1. Introduction

Omi Group Joint Stock Company (OmiGroup) is committed to respecting and protecting the personal data of customers, partners, and users accessing the website omihealthtech.vn

Scope of Application: The website omihealthtech.vn serves as a channel for presenting the capabilities, products, and healthcare technology solutions of Omi Health Tech. The website does not collect or process personal health data, medical records, test results, or patient identification data through public channels. The processing of healthcare data in implementation projects with partner hospitals is governed by separate contracts and Data Processing Agreements (DPAs), and falls outside the scope of this Policy.

This Policy is established to provide transparency regarding the collection, use, storage, and protection of personal data, and to ensure compliance with applicable laws and regulations, including:

• Personal Data Protection Law No. 91/2025/QH15
• Decree No. 356/2025/ND-CP
• Applicable laws and regulations as amended from time to time.

The processing of personal data shall only be carried out when there is an appropriate legal basis, including the valid consent of the data subject as required by law.

2. Data Controller Information

• Organization name: Omi Group Joint Stock Company (OmiGroup)
• Address: Hanoi, Vietnam
• Email: info@omihealthtech.vn
• Phone: (+84) 24 6664 4599
• Data Protection Officer (DPO) contact: dpo@omigroup.vn

3. Purpose and Scope of Data Collection

This website is technically operated and managed by Omi Group Joint Stock Company (OmiGroup). When users access the website, certain technical information may be automatically collected, including IP addresses, domain names, device types, browsers, and browsing behavior. OmiGroup also uses cookies and similar technologies to support website operations, analyze user behavior, and improve user experience.

Personal data is collected in the following circumstances:

• When users submit contact, consultation, or partnership requests;
• When registering to receive information or newsletters from Omi Health Tech;
• When accessing and using the website;
• When participating in surveys, programs, events, or other activities organized by OmiGroup.

The types of data that may be collected include:

• Full name, email address, phone number;
• Organization/company name (if applicable);
• Contact content or requests;
• Technical data: IP address, device, browser, browsing behavior.

Omi Health Tech collects personal data only to the extent necessary to serve the stated purposes and in accordance with applicable laws and regulations.

Sensitive Personal Data

Omi Health Tech does not collect sensitive personal data by default through the website.

In certain specific circumstances related to consulting, partnership, or solution implementation activities (e.g., in the field of digital healthcare), OmiGroup may receive or process sensitive personal data, including:

• Health information or medical data;
• Biometric data (if applicable);
• Personal identification information (National ID/Citizen ID, passport);
• Financial information (when necessary for services/partnerships);
• Detailed location data;
• Data from projects containing sensitive personal information of third parties.

The processing of sensitive personal data shall only be carried out with the separate consent of the data subject; and in compliance with enhanced security measures as required by law.

4. Scope of Information Use

Users' personal data is processed by OmiGroup for the following purposes:

• Receiving, processing, and responding to user requests;
• Providing information about OmiGroup's products, services, and activities with the user's consent;
• Analyzing and improving the quality of the website and user experience;
• Ensuring system security and safety, and preventing fraud;
• Fulfilling obligations as required by law.

Personal data shall only be processed within the scope of the stated purposes and on an appropriate legal basis as prescribed by applicable regulations.

5. Data Retention Period

Personal data is retained for the period necessary to fulfill the processing purposes and to comply with applicable legal requirements.

6. Sharing of Personal Data

OmiGroup is committed to not providing, sharing, or selling customers' personal information to third parties. Personal data shall only be shared in the following cases:

• With the user's consent;
• With service providers engaged by OmiGroup (including but not limited to hosting, infrastructure, data analytics, and marketing), to the extent necessary and subject to confidentiality obligations;
• As required by competent state authorities;
• To protect the legitimate rights and interests of OmiGroup as prescribed by law.

Data recipients shall only process data for authorized purposes and shall not use it for their own purposes.

7. Cross-Border Transfer of Personal Data

Personal data may be stored or processed outside the territory of Vietnam when necessary for OmiGroup's operations, including the use of international technology services.

Data transfers are carried out on the following basis:

• An appropriate legal basis as prescribed by applicable regulations;
• Fulfillment of obligations related to impact assessments and data protection (where applicable);
• Application of necessary security measures to ensure data safety.

OmiGroup is committed to full compliance with applicable laws governing cross-border personal data transfers.

8. Personal Data Security

OmiGroup applies appropriate technical and organizational measures to protect users' personal data throughout the collection, processing, and storage lifecycle. These measures include but are not limited to:

• Use of encryption mechanisms (HTTPS/TLS) to protect data during transmission;
• User passwords are hashed using security standards and are not stored in plaintext;
• Regular data backups with recovery capabilities in the event of an incident.
• Implementation of role-based access control systems to prevent unauthorized access;
• Regular system monitoring to detect and prevent unauthorized access activities;
• Security awareness training for relevant personnel;
• Development and operation of an information security incident response process in accordance with internal policies.

9. User Rights

Users have rights over their personal data in accordance with applicable laws. Specifically:

• The right to be informed about and to consent to the processing of personal data;
• The right to request access to, correction of, or deletion of their personal data;
• The right to withdraw consent to data processing at any time;
• The right to object to the use of personal data for marketing purposes;
• The right to file a complaint in the event of a violation related to personal data.

Users may exercise the above rights by submitting a request to: info@omihealthtech.vn. We will receive and process requests within the timeframes and procedures prescribed by law.

10. Cookies and Tracking Technologies

OmiGroup uses cookies and similar tracking technologies to support website operations and enhance user experience. Specifically, cookies are used to:

• Ensure stable and continuous website operation;
• Analyze browsing behavior to improve content and system performance;
• Support marketing activities (where applicable).

Users have the right to actively manage, restrict, or decline the use of cookies through their browser settings or cookie management tools integrated on the website (where available).

11. Contact Information

For any questions, requests, or complaints regarding the processing of personal data, users may contact us at:

• Organization name: Omi Group Joint Stock Company
• Address: Hanoi, Vietnam
• Email: dpo@omigroup.vn
• Phone: (+84) 24 6664 4599

12. General Terms

This Policy is governed and interpreted in accordance with the laws of Vietnam, including Personal Data Protection Law No. 91/2025/QH15, Decree No. 356/2025/ND-CP, and any related amended or replaced legal instruments from time to time.

Users have the right to submit complaints to the competent state authority responsible for personal data protection as prescribed by law.

OmiGroup reserves the right to amend or supplement this Policy at any time. Updated content will be published on the website and shall take effect from the date of publication.

Effective date and version: This Policy is version 2.0, effective from May 1, 2026.