Legal Documents

This Privacy Policy explains how TCM Clinical Pro Ltd. ("Company", "we") collects, uses, stores, and shares personal data when you use TCM Clinical Pro (the "Platform"). It applies to all Users and governs data processing activities across all jurisdictions in which the Platform operates, including the European Union, Portugal, Spain, Brazil, and the United States. This Policy is compliant with GDPR, LGPD, and CCPA/CPRA.

TCM Clinical Pro Ltd., registered in Portugal, is the data controller for Subscriber (practitioner) data. Where Subscribers upload patient data, they act as independent data controllers; the Company acts as a data processor on their behalf pursuant to a Data Processing Agreement. Data Protection Officer (DPO): Contact hello@tcmclinicalpro.com

2.1 Subscriber Data (Practitioners): • Identity: full name, professional title, licence/registration number • Contact: email address, phone, clinic address • Account credentials: encrypted password hash • Payment: billing address, last 4 digits of card (full card data processed by Stripe) • Professional verification data • Usage data: login times, features used, diagnosis counts 2.2 Patient Data (processed on your behalf): • Patient demographics entered by the Subscriber • Clinical data: symptoms, tongue/pulse observations, diagnosis records • Appointment and scheduling records • Clinical notes and session outcomes We do not collect patient data directly — all patient data is entered by Subscribers. Subscribers are responsible for obtaining appropriate consent from their patients.

• Performance of contract: to provide the subscription service • Legal obligation: regulatory compliance and audit requirements • Legitimate interests: platform security, fraud prevention, service improvement • Consent: for marketing communications (opt-in only) For special category data (health data), processing is based on Article 9(2)(h) GDPR (healthcare professional context) and your explicit agreement to our Terms.

• To provide, maintain, and improve the Platform • To process subscription payments • To send service-related communications (onboarding, billing, security alerts) • To provide customer support • To comply with legal and regulatory obligations • To detect and prevent fraud and abuse • To generate anonymised, aggregated analytics (no individual identification) We do not use your patient data to train shared models. Your clinical data remains private to your account.

We do not sell personal data. We share data only with: • Payment processor (Stripe) — for subscription billing • Cloud infrastructure provider — for hosting and storage (EU-based servers) • Email service provider — for transactional emails • Analytics service — anonymised usage data only All third-party processors are subject to Data Processing Agreements and are GDPR-compliant. No data is transferred outside the EU/EEA without appropriate safeguards (Standard Contractual Clauses where applicable).

• Subscriber account data: retained for the duration of the subscription + 90 days post-termination • Patient clinical data: retained as long as the account is active; exportable at any time • Payment records: retained for 7 years per EU accounting regulations • Audit logs: retained for 2 years You may request deletion of your data at any time, subject to legal retention obligations.

Under GDPR and equivalent laws, you have the right to: • Access: obtain a copy of your personal data • Rectification: correct inaccurate data • Erasure: request deletion ("right to be forgotten") • Portability: receive your data in a machine-readable format • Restriction: limit how we process your data • Objection: object to processing based on legitimate interests • Withdraw consent: for consent-based processing at any time To exercise your rights, contact hello@tcmclinicalpro.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

We implement industry-standard security measures: • All data encrypted at rest (AES-256) and in transit (TLS 1.3) • Regular security audits and penetration testing • Role-based access controls • Multi-factor authentication available • Incident response procedures with regulatory notification timelines In the event of a data breach affecting your personal data, we will notify you and relevant supervisory authorities within 72 hours as required by GDPR Article 33.

We use cookies and similar technologies as described in our Cookie Policy. You can manage cookie preferences via the cookie banner on the Platform.

For privacy queries, data subject requests, or to report a concern: Email: hello@tcmclinicalpro.com Response time: within 30 days For GDPR complaints unresolved by us, you may contact the Portuguese Data Protection Authority (CNPD) at cnpd.pt.

When you use the referral invitation feature, the Platform sends the invitation email on your behalf from the Platform's own email address. The email discloses your name (as registered on your account) to the invited colleague as the person who referred them. The invitee's email address is processed solely for the purpose of sending the invitation and tracking the referral status. By using this feature, you consent to the disclosure of your name to the invitee.