Privacy Policy

Ocare Club is a healthy-living app operated by LIBERTY AND SKY COMPANY LIMITED (“Ocare”, “we”, “us”). This policy explains what personal data we collect through the Ocare Club mobile and web apps, how we use it, who we share it with, and the choices and rights you have. We act as the data controller under Thailand’s Personal Data Protection Act (PDPA).

We collect only what we need to run the service:

• Account & identity — your name and email address, provided when you sign in with Google, Sign in with Apple, or LINE, plus an internal account identifier.
• Health & wellness data — information you enter in the Wellness Passport, health goals, health-dimension selections, and any health-assessment (Peakspan) inputs and results. This is sensitive data and we process it only with your consent.
• Activity data — activities you browse, RSVP to, and check in at; your engagement score and streak; and community posts you create.
• Photos — an image you choose from your device library for your profile or a check-in share card. We access your photo library only when you pick an image; we do not scan your library.
• Technical data — basic device and app information and logs, collected automatically as you use the app, needed to operate, secure, and troubleshoot the service.

This build of the app does not collect location data or payment information. If those features are enabled in a future version, this policy will be updated first.

• Provide and personalize the app — your feed, activities, goals, and progress.
• Enable sign-in and keep your account secure.
• Support wellness features and, where you use them, coordinate care with the providers you choose.
• Respond to your requests and provide customer support.
• Comply with legal obligations and protect the rights and safety of members.

We rely on your consent for health and other sensitive data, on the performance of our service to you for account and activity data, and on our legitimate interests and legal obligations where applicable. You can review and withdraw the consents you have given at any time in the app’s Privacy settings; withdrawing a consent does not affect processing already carried out and may limit features that depend on it.

We do not sell your personal data. We share it only with:

• Sign-in providers — Google, Apple, and LINE, to authenticate you, and Google Firebase, which we use for authentication infrastructure.
• Service providers — hosting and infrastructure vendors that process data on our behalf under contract.
• Healthcare providers you choose — where you use a care program, the relevant clinicians or labs receive the information needed to deliver that care.
• A third-party AI service — OpenRouter (openrouter.ai), which forwards the request to the AI model provider that serves it. This happens only if you switch on the “AI processing” consent, and only for the wellness suggestions described below.
• Authorities — where required by law or to protect safety.

AI processing — exactly what is sent, and to whom

When you complete the Peakspan wellness assessment and have given the “AI processing” consent, we send the following to OpenRouter to generate your activity, food and supplement suggestions:

• your six wellness dimension scores (numbers from 0–100),
• your overall Peakspan index and its band (for example “Good”), and
• which two dimensions scored lowest.

We do not send your name, email address, phone number, date of birth, photos, account identifier, or your individual assessment answers. The request contains numeric scores only, so the AI service cannot identify you from it. The suggestions come back to our servers and are stored with your assessment result in your account.

If you leave the “AI processing” consent off, nothing is sent to any AI service — the assessment still works and simply shows no AI-generated suggestions. You can withdraw the consent at any time in the app under Passport → Privacy; we will stop sending data from that moment. OpenRouter processes the request under its own privacy terms, published at openrouter.ai/privacy; because we transmit no identifying data, no personal data about you leaves our systems in that request.

Third parties are held to equivalent protection

Every recipient listed above processes your data on our instructions under a written agreement that requires confidentiality, security measures equivalent to our own, use limited to the purpose we specify, and no independent use or onward sale of your data. Where a recipient is outside Thailand, we rely on the cross-border transfer safeguards the PDPA requires. Sign-in providers (Google, Apple, LINE) act under their own published privacy terms for the authentication step you initiate.

For the AI request specifically, we do not rely on a negotiated contract for your protection: we transmit no data that identifies you, so the AI service receives numbers it cannot associate with any person. That, together with the consent being off by default, is the protection.

We keep your data for as long as your account is active and as needed to provide the service, then for any period required to meet legal, accounting, or safety obligations. When you delete your account, we delete or anonymize your personal data except where we must retain specific records by law.

Under the PDPA you can, subject to legal limits:

• Access a copy of your data and request a portable export.
• Correct data that is inaccurate or out of date.
• Delete your account and personal data.
• Withdraw consent, and object to or restrict certain processing.

You can export your data and delete your account directly in the app (Wellness Passport → Privacy), or contact us at [email protected].

We protect your data with encryption in transit, access controls, and other technical and organizational measures appropriate to the sensitivity of health information. No system is perfectly secure, but we work to keep your data safe and to notify you and the authorities of any breach as required.

Ocare Club is intended for adults and is not directed to children. We do not knowingly collect data from anyone under the age required by local law; if you believe a minor has provided us data, contact us and we will remove it.

We may update this policy as the app evolves or the law changes. We will post the new version here and update the effective date above; significant changes will be communicated in the app.

For privacy questions or to exercise your rights, contact LIBERTY AND SKY COMPANY LIMITED at [email protected].