Privacy Policy
Document Info
Company: CÔNG TY TNHH KỸ THUẬT SỐ LIVWELL (LIVWELL DIGITAL COMPANY LIMITED) Version: 2.0 · Language: English (Vietnamese version prevails in case of conflict) Last Updated: June 16, 2026 · Contact: admin@livwell.asia
Table of Contents
- Introduction & Scope
- Data Controller Information
- Definitions
- Information We Collect
- How We Use Your Information
- Sensitive Personal Data
- Sharing & Disclosure
- Cross-Border Data Transfer
- Data Storage & Security
- Your Rights
- Cookies & Tracking Technologies
- Children's Privacy
- Third-Party Links
- Policy Changes
- Contact & Complaints
- Governing Law & Dispute Resolution
- Language & Prevalence
1. Introduction & Scope
CÔNG TY TNHH KỸ THUẬT SỐ LIVWELL (trading as "Livwell Vietnam"), a company incorporated under the laws of the Socialist Republic of Vietnam with Tax Code 0316360993 and registered address at 62 Võ Văn Tần (phía sau), phường Xuân Hoà, Thành Phố Hồ Chí Minh, Việt Nam ("Livwell," "we," "our," or "us"), is committed to protecting and respecting your privacy.
This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. It applies to:
Our website at https://livwell.vn/ and https://admin.livwell.asia/ (the "Site");
Our mobile application "LivWell" (the "App");
All insurance products, wellness services, rewards programs, and other services offered through the Site and App (collectively, the "Services").
This Policy is issued in accordance with:
Law No. 91/2025/QH15 on Personal Data Protection ("Personal Data Protection Law 2025");
Decree No. 356/2025/ND-CP detailing a number of articles and measures for implementing the Personal Data Protection Law (“Decree 356”);
Law No. 08/2022/QH15 on Insurance Business ("Law on Insurance Business 2022");
Law No. 24/2023/QH15 on Electronic Transactions;
Law No. 86/2015/QH13 on Cyber Information Security;
Law No. 116/2025/QH15 on Cybersecurity;
Other applicable laws and regulations of the Socialist Republic of Vietnam.
Please Read Carefully
By accessing or using our Services, you confirm that you have read, understood, and consent to the collection, processing, use, and disclosure of your personal data as described in this Policy. If you do not agree with any part of this Policy, you must not use our Services.
2. Data Controller Information
Data Controller
Data Controller: CÔNG TY TNHH KỸ THUẬT SỐ LIVWELL (Livwell Vietnam)
Data Protection Officer: Vikas
Contact: vikas@livwell.asia
3. Definitions
For the purposes of this Policy, the following terms shall have the meanings set out below. These definitions align with the Personal Data Protection Law 2025 and the Law on Insurance Business 2022:
"Personal data" means digital data or information in another form that identifies or helps to identify a specific person. It includes basic personal data and sensitive personal data.
"Basic personal data" means personal data reflecting common identity and background elements regularly used in transactions and social relations, falling within the category issued by the Government. It includes: surname, middle name, and given name at birth, and other names (if any); date of birth; date of death or disappearance; gender; place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current place of residence, hometown, and contact address; nationality; images of the individual; telephone number, personal identification number, passport number, driver's license number, and vehicle license plate number; marital status; information on family relations (parents, children, spouse); information on the individual's digital accounts; and other information associated with a specific person or helping to identify a specific person.
"Sensitive personal data" means personal data tied to an individual's privacy that, when infringed, will directly affect the lawful rights and interests of agencies, organizations, and individuals, falling within the category issued by the Government. It includes: data revealing racial or ethnic origin; political, religious, and belief views; information about private life, personal secrets, and family secrets; health status; biometric data and genetic characteristics; data revealing the individual's sex life and sexual orientation; data on crimes and legal violations collected and stored by law enforcement agencies; the individual's location determined through location services; login name and password information for the individual's electronic identification account; images of the identity card, citizen identity card, and people's identity card; login name and password for bank accounts, etc.
"Data Processing" means an activity affecting personal data, including one or more of the following activities: collecting, analyzing, aggregating, encrypting, decrypting, modifying, deleting, destroying, de-identifying, providing, disclosing, and transferring personal data, and other activities affecting personal data.
"Data Controller" means an agency, organization, or individual that determines the purposes and means of processing personal data.
"Data Processor" means an agency, organization, or individual that processes data personal data at the request of the Data Controller or the Data Controller and Processor under a contract.
"Data Controller and Processor" means an agency, organization, or individual that determines the purposes and means of, and directly processes, personal data.
"Third Party" means an organization or individual other than the data subject, the Data Controller, the Data Controller and Processor, the Data Processor who participates in the processing of personal data in accordance with the law.
"Consent" means the data subject's voluntary, informed, and unambiguous expression of will by which the data subject agrees to the processing of their personal data.
"TPA" (Third-Party Administrator) means an organization that provides insurance administration services, including policy issuance, claims processing, and related services, on behalf of insurers.
"National ID" means Căn cước công dân (CCCD), Chứng minh nhân dân (CMND), passport, or any other government-issued identification document.
"LifeScore" means a proprietary health and wellness score generated by Livwell from your activity, health, and biometric data, used to personalize recommendations, determine reward eligibility, and inform insurance product offerings.
4. Information We Collect
We collect personal data through the following methods and categories:
4.1 Information You Provide Directly
When you register for an account, use our Services, or communicate with us, you may provide:
4.2 Information We Collect Automatically
When you use our Services, we automatically collect:
4.3 Information We Receive from Third Parties
We may receive personal data about you from:
Insurance Partners: Policy eligibility data, coverage confirmation, claims status updates;
Wellness & Rewards Partners: Redemption confirmations, benefit usage data;
Connected Devices & Wearables: Health and activity data from devices you authorize to connect to the App (e.g., Apple HealthKit, Google Health Connect). Note: data from these platforms passes through Apple's and Google's servers prior to being received by Livwell — please review their respective privacy policies;
Employers (for B2B Programs): Employee eligibility confirmation, corporate enrollment data;
Service Providers: Technical infrastructure, analytics, and verification service providers.
When we receive data from third parties, we will inform you of the source and purpose at the point of collection or within a reasonable period thereafter..
You may revoke LivWell's access to Health Connect data at any time via Settings → Health Connect → App permissions → LivWell (Android 14+), or via the Health Connect app → Data and access → LivWell → App permissions on earlier Android versions.
4.4 Information We Do NOT Collect
We do not knowingly collect:
Political opinions or religious beliefs;
Trade union membership;
Genetic data (beyond what may be inferred from standard health metrics);
Data concerning criminal convictions or offences.
5. How We Use Your Information
We process your personal data for the following purposes, each grounded in a lawful basis under the Personal Data Protection Law 2025:
5.1 Service Provision (Contractual Necessity & Consent)
5.2 Service Improvement & Analytics (Legitimate Interest)
5.3 Communications & Marketing (Consent)
You may withdraw your consent to marketing communications at any time by adjusting your in-app notification settings, clicking "unsubscribe" in any marketing email, or contacting us at Admin@livwell.asia. Withdrawal of marketing consent does not affect our ability to send you essential service-related communications.
5.4 Legal & Compliance Obligations
5.5 Automated Decision-Making (LifeScore)
Your LifeScore is generated through automated processing of your activity and health data. This score may influence which insurance products are available to you and on what terms. You have the right to:
Request information about the factors that influence your LifeScore;
Correct inaccurate input data that may affect your score;
Request human review of any eligibility decision by contacting Admin@livwell.asia.
6. Sensitive Personal Data — Specific Provisions
Enhanced Protection — Sensitive Personal Data
Under the Personal Data Protection Law 2025, the categories below are classified as Sensitive Personal Data. We apply enhanced protections to each. Your explicit, separate consent for each category is obtained through dedicated consent screens in the App — at the moment the relevant feature is first activated, not through general policy acceptance alone.
6.1 Biometric Data (Face Scan)
What we collect: Facial images and facial feature measurements captured through your device camera for insurance wellness assessment, identity verification, and service personalization.
How we use it:
Identity verification for account security and insurance policy issuance;
Insurance wellness assessment through facial analysis (e.g., stress indicators, vital sign estimation);
Personalization of health recommendations and coaching.
Specific safeguards:
Facial scan data is encrypted at rest and in transit using industry-standard encryption protocols consistent with our cloud infrastructure provider's (MongoDB Atlas) security guidelines;
Facial scan data is stored separately from general account data with additional access controls;
Processing by contracted facial analysis service providers acting on our documented instructions constitutes data processing, not third-party sharing, for the purposes of this Section;
Facial scan data is NOT shared with TPAs, insurance partners, employers, or any third party without your separate, explicit consent;
You may request deletion of your facial scan data at any time by contacting Admin@livwell.asia.
6.2 Health & Medical Data
What we collect: Health metrics (height, weight, heart rate, steps, calories, sleep data), health questionnaire responses, teleconsultation records, mobility assessments, and health scores derived from our proprietary algorithms.
How we use it:
Generating your personal LifeScore and wellness insights;
Providing personalized health recommendations and coaching;
Determining eligibility for insurance products and wellness rewards;
Facilitating teleconsultation and health services.
Specific safeguards:
Health data is processed primarily within Livwell's systems and is NOT shared with employers in individually identifiable form (only aggregated, de-identified trends);
Health data shared with teleconsultation partners (e.g., DiaB) is limited to what is necessary for the specific consultation;
Health data is NOT sold, rented, or traded to any third party.
6.3 National ID Data
What we collect: Căn cước công dân (CCCD) number, Chứng minh nhân dân (CMND) number, or passport number, including images of these documents where required for KYC compliance.
How we use it:
Identity verification for account creation and insurance policy issuance;
Compliance with know-your-customer (KYC) requirements under Law No. 14/2022/QH15 on Anti-Money Laundering;
Transmission to TPAs solely for the purpose of loading insurance policies and processing claims.
Specific safeguards:
National ID number is retained for the duration of your insurance policy + 5 years after termination, as required by insurance law;
National ID document images, if collected, are purged within 30 days of successful identity verification (unless retention is required by insurance regulations);
National ID data is shared with TPAs ONLY for insurance policy administration and claims processing;
National ID data is NOT shared with wellness partners, rewards partners, employers, or any other third party.
6.4 Your Specific Consent for Sensitive Data
Consent for Sensitive Personal Data
Your consent for each category of Sensitive Personal Data is collected separately and specifically through dedicated consent screens within the App — at the moment the relevant feature is activated. This consent is:
Voluntary: You may choose not to provide Sensitive Personal Data, but this may limit your access to certain Services (e.g., insurance products require National ID; LifeScore requires health data);
Specific: The purposes for each category are clearly stated at the point of consent;
Withdrawable: You may withdraw consent at any time via Settings → Privacy or by contacting Admin@livwell.asia.
Note on consequences: Withdrawal of National ID consent will prevent insurance policy issuance and claims processing. Withdrawal of health data consent will disable LifeScore and personalized wellness features. We will inform you of the specific consequences at the time of your withdrawal request.
7. Sharing & Disclosure of Your Information
We Do Not Sell Your Data
We do not sell, rent, or trade your personal data. We share your personal data only as described below.
7.1 Sharing with Third-Party Administrators (TPAs)
To provide insurance services, we share the following data with TPAs:
For health insurance claims adjudication, we may request your separate consent at the time of claim submission to share specific medical documentation (such as diagnosis records or hospital discharge summaries) with the relevant TPA. You may decline, in which case alternative claims processing routes will be provided.
We do NOT share with TPAs: Biometric data, health data, activity data, facial scan data, or any other Sensitive Personal Data beyond what is strictly necessary for insurance administration.
7.2 Sharing with Insurance Partners
We share with insurance companies (insurers) the data necessary to underwrite, issue, and manage insurance policies you have applied for or purchased. This may include identity and contact data. Health data will only be shared with insurers where required for underwriting and only with your explicit, separate consent obtained at the point of insurance application.
7.3 Sharing with Service Providers
We engage third-party service providers who process data on our behalf under strict contractual obligations:
- CleverTap — Push + engagement analytics. Receives health data: No
- PostHog — Product analytics. Receives health data: No
- Firebase — Push notifications, crash reporting. Receives health data: No
- Intercom — In-app support messaging. Receives health data: No
- Branch — Deep linking. Receives health data: No
- DiaB — Teleconsultation. Receives health data: Yes (limited to consultation context)
- MongoDB Atlas (GCP Singapore) — Data storage / hosting. Receives health data: Yes
All service providers are contractually bound to:
Process data only on our documented instructions;
Implement appropriate technical and organizational security measures;
Not retain, use, or disclose data for any purpose other than providing services to us;
Comply with the Personal Data Protection Law 2025 and applicable data protection laws;
Notify us immediately of any data breach.7.4 Sharing with Employers (B2B Programs)
For users enrolled through corporate wellness programs, we share with the sponsoring employer only aggregated, de-identified data about workforce wellness trends. We do NOT share individual employee health data, activity data, biometric data, or any information that could identify a specific employee's health status or behaviors.
7.5 Sharing Required by Law
We may disclose your personal data to relevant agencies, organizations, and individuals in certain special cases permitted by law, as follows:
To protect the life, health, honor, dignity, and lawful rights and interests of you or another person in urgent cases; to protect the legitimate rights or interests of us, others, or the interests of the State or of agencies and organizations, as necessary, against the infringement of the aforementioned interests;
To address an emergency; a threat to national security; to prevent and combat riots, terrorism, crime, and legal violations;
To serve the operations of state agencies and state management activities as provided by law;
To act in accordance with your agreement with the Company or with relevant agencies, organizations, and individuals as provided by law;
Other cases as provided by law.
7.6 Business Transfers
In the event of a merger, acquisition, reorganization, or sale of all or part of our assets, your personal data may be transferred to the successor entity. We will notify you of any such transfer and ensure the recipient is bound by obligations consistent with this Policy.
8. Cross-Border Data Transfer
8.1 Current Storage Location
Data Location
Your personal data is currently stored on MongoDB Atlas cloud infrastructure with a primary instance located in Singapore. We have completed (or are in the process of completing) registration with the competent Vietnamese authority under Article 20 of the Personal Data Protection Law 2025 for this cross-border transfer. Where facial scan data is processed by our contracted service provider, the applicable cross-border transfer obligations for that processing are addressed separately under the relevant data processing agreement.
8.2 Data Localization Commitment
We acknowledge the data localization requirements under the Personal Data Protection Law 2025 and Vietnamese law. We are committed to:
Establishing Vietnam-based data storage infrastructure as soon as MongoDB Atlas or equivalent secure cloud infrastructure becomes available with a Vietnam region;
Migrating or replicating Vietnamese user data to Vietnam-based storage upon availability;
Ensuring that any cross-border transfer complies with the requirements of the Personal Data Protection Law 2025, including conducting a transfer impact assessment and implementing appropriate safeguards.
8.3 Safeguards for Cross-Border Transfers
For any cross-border transfer of your personal data, we ensure:
The recipient jurisdiction provides adequate protection for personal data, or we implement contractual clauses, binding corporate rules, or other mechanisms to ensure equivalent protection;
The transfer is necessary for the performance of our contract with you or for the provision of Services you have requested;
We maintain documentation of all cross-border transfers and the safeguards applied.
9. Data Storage & Security
9.1 Security Measures
9.2 Data Breach Response
Breach Notification
In the event of a personal data breach, we will:
Immediately activate our incident response protocol;
Immediately notify the affected data subjects within 72 hours from the time the breach is detected;
At the same time, report to the competent state authority as required;
Take immediate remedial measures to contain and mitigate the breach.
9.3 Data Retention
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized.
10. Your Rights
Your Rights at a Glance
Under the Personal Data Protection Law 2025 you have the right to: Know · Consent · Withhold Consent · Withdraw Consent · View · Rectify · Request Rectification · Request Provision · Erase · Restrict · Object · Complain · Request Compensation · Request Personal Data Protection
To exercise any right: Admin@livwell.asia — we respond within 02 working days.
10.1 Right to Know
You have the right to know about the processing of your personal data, including the purposes, categories of data processed, and parties with whom data is shared.
10.2 Right to Consent / Withhold Consent / Withdraw Consent (*)
You have the right to consent or withhold consent to our processing of your personal data, expressed through the options in our App or on records with the relevant parties.
Where the processing of personal data is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
10.3 Right to Access/ View/ Rectify/ Request Provision of Data
You have the right to access the personal data we hold about you and view much of your information directly through the App.
You have the right to rectify inaccurate or incomplete personal data. You can update most information directly through the App.
To request comprehensive data access/ provision or rectification, please contact Admin@livwell.asia.
10.4 Right to Erasure (*)
You have the right to request deletion of your personal data when:
The data is no longer necessary for the purposes for which it was collected;
You withdraw your consent and there is no other legal basis for processing;
The data has been processed unlawfully;
Deletion is required by law.
Upon receiving a verified erasure request, we will erase your data within 20 days if the data is processed solely by us/ 30 days if a third party is involved, and may be extended by a further 20 days in complex cases, except for data we are legally required to retain.
10.5 Right to Restrict Processing (*)
You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data or object to processing.
10.6 Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller where technically feasible.
10.7 Right to Object (*)
You have the right to object to the processing of your personal data for direct marketing purposes at any time.
(*) However, depending on the specific circumstances, we may need to clarify with you that withholding consent / withdrawing consent / erasure / restriction / objection to the processing of personal data may affect our ability to provide services under the contract. We will always ensure you are fully informed so you can consider before deciding. After you confirm the exercise of these rights, the service may be limited or unavailable as a result, and the contract may be terminated if the service can no longer be provided.
10.8 Right to Complain
You have the right to lodge a complaint with us or the competent state authorities if you believe your data protection rights have been violated.
10.9 Right to Claim Compensation
Under Article 4 of the Personal Data Protection Law 2025, you have the right to claim compensation for damages caused by violations of personal data protection regulations.
10.10 Right to Request Personal Data Protection
You have the right to request that we and the parties involved in processing your personal data take measures and solutions to protect personal data in accordance with the law.
10.11 Exercising Your Rights
Contact us at Admin@livwell.asia. We respond within 02 working days of receipt. Identity verification may be required. No fee will be charged unless your request is manifestly unfounded or excessive.
11. Your Obligations
Pursuant to the Personal Data Protection Law 2025, you have the following obligations:
Protect your own personal data;
Respect and protect the personal data of others;
Provide your personal data fully and accurately in accordance with the law, under a contract, or when consenting to the processing of your personal data;
Comply with the law on personal data protection and participate in preventing and combating acts that infringe personal data.
When exercising your rights and obligations regarding your personal data as above, you must fully comply with the following principles:
Act in accordance with the law; comply with the data subject's obligations under the contract. The exercise of the data subject's rights and obligations must aim to protect your lawful rights and interests;
Do not cause difficulty or obstruct the exercise of the legal rights and obligations of us and the relevant third parties in processing personal data;
Do not infringe the lawful rights and interests of the State or of other agencies, organizations, and individuals.
12. Cookies & Tracking Technologies
12.1 Types of Cookies Used
12.2 Your Choices
You can control cookies through your browser settings and in-app preferences. Disabling non-essential cookies may affect the functionality of our Services.
13. Children's Privacy
Our Services are not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you are between 16 and 18 years of age, you must obtain the consent of your parent or legal guardian before using our Services.
If we become aware that we have collected personal data from a child under 16 without verified parental consent, we will delete that data promptly. Contact us at Admin@livwell.asia if you believe a child under 16 has provided us with personal data.
14. Links to Third-Party Services
Our Services may contain links to third-party websites, applications, or services not owned or controlled by Livwell. This Policy does not apply to those third-party services. We are not responsible for their privacy practices or content.
15. Changes to This Privacy Policy
When we make material changes, we will:
Post the updated Policy with a new "Last Updated" date;
Notify you through the App or by email where changes are significant;
For changes that materially affect the processing of your Sensitive Personal Data, we will seek your explicit renewed consent through the App before such changes take effect — continued use of the Services alone will not constitute consent for such changes.
16. Contact & Complaints
If you are not satisfied with our response, you have the right to lodge a complaint with:
Department of Cybersecurity and High-Tech Crime Prevention (A05) Ministry of Public Security, Socialist Republic of Vietnam
17. Governing Law & Dispute Resolution
17.1 Governing Law
This Policy and any dispute arising out of or in connection with it shall be governed by the laws of the Socialist Republic of Vietnam, including the Personal Data Protection Law 2025 and the Insurance Business Law 2022.
17.2 Dispute Resolution
Step 1 — Negotiation: Good-faith negotiations within 30 days of written notice of dispute.
Step 2 — Arbitration: Disputes not resolved by negotiation shall be referred to the Vietnam International Arbitration Centre (VIAC), conducted in Ho Chi Minh City, in the Vietnamese language, by a sole arbitrator. The arbitral award shall be final and binding.
Individual consumers also have the right to seek assistance from the Vietnam Competition and Consumer Authority (VCCA) under the Law on Consumer Rights Protection.
17.3 Exception for Injunctive Relief
Either party may seek injunctive or equitable relief from the competent Vietnamese courts without first engaging in the above process.
18. Language & Prevalence
Language
This Policy is published in both English and Vietnamese. In the event of any inconsistency or discrepancy between the two versions, the Vietnamese version shall prevail for all purposes under Vietnamese law.
This Privacy Policy was last updated on June 16, 2026.
Prepared by Myna — Chief of Staff to Vikas Dhar — Co-founder, Livwell
