中EN
← Back to Governance

Privacy Policy

Version 2.0 · Effective: 2026-09-27 · Replaces the previously published Privacy Statement

Media-WIND Health Group (the "Group", "we" or "us") values your privacy. This Policy is adopted under Taiwan's Personal Data Protection Act (the "PDPA"), its Enforcement Rules and subsidiary regulations, and the confidentiality provisions of the Medical Care Act and the Pharmaceutical Affairs Act. It explains how we collect, process, use and protect your personal data when you use the Group's websites, LINE Official Accounts and services.

This Policy consists of General Provisions, which apply to all Group websites and services, and Schedules, which set out rules specific to individual websites or services. Where a Schedule conflicts with the General Provisions, the Schedule prevails for that website or service.

The Traditional Chinese version of this Policy is the governing version. This English version is provided for reference; in case of discrepancy, the Chinese version prevails.

Part I — General Provisions

1. Scope

  1. This Policy applies to the Group websites, LINE Official Accounts, newsletters, online forms, customer service lines and other digital services listed in Schedule 1 (the "Services").
  2. It does not apply to third-party websites or platforms linked from the Services, or to the processing performed by social platforms themselves (such as LINE, Facebook and YouTube), which is governed by their own privacy policies.
  3. The Group's CareCompanion (照伴隨) website, LINE Official Account and related services — including long-term care, home care and Garmin wearable data integration — are governed by their own separate privacy policies, not this Policy. See the CareCompanion website.
  4. If you join a patient support or assistance programme (PSP/PAP) run by the Group through a hospital, pharmaceutical company or other partner, the consent form or service agreement you sign also applies and prevails over this Policy in case of conflict.

2. Data Controller

The collector of your personal data is the Group member company or institution listed in Schedule 1 for the website or service you use. "We" in this Policy refers to that entity.

3. Purposes and Categories of Data

  1. We collect personal data only to the extent necessary for specified purposes and do not use it beyond those purposes. Purposes and data categories for each service are set out in Schedule 2.
  2. Common purposes (using the Ministry of Justice's specified-purpose codes) include: 040 marketing (with your consent only); 063 collection under statutory obligations; 069 contractual and similar legal relationships; 090 consumer and customer management and service; 135 information and communication services; 136 information and database management; 157 surveys, statistics and research analysis; 181 other business within registered scope.
  3. Common data categories include identifiers (name, phone, email, address, LINE user ID), government identifiers (only where required by law or the service), personal descriptions (gender, date of birth), family details (carers, emergency contacts), and technical data (IP address, browser, device, browsing records, cookie identifiers).

4. Sensitive Data (Health and Medical Data)

  1. Some Services involve medical, health examination and medication data. We collect, process or use such data only in the circumstances permitted by Article 6 of the PDPA, including where expressly required by law, where necessary to perform a statutory obligation with appropriate safeguards, or with your written consent.
  2. Sensitive data collected with your written consent is used only for the purposes and within the scope stated in that consent.
  3. General contact forms are not a channel for medical records, test reports or other health data. Please do not send such data through general forms, email or social messaging. Where a service genuinely requires it, we will provide a secure submission method.

5. How We Collect Data

  1. Directly — when you complete forms, subscribe to newsletters, add our LINE Official Account, call customer service, register for events or apply for services.
  2. Automatically — technical data recorded by servers and cookies when you browse (see Section 14).
  3. Indirectly — data provided by third parties with your consent or as permitted by law, such as referrals from hospitals or physicians, or pharmaceutical-sponsored support programmes. We will notify you of the source and the statutorily required information before processing, as required by Article 9 of the PDPA, unless an exemption applies.

6. Period, Territory, Recipients and Manner of Use

  1. Period: the duration of the specified purpose, any retention period required by law or contract, or as necessary for our business, whichever is longest (see Section 19).
  2. Territory: Taiwan (R.O.C.) and the locations of the cloud services described in Section 7.
  3. Recipients: the collecting Group entity; processors necessary to provide the Services (Section 8); authorities entitled by law; third parties you consent to (for example your physician; sponsoring pharmaceutical companies receive de-identified data only, or data within the scope of your consent).
  4. Manner: automated or manual processing within the above purposes, including communications, service delivery, customer support, statistical analysis (de-identified by default) and consented marketing.

7. International Transfers

The Services use international cloud providers (for example website hosting and databases, email and newsletter systems), so data may be stored or processed outside Taiwan. We prefer data centres located in Asia that hold recognised information security certifications, and we contractually bind providers to confidentiality and security obligations. We will comply with any restriction on international transfers imposed by the competent authority under the PDPA.

8. Processors

We may engage third parties to process personal data on our behalf (for example cloud hosting, newsletter delivery, customer service systems, IT operations, logistics). In accordance with Article 4 of the PDPA and its Enforcement Rules, we (1) set out in writing the scope of processing, security measures, sub-processing restrictions, incident notification and return or deletion of data on termination; (2) supervise processors appropriately; and (3) require processors to act only on our instructions.

9. No Sale or Rental; Restrictions on Disclosure

We never sell, rent or trade your personal data. We do not disclose your data to third parties or use it beyond the specified purposes except:

  1. where expressly required by law or necessary to perform a statutory obligation (for example adverse drug reaction reporting under the Pharmaceutical Affairs Act and pharmacovigilance rules, communicable disease reporting, or inspections by health authorities);
  2. where necessary for national security or the public interest;
  3. to prevent harm to the life, body, freedom or property of you or others;
  4. to prevent material harm to the rights of others;
  5. for statistics or academic research in the public interest by a government agency or academic institution, where the data cannot identify a specific individual;
  6. with your consent;
  7. where it is in your interest; or
  8. in a merger, demerger, transfer of business or other reorganisation, in which case the successor will continue processing under this Policy or protections no less stringent, with prior notice.

10. Your Rights

  1. Under Article 3 of the PDPA you may: (1) inquire about or review your data; (2) request a copy; (3) request supplementation or correction; (4) request that we cease collection, processing or use; and (5) request deletion.
  2. Please submit requests to the contact in Section 24. We will verify your identity first; an agent must provide a power of attorney.
  3. Under Article 13 of the PDPA we will decide on requests to review or copy within 15 days, and on requests to correct, cease or delete within 30 days. Each period may be extended once if necessary, with written notice of the reason.
  4. We may charge a reasonable cost for review or copies under Article 14 of the PDPA, and will tell you in advance.
  5. We may decline to delete or cease using data that we must retain by law (for example medical records and accounting records), that is necessary for our business, or that you have consented to in writing, and will explain why.
  6. You may object to marketing at any time; we will stop immediately and free of charge.

11. Consequences of Not Providing Data

Providing personal data is voluntary. If you do not provide data necessary for a service, or the data is inaccurate or incomplete, we may be unable to provide that service, respond to your inquiry or complete a programme review.

12. Information Security

In accordance with Article 27 of the PDPA, its Enforcement Rules and applicable security regulations, and with reference to the control frameworks of ISO/IEC 27001 and ISO/IEC 27701 (Media-WIND Health Strategies and MediCloud Biotech are certified by SGS to ISO/IEC 27001 and 27701), we apply reasonable technical and organisational measures, including:

  1. Governance — designated data protection personnel, a personal data inventory and risk assessment, and periodic review of our security plan.
  2. People — confidentiality undertakings and regular privacy and security training for staff and contractors; prompt revocation of access on departure or transfer.
  3. Access control — least privilege and segregation of duties; multi-factor authentication for administrative access; access and activity logging with periodic audit.
  4. Transmission and storage — HTTPS (TLS 1.2 or higher) site-wide; encryption or de-identification of sensitive data at rest; passwords stored using one-way hashing.
  5. System security — firewalls, malware protection, regular vulnerability scanning and patching; regular backups of key systems with restore testing.
  6. Processor management — security assessment and contractual controls (Section 8).
  7. Physical security — equipment and paper records containing personal data kept in restricted areas.
  8. Disposal — irreversible deletion or destruction, with records, when retention ends or the purpose ceases.

No internet transmission or electronic storage can be guaranteed to be completely secure. We continuously review and improve our measures but cannot guarantee that unauthorised access will never occur (see also Section 21).

13. Data Incident Response

  1. If personal data is stolen, leaked, altered or otherwise compromised, we will act immediately to contain the incident and prevent further harm, investigate its cause and impact, and keep records.
  2. We will notify the competent authority (including the Personal Data Protection Commission or the relevant sectoral regulator) within the time and in the manner required by the PDPA and its subsidiary regulations, and notify affected individuals by appropriate means (email, SMS, phone or website notice), describing the incident, our response and a contact point.

14. Cookies and Similar Technologies

  1. Cookies are small text files stored in your browser. We use:
  2. Strictly necessary cookies for site operation and security (such as language settings and load balancing); these cannot be disabled.
  3. Analytics cookies — Google Analytics 4 (possibly loaded via Google Tag Manager) to understand site usage and improve content; we do not use them to identify you personally.
  4. Functional cookies / third-party embeds — Google Maps, YouTube and similar embedded content may set cookies from those providers.
  5. We do not currently use cross-site advertising cookies. If we do in future, we will update this Policy and obtain consent as required by law.
  6. You can refuse or delete cookies in your browser settings, or install the Google Analytics opt-out add-on (https://tools.google.com/dlpage/gaoptout). Refusing cookies may affect some site functions.
  7. Third-party processing is governed by the providers' own policies (for example Google: https://policies.google.com/privacy).

15. LINE Official Accounts and Social Platforms

  1. When you add a Group LINE Official Account, we may receive your LINE display name, profile picture, LINE user ID and the messages you send us. We do not receive your LINE password, friend list or conversations with others.
  2. This data is used only to respond to inquiries, send service notices and information you choose to receive. We may use auto-replies or chatbots; conversations are handed to staff where human handling is needed.
  3. Processing by the LINE platform itself (including message transmission and server storage) is the responsibility of LY Corporation under its privacy policy and is outside our control. Please avoid sending national ID numbers, full medical records or test reports via LINE; where a service requires such data, we will provide a secure channel.
  4. You may block or remove our LINE Official Account at any time to stop messages. To delete conversation records we hold, submit a request under Section 10.

16. Newsletters

  1. Subscribing requires your name and email address and is completed only after you click the confirmation email (double opt-in).
  2. Newsletters are sent through Newsleopard; we may receive open and click statistics to improve content.
  3. Every newsletter contains an unsubscribe link. After you unsubscribe we stop sending and delete or archive subscription data within a reasonable period.

17. Minors and Persons under Guardianship

The Services are intended for adults. Minors and persons under assistance or guardianship orders should have their legal representative, assistant or guardian read and agree to this Policy; for patient support programmes, the relevant consent is signed by the legal representative or carer. If we learn that we have collected a minor's data without consent, we will delete it promptly.

18. Customer Service Calls, Recording and Automated Processing

  1. Customer service calls may be recorded for quality and accuracy; you will be told at the start of the call.
  2. If we use speech recognition, AI-assisted customer service or other automated tools, we will disclose this in advance. Decisions with significant effect on you, such as programme eligibility or service approval, are reviewed by staff and not made solely by automated means.
  3. We do not provide data that identifies you to third parties for training their AI models.

19. Retention

  1. We retain personal data for the duration of the specified purpose. When the purpose ceases or the period ends, we delete or destroy it under Section 12(8), or retain it in de-identified form for statistics.
  2. Where law prescribes a retention period, that period applies — for example, medical records are retained for at least seven years under the Medical Care Act; accounting records are retained for the periods required by the applicable laws.
  3. Website analytics data is retained according to Google Analytics settings (up to 14 months).

20. External Links

The Services may link to third-party websites or platforms whose content, security and data practices we do not control and to which this Policy does not apply. Please read their privacy policies before using them.

21. Disclaimer and Limitation of Liability

  1. Website content — Health, disease, medicine, subsidy and long-term care information on the Services is for general reference only. It is not a medical diagnosis, treatment recommendation or professional advice and does not replace the judgment of physicians, pharmacists or other healthcare professionals. Please consult a healthcare professional about any health concern. Subsidy and programme eligibility is subject to the final decision of the competent authority or programme sponsor.
  2. Third-party services — The Group is not liable for losses caused by system failures, security incidents or policy changes of third-party platforms or services (including LINE, Google, newsletter platforms, and telecom and internet providers) that are not attributable to the Group.
  3. User-side causes — The Group is not liable for losses, not attributable to the Group, arising from your disclosure of your own account credentials, passwords or verification codes, your transmission of personal data through insecure channels (such as ordinary email or public social media posts), or the compromise of your own devices or networks.
  4. Force majeure — The Group is not liable for service interruption or data damage caused by natural disasters, war, government orders, power outages, large-scale cyberattacks not attributable to the Group or other force majeure events, but will make reasonable efforts to mitigate the impact and act under Section 13.
  5. Mandatory law prevails — This Section applies to the maximum extent permitted by the laws of Taiwan (R.O.C.). It does not exclude or limit any liability the Group bears under the PDPA, the Consumer Protection Act or other laws, nor liability for damage caused by the Group's intentional misconduct or gross negligence.

22. Changes to this Policy

  1. We may amend this Policy due to changes in law, services or security needs. Amended versions will be posted on this website with a version number and effective date.
  2. For changes that materially affect your rights — such as to purposes, scope of use or disclosure to third parties — we will give notice before they take effect by website notice, email, LINE message or other appropriate means, and will obtain fresh consent where the law requires.
  3. Continued use of the Services after an amendment takes effect means you are aware of it; however, continued use does not constitute consent to any matter for which the law requires your consent.

23. Governing Law and Jurisdiction

This Policy is governed by the laws of Taiwan (R.O.C.). The Taiwan Taipei District Court shall be the court of first instance for disputes arising from this Policy, unless exclusive jurisdiction or consumer-protection or other mandatory provisions of law apply.

24. Contact

For questions, requests to exercise your rights or complaints, please contact:

  • Data protection contact: privacy@media-wind.com.tw
  • Phone: +886 2-6626-9168
  • Address: M Floor, No. 5, Sec. 5, Xinyi Rd., Xinyi Dist., Taipei 110, Taiwan (Taipei World Trade Center Exhibition Hall 1)
  • Service-specific contacts are listed in Schedule 1.

Part II — Schedules

Schedule 1 — Websites, Services and Data Controllers

Website / Service URL or Account Data Controller Dedicated Contact
Media-WIND Health Group corporate site www.media-wind.com.tw Media-WIND Health Holdings (采鋐健康投控) privacy@media-wind.com.tw / +886 2-6626-9168
PatientsForce (patient support services) www.patientsforce.com.tw; LINE: @patientsforce Media-WIND Health Strategies (采照策略顧問股份有限公司) and MediCloud Biotech (采曜生醫科技股份有限公司) — the company running the programme or service you join is the data controller privacy@media-wind.com.tw / +886 2-6626-9168
Newsletters Subscription forms on each site Media-WIND Health Holdings (采鋐健康投控) privacy@media-wind.com.tw

Schedule 2 — Purposes and Data Categories by Service

A. Corporate site

  • Purposes: inquiries, investor relations, recruitment, newsletters, site analytics (040, 069, 090, 135, 157, 181; recruitment also 002 human resources management).
  • Data: name, email, phone, company and title, inquiry content; applicants' CV data; technical data.

B. PatientsForce patient support services

  • Purposes: running pharmaceutical-sponsored patient support and assistance programmes (PSP/PAP), medication education and reminders, eligibility review, product or subsidy redemption, adverse drug reaction reporting, customer service (063, 064 healthcare services, 069, 090, 135, 136, 157).
  • Data: identifiers, personal descriptions, health records (diagnosis, prescription and medication use, limited to programme needs), carer or family contacts, hospital and physician information.
  • Specific rules:
  • Health data is handled under Section 4 and the programme consent form, for programme purposes only.
  • Data provided to sponsoring pharmaceutical companies is de-identified and aggregated by default; identifiable data (for example for adverse event reporting) is provided only where required by law or within the scope of consent.
  • After a programme ends, data is retained for the period required by the sponsor contract and law, then deleted.

C. LINE Official Accounts — see Section 15.

Version history: 2.0 (2026-09-27) — restructured into Group General Provisions and Schedules; added provisions on sensitive data, indirect collection, processors, international transfers, rights-request procedures, security measures, incident notification, LINE, call recording and AI, retention, disclaimer, and governing law; CareCompanion's website, LINE Official Account and Garmin data integration are governed by separate privacy policies (Section 1(3)). Previous: Privacy Statement (undated).

Privacy Policy | Media-WIND Health Holdings