Privacy Policy

YiLa Technology Pte Ltd, a private company limited by shares incorporated in Singapore, is the organisation responsible for the personal data described here. In this policy “we” and “us” mean that company, and “this site” means yilamed.com.

This policy covers this website only. YilaCMS (clinic.yilamed.com), the platform console (platform.yilamed.com), YilaCare, and the clinical AI agent (agent.yilamed.com) are separate services. What they collect, where it is processed, how long it is kept and on what contractual footing is governed by the service agreement and data-processing terms your clinic signs with us — not by this page. Ask us for those documents before you sign anything.

If you are a patient rather than a clinic: your record sits with your clinic. Your clinic is the organisation accountable for it and the one to ask; we hold it on their instruction as a data intermediary, not on our own account.

The clinical AI agent at agent.yilamed.com accepts consultation text that you paste into it. It is a public demonstration tool, it is operated separately from this website, and this policy does not extend to it.

Do not paste anything into it that identifies a real patient. Remove the name, the NRIC or FIN, contact details, and anything else that could single a person out. If you want to evaluate the product against real records, that is a conversation to have with us under a data-processing agreement — not something to do through a public trial.

Nothing you type. There is no sign-up, no login and no form anywhere on this site. Every contact control opens your own mail client with a message addressed to info@yilamed.com; we receive whatever you choose to write and send, and nothing before that.

So the personal data we hold from this site amounts to: what you put in an email to us, and the technical request records described below.

This site sets no cookies. There is no analytics, no advertising pixel, no session replay and no third-party tracking script on any page. Nothing here follows you to another site, and nothing here knows you were on one.

Your language choice is carried in the URL — /zh, /zh-tw — rather than stored, which is why switching language changes the address bar.

When you dismiss the floating trial banner, the site writes a single timestamp under the key yilamed_trial_cta_dismissed so the banner does not reappear for twenty-four hours.

It is a number. It contains nothing about you, it never leaves your browser, and it is not transmitted to us or to anyone else. Clearing your site data removes it.

The site is served by Vercel Inc., which keeps standard request logs on our behalf: IP address, user agent, the page requested, the timestamp and the response status.

We do not use these to build a profile of you, and they are not joined to anything else. We do not sell, rent or trade any of it.

Request logs exist to serve the pages, keep the site available, and identify abuse or attack. Email exists so we can answer you and, if it becomes a commercial conversation, keep an ordinary business record of it.

We do not use anything collected through this site for advertising, profiling, or automated decision-making, and we do not use it to train models. If we ever wanted to use it for a purpose materially different from these, we would ask you first.

Our hosting provider (Vercel) and our email provider (Google, through Google Workspace), each acting as our processor under contract and only to provide the service. Where online booking is enabled, the scheduling provider named in the section on the booking page.

Beyond that: our professional advisers where they need it and are bound by confidentiality, a successor organisation if the business is transferred, and anyone we are legally required to disclose to — a court order, a regulator acting within its powers, or a law that compels it. Nobody else.

Vercel and Google are US-headquartered and operate globally, so serving this website and receiving your email can involve processing outside Singapore.

Section 26 of the Personal Data Protection Act 2012 permits a transfer only where the recipient is bound to a standard of protection comparable to the Act. We rely on the contractual terms those providers offer for transfers of that kind. You may ask us what those terms are and we will tell you.

Where our clinical products send data, and under what safeguards, is a separate question with a separate answer. It belongs in your service agreement, and we will put it in writing before you commit to anything.

Request logs are held by Vercel under its own retention schedule as our hosting processor; we do not extract or archive them separately.

Email is kept while the enquiry is live and afterwards for as long as we need it as a business record — ordinarily up to seven years for correspondence connected to a contract or a transaction, in line with the record-keeping periods Singapore law expects of a company. When it is no longer needed for a legal or business purpose, we delete it or anonymise it.

The site is served over HTTPS with HSTS. Access to the mailbox and to the hosting account is restricted to the people who need it, protected by two-factor authentication, and reviewed when someone leaves.

No safeguard is absolute, and we do not claim otherwise. If a breach occurs that is likely to result in significant harm to you, or that meets the notifiable threshold under Part 6A of the Act, we will notify the Personal Data Protection Commission and affected individuals as the Act requires.

Under the Personal Data Protection Act 2012 you may ask what personal data we hold about you and how it has been used or disclosed in the past year (access), ask us to correct anything inaccurate or incomplete (correction), and withdraw consent to further use (withdrawal).

Write to info@yilamed.com and say which. We will respond as soon as we reasonably can and in any event within thirty days; if we cannot meet that, we will tell you when we can. There is no charge for a straightforward request. The Act lets us decline in limited situations — for example where the data is another person’s, or is subject to legal privilege — and if we decline we will tell you why.

If your request is really about a clinical record, we will say so and point you to your clinic. That record belongs to them and we cannot release it on our own authority.

As section 11(3) of the Act requires, we have designated a Data Protection Officer responsible for our compliance with it.

Write to info@yilamed.com, marked for the attention of the Data Protection Officer. Post reaches us at our registered office in Singapore.

Tell us first — most things are a misunderstanding that one reply fixes, and we would rather hear it.

If we cannot resolve it, you may complain to the Personal Data Protection Commission, the authority that administers the Act in Singapore, at pdpc.gov.sg. Nothing in this policy affects that right.

This site is addressed to clinics and to healthcare professionals, and is not directed at children. We do not knowingly collect personal data from a child through it. If you believe a child has sent us personal data, write to us and we will delete it.

If what the site collects changes, this page changes with it and the date at the top moves. We do not backdate it.

If a change is material — a new script, a form, anything that starts collecting something the previous version said we did not — we will say what changed rather than quietly reissuing the document.