similar tracking technologies, and our Bodycheck Care web pages load none (section 3.10).
• Simplified notice. Before you create an account, the app shows you a simplified privacy notice in Spanish with our identity and address, the purposes and a link to this full notice.
• Changes. We tell you about changes to this notice in the app and by email, and publish the new version on this page (section 25).
• Breaches. If a security breach significantly affects your property or moral rights, we will tell you without delay so that you can take steps to protect them.
• Complaints. If you believe we have not respected your rights, contact our Privacy Officer first. You may also start a rights protection procedure with the Secretaría Anticorrupción y Buen Gobierno, which has supervised the LFPDPPP since 21 March 2025 (www.gob.mx/buengobierno).

23. Chile

This section applies if you live in Chile. We handle your personal data under Law 19.628 on the Protection of Private Life. From 1 December 2026, the amendments made by Law 21.719, which apply to controllers outside Chile that offer goods or services to people in Chile, also apply to us, and this section describes how we meet them.

• Health information. Health information is sensitive data. We process it only with your express consent, given in writing (electronically) with the separate health information consent at sign-up (section 4), and only for the purposes in section 5. You can withdraw it at any time (section 4).
• International transfer and your consent. Your personal data, including health information, is stored in the Republic of Korea, and limited information is processed by our service providers in the United States (sections 7 and 8). The laws of those countries may not protect your data to the same level as Chilean law. At sign-up, the app asks you, as a separate item, for your explicit consent to this transfer, after telling you the countries, the recipients, the purposes and this risk. We also protect the data with contracts that require our service providers to protect it and use it only on our instructions (section 8). If you do not give this consent, you cannot create an account, because the data of every account is stored in the Republic of Korea. You can withdraw it in the same way as the health information consent (section 4), which means deleting your account.
• Your rights. You may ask to access your personal data and to rectify, delete or block it, and, from 1 December 2026, to oppose its processing, to receive it in a structured, commonly used format, and not to be subject to decisions based solely on automated processing (we make no such decisions, section 6). Email develop@axonmed.io (section 11); requests are free. We answer within the time in section 11 and in any case within 30 days. If we need more time, we will tell you why within those 30 days and take no more than 30 more days.
• Contact for Chile. We have no establishment in Chile. You and the Personal Data Protection Agency (Agencia de Protección de Datos Personales) can reach us at develop@axonmed.io (section 26).
• Breaches. From 1 December 2026, we report security breaches to the Personal Data Protection Agency and notify you when Law 21.719 requires it, for example when health information is involved.
• Complaints. Contact our Privacy Officer first. You may also go to the courts as Law 19.628 provides and, from 1 December 2026, complain to the Personal Data Protection Agency.

24. Panama

This section applies if you live in Panama. We handle your personal data in line with Law 81 of 2019 on the Protection of Personal Data and Executive Decree 285 of 2021.

• Consent. We process your personal data with your consent and only for the purposes in section 5. Health information is sensitive data: we process it only with your separate, express consent (section 4). You can withdraw your consent at any time (section 4).
• Transfers. Your personal data is stored in the Republic of Korea, and limited information is processed by our service providers in the United States (sections 7 and 8). We transfer it only as needed to provide the Service you ask for, under contracts that require the recipients to protect it at least to the standard of Law 81 and to use it only on our instructions.
• Your rights. You may ask to access, rectify or cancel (delete) your personal data, to oppose its processing, and to receive it in a structured, commonly used format (portability) (section 11). Requests are free. We answer within 10 business days.
• Breaches. If a security breach affects your personal data, we notify you and the National Authority for Transparency and Access to Information (Autoridad Nacional de Transparencia y Acceso a la Información, ANTAI) as Law 81 and Executive Decree 285 require.
• Complaints. Contact our Privacy Officer first. You may also complain to ANTAI (www.antai.gob.pa).

25. Changes to this policy

We will tell you in the app and by email at least 30 days before a material change takes effect, and post the new version on this page with its effective date. If a change means we would use health information for a new purpose or share it with someone new, we will ask for your consent again before doing so. Previous versions are available from the Privacy Officer.

26. Contact

• Privacy Officer: Seungho Shin, Chief Executive Officer, develop@axonmed.io
• AXONMED Co., Ltd., Unit 217, 2F, Commercial Bldg., 85 Haemil 3-ro, Sejong-si 30092, Republic of Korea. Business registration number 786-81-04109. Mail-order sales business report number 2026-Sejong-0575.
• Telephone: +82-70-5236-0724 (weekdays 09:00 to 18:00 Korea Standard Time, GMT+9)
• Email (support and privacy): develop@axonmed.io