PRIVACY NOTICE

Last updated September 09, 2026

This Privacy Notice is designed to inform you of how Meticuly Incorporated, Meticuly Company Limited and companies within the same corporate group (collectively referred to as “Meticuly” or “the Company”) collects, uses, and protects your Personal Data. Whether you are accessing our product/services or Meticuly platform as an individual or on behalf of an entity, this notice applies to all information provided during the application for or use of our products and services. We are committed to processing your data—including health-related information—with the highest level of security in accordance with global standards. This includes compliance with the Health Insurance Portability and Accountability Act (HIPAA), the Personal Data Protection Act B.E. 2562 (PDPA), the EU General Data Protection Regulation (GDPR), and other applicable data protection laws. The following sections outline our collection methods, processing purposes, disclosure protocols, retention periods, and your statutory rights as a data subject.

Third-Party Account Sign-In (including Google Sign-In)

Meticuly allows you to sign in to the Meticuly platform using an account provided by a third-party identity provider, including a Google Account. In this Privacy Notice, “Third-Party User Data” means the Personal Data that Meticuly receives from such a provider when you choose to sign in in this way, and Personal Data that Meticuly receives from Google APIs is Third-Party User Data that is also referred to as “Google user data”. The types of Third-Party User Data collected, and how Meticuly uses, discloses, protects, retains, and deletes it, are set out in the corresponding sections below. Where a provision of this Privacy Notice relating specifically to Third-Party User Data differs from a general provision, the specific provision shall prevail in respect of Third-Party User Data.

Restrictions on the use of Third-Party User Data. Meticuly does not sell Third-Party User Data, including Google user data, and does not transfer it to data brokers, information resellers, or advertising platforms. Meticuly does not use or transfer it for advertising of any kind, including targeted, personalised, interest-based, or retargeted advertising, nor to determine credit-worthiness or for lending purposes. Meticuly does not use Google user data to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models. Accordingly, Third-Party User Data, including Google user data, is excluded from the marketing, remarketing, disclosure to business alliances, cookie-based tracking, and automated profiling activities described elsewhere in this Privacy Notice.

Limited Use. Meticuly’s use and transfer of information received from Google APIs to any other application adheres to the Google API Services User Data Policy, including the Limited Use requirements. That policy is available at
https://developers.google.com/terms/api-services-user-data-policy.

Types of information collected by Meticuly

Meticuly shall collect and process the following information:

Identifiable information: This shall include any information identifying you such as name, surname, title, date, month, and year of birth, number of and information in the identity card, passport number, taxpayer number, nationality, username, or other identifiable information.
Third-Party User Data (including Google user data): Where you sign in using a third-party account, the information that the provider shares with Meticuly at your request. From Google, Meticuly requests only the openid, email, and profile scopes and receives only your Google account unique identifier, your name, your email address and its verification status, your profile picture URL, and your locale preference. Meticuly does not request or receive access to Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, or any other Google service, and at no time receives or stores the password to your third-party account.
Contact information: This shall include any information provided by you to the Company to enable the Company to contact you such as mail address, e-mail, social media accounts, home telephone number, and mobile phone number.
Transaction information: This shall include, but not be limited to details regarding payments to or from you, bank accounts, details of payment through your card, your contact with the Company, and details of products or services purchased by you from the Company.
Information from digital devices: This shall include an online identifier, IP Address, type of network information operating system, type, and version of browser web, Cookies, activity records, specific equipment identifier, coordinate information, photographs, video, and audio records.
Information about the use of the website/communication information: While you are using communication channels, applications, websites, or other social media of the Company or of a third person, the Company uses an automated data collection technology (including Cookies, web beacon, or tracking system of a third person to analyze information and for the purpose of marketing) to collect information about you and your online activity such as links you clicked, pages and contents you read, content response times, unsuccessful downloading, and times you used to view websites.
Marketing research and your comments: This shall include any information you have voluntarily shared with the Company regarding your experience of use of the products and/or services with the Company such as your need and interest, your information and comments provided when joining research activities and/or marketing surveys or your contact information provided by you to the Company for sending news and updates of the Company.
Profile: This shall include details of logging in, your purchases or orders, your interests or settings, comments, or survey responses.
Information acquired from customer support services: This shall include any communication with the staff of the Company for service provisions such as contact records, complaints, and/or disputes, e-mails, letters sent by you to the Company, and your comment records, and any consultation given by the Company to you.
Details of other persons provided by you: This shall include any information on other persons provided by you to the Company which the Company may have or not have a legal relationship therewith directly such as identified or contact information of those persons.
Personal Data in the special type (sensitive data): Any sensitive data necessary to be used for selling the products and/or services to you and for performing the duty as specified by law such as your health information.

Sources of information collected by Meticuly

Meticuly shall collect your information from the following sources:

Information that you have given Meticuly: Such as information that you filled in the form, order form, or other forms provided by the Company to you on the website of the Company.
Information shared with Meticuly by a third-party identity provider at your request: When you choose to sign in with a Google Account or another third-party account, that provider shares the Third-Party User Data described above with Meticuly, with your authorisation.
Information that Meticuly has created about you: This shall include information on sale and marketing such as details on the products and/or services received and selected by you, animation or audio information such as an image or audio records between you and staff of the Company while providing services, and CCTV information, etc.
Information collected by Meticuly from other sources: Such as information that the Company has received from a business partner and information that you shared on social media.

If you do not provide, or withdraw your consent for, the collection, use, or disclosure of Personal Data that Meticuly has informed you is necessary, Meticuly may be unable to sell products or provide services requested by you, perform our contractual obligations, enter into an agreement with you, or comply with our legal obligations. This may result in our products or services being restricted, suspended, or terminated, as applicable.

If you provide Personal Data of another individual to Meticuly, or request that we disclose such Personal Data to a third party, you represent and warrant that you have obtained the necessary consent from such individual, or are otherwise legally permitted to do so. You must also ensure that the individual has been informed of this Privacy Notice and understands how their Personal Data will be collected, used, and disclosed.

Use of the Personal Data

Meticuly may collect, use, and disclose (“Process or Processing”) the Personal Data fairly and correctly in accordance with the law and for only specific objectives specified by law (the “Processing Base(s)”).

There are many Processing Bases under the applicable law on Personal Data protection based on the circumstances and objectives of the Processing activity and the type of information processed.

Meticuly may cite any of the following Processing Bases for processing your Personal Data:

Upon it is necessary to comply with an agreement or to perform the duty the Company has to you or for proceeding as your request before entering into an agreement with you;
For legal compliance of the Company;
Upon the processing of your Personal Data shall be for the legitimate interests of the Company; and
Upon you have given consent to the Company for processing your Personal Data.

In the event that they are sensitive data or Personal Data in the special type under the relevant law on Personal Data protection other than the above-mentioned Processing Bases, the Company shall process the Personal Data in compliance with other provisions specified by the law on Personal Data protection.

Certain processing activities may base on more than one of the Processing Bases. In such cases, the Company may rely on any of the Processing Bases to process your Personal Data.

Objectives for processing your Personal Data and the Processing Base(s) shall be as the following table:

1. Selling products and/or services

To confirm and verify your identity.
To provide services and/or sell products of the Company to you.
To manage the relationship between the Company and you or your business.
To perform as per your instruction.
To collect outstanding debts payable to the Company (if any).
To study how you have used the products and/or services of the Company or of other entities.
To be used to remind of benefits you should have.
To communicate with you regarding the products and/or services.

Processing Bases:

Upon it is necessary to comply with an agreement or to perform the duty the Company has to you or for proceeding as your request before entering into an agreement with you.
For legitimate interests of the Company.

2. Customer services

To respond to or handle requests from you.
To manage fees, charges, or interest payable to the customer’s account (if any); and
To improve the proficiency and working of the website of the Company (Cookies website).

Processing Bases:

Upon it is necessary to comply with an agreement or to perform the duty the Company has to you or for proceeding as your request before entering into an agreement with you.
For legitimate interests of the Company.

3. Marketing activities

To make the marketing specific to customer groups.
To provide you with information on the products and/or services of the Company and/or the group of associated companies and/or alliances of the Company you may be interested in.
To enable social media providers to send you information regarding the products and/or services of the Company you may be interested in.
To communicate with you through channels (including via email, telephone, text, social media, post, or in person); and
To maintain and update your contact information in the appropriate case.

Processing Bases:

Upon you have given consent to the Company for processing your Personal Data.
For legitimate interests of the Company.

4. Disclosure of your Personal Data to a business alliance of the Company for the purpose of marketing of the said person

To enable the business alliances of the Company to present its products and/or services to you.

Processing Bases:

Upon you have given consent to the Company for processing your Personal Data.

5. Business development

To understand and develop new products and/or services suitable for the customers’ needs and to develop the business proficiency of the Company.
To test, research, analyze, and develop the form of use of new products and/or services.
To plan the development of the currently existing products and/or services.
To handle your complaints (if any).
To make a statistical report or marketing research.
To make reports and do internal audits.
To make a survey form or listen to your comments regarding the products and/or services of the Company; and
To make academic research.

Processing Bases:

Upon it is necessary to comply with an agreement or to perform the duty the Company has to you or for proceeding as your request before entering into an agreement with you.
For legitimate interests of the Company.
Upon you have given consent to the Company for processing your Personal Data.

6. Legal compliance of the company

To confirm and verify your identity.
To submit reports in accordance with the law to relevant agencies.
To comply with relevant laws, rules, and regulations; and
To establish the right of claim in accordance with the law.

Processing Bases:

For legal compliance of the Company.
For legitimate interests of the Company.

7. Third-party account sign-in (including Google sign-in)

To create, authenticate, and maintain your Meticuly user account using Third-Party User Data, such as Google user data.
To verify your identity and to detect and prevent unauthorised access to the Meticuly platform.
To display your name and profile picture to you within the platform.
To send you service, security, and account-related communications.
To maintain the access control and audit records required by Meticuly’s quality management system and by applicable medical device regulations.

Meticuly does not use Third-Party User Data, including Google user data, for any purpose other than those listed above.

Processing Bases:

Upon it is necessary to comply with an agreement or to perform the duty the Company has to you or for proceeding as your request before entering into an agreement with you.
For legitimate interests of the Company.

8. Other processing activities

To process any information regarding the objectives specified in this table.

Processing Bases:

The same Processing Base as the said relevant activities.

Disclosure of the Personal Data

Meticuly may disclose your Personal Data or the Personal Data of a person relating to your business to a third person to the extent permitted by law such as in the event that the Company or a third person:

Service Provision: Where it is necessary to disclose your Personal Data to third parties to provide products and/or services requested by you (for example, payment processing or service delivery).
Legal Obligations: Where disclosure is required to comply with applicable laws, regulations, or orders from government authorities, or to fulfill duties in the public interest (for example, preventing fraud, corruption, or tax evasion).
Legal Claims and Proceedings: Where it is necessary for the establishment, exercise, or defense of legal claims, including in connection with dispute resolution, litigation, or regulatory investigations.
Legitimate Business Interests: Where disclosure is necessary for Meticuly’s legitimate business interests or those of third parties, such as risk management, identity verification, outsourcing to service providers, or assessing the suitability of products and services.
Vital Interests: Where disclosure is necessary to prevent or mitigate a threat to life, body, or health of any person.
Consent: Where you, or a person related to your business, have provided consent for such disclosure.

For Personal Data which is sensitive data or the Personal Data in the special type under the relevant laws on Personal Data protection other than foregoing Processing Base(s), the Company may disclose the said information under other provisions specified by the law on Personal Data protection.

Certain disclosure of information may base on more than one of the Processing Bases. In such case, Meticuly may use any of the specified Processing Base(s) for such disclosure.

Meticuly may disclose your Personal Data or the Personal Data of a person relating to your business for the above-mentioned objectives to other persons. These persons shall include:

A contractor, agent, or service provider which provides services or works for the Company;
Cloud provider;
An identity provider that operates the sign-in service on Meticuly’s behalf, in respect of Third-Party User Data;
A hospital, company providing medical services or personnel;
A service provider making advertisements in way of following up with customers or target groups (remarketing), provided that Third-Party User Data, including Google user data, is never disclosed to such a service provider or used for advertising or remarketing purposes;
Business alliances of the Company; and
Other persons that the Company has disclosed your Personal Data as instructed by you.

Third-Party User Data, including Google user data, is disclosed only to the identity provider and the cloud provider named above, each of which acts as a processor under a written data processing agreement and processes the data solely on Meticuly’s documented instructions, and where disclosure is required by applicable law or legal process. Meticuly does not disclose Third-Party User Data to any other person.

Meticuly shall not use the Personal Data for any objectives other than those described. If the Company wishes to collect or use other additional information not described in this Privacy Notice, the Company shall notify you thereof and/or request consent from you first to be in conformity with the relevant laws on Personal Data protection.

Transfer of Personal Data to a foreign country

Your Personal Data may be transferred to be processed in another country where an associated company or a service provider of Meticuly is operating the business or shall be in accordance with the laws. Meticuly shall perform all necessary and appropriate stages to ensure that your Personal Data have been securely stored and shall be in accordance with this Privacy Notice as well as provisions under the relevant laws on Personal Data protection. In certain cases, it may include entering into relevant standard contracts (or equivalent measures) with a party outside Thailand.

Retention of the Personal Data

Meticuly will retain your Personal Data for as long as necessary to provide our services and maintain our relationship with you, or until we receive and process your request to withdraw consent or delete your Personal Data, as described below. We may retain certain Personal Data for a longer period where required or permitted by applicable laws, regulations, contractual obligations, or for the establishment, exercise, or defense of legal claims.

When your Personal Data is no longer required for these purposes, Meticuly will take reasonable steps to delete, destroy, or anonymize such data in accordance with applicable laws.

Third-Party User Data, including Google user data, is retained only for as long as your Meticuly account remains active. You may delete your account, or request deletion of your Third-Party User Data, at any time by contacting the Data Protection Officer at dpo@meticuly.com. Meticuly will delete or irreversibly anonymise the data within thirty (30) days of the request, except where retention is required by applicable law. You may also revoke Meticuly’s access to your Google Account at any time at

https://myaccount.google.com/permissions.

Your rights as the data subject

Under the terms and exceptions of the relevant laws on Personal Data protection, you have the rights as follows:

Right to withdraw consent: You can withdraw the consent given by you to Meticuly. Your withdrawal of consent shall not affect the Processing of your Personal Data existing before such withdrawal shall be effective.

If your consent is not a precedent condition, the said withdrawal may restrict the Company to fully granting benefits or experience of the use of the services of the products and/or services you received whether wholly or partly.

If your consent is a precedent condition, the said withdrawal may make the services of the Company have a restriction, suspension, cancellation, or prohibition under the law, as the case may be.

Whether in any case, Meticuly shall not be responsible for any loss arising and expressly reserves the right under the law of the Company in all respects in case of your consent leading to be restricted, suspended, canceled, or prohibited under the law.

If you would like to review, update, correct, or delete your Personal Data, please contact Meticuly's Data Protection Officer (DPO) using the contact information provided at the end of this Privacy Notice.

Right of access: You shall be entitled to receive a copy of Personal Data about you under the responsibility of the Company and shall be entitled to inspect whether the Company has correctly processed your Personal Data in accordance with the law.
Right to rectification: You shall be entitled to request to rectify incomplete or inaccurate information about you collected by the Company.
Right to erasure: You can request the Company to erase or destroy your Personal Data for no reason the Company can process your Personal Data. Furthermore, you also have the right to request the Company to erase or destroy the Personal Data you have exercised the right to object to the processing of your Personal Data (please read below).
Right to object: You can object to the processing of your Personal Data if the Company is relying on the Processing Base for the legitimate interests of the Company or of a third person if you have the right to object to the processing of your Personal Data with the said reason. Furthermore, you also have the right to object the Company to processing your Personal Data for the purpose of direct marketing.
Right to restriction of processing: You shall be entitled to request the Company to restrict the processing of your Personal Data such as in the event you wish the Company to restrict the use of your Personal Data the Company is rectifying it.
Right to transfer: You shall be entitled to request the transfer of your Personal Data to another person or entity.
Right to complain: You can submit complaints to a competent data protection organization if you believe that the Company has not complied with the provisions of the relevant laws on Personal Data protection.

If you wish to exercise any of these rights, you may submit your request by contacting our Data Protection Officer at the contact details below. Meticuly will consider and respond to your request in accordance with applicable laws.

Please note that we may require you to provide proof of identity or other authentication information before processing your request. We will process your request without undue delay and will inform you in advance if additional time is required. The exercise of your rights is subject to applicable laws and may be limited where necessary to comply with legal obligations or to protect the legitimate interests of Meticuly or other parties.

Security Protection of your Personal Data

Meticuly gives importance to your privacy. Therefore, Meticuly emphasizes to assure the security of your Personal Data. The Company shall inspect and take security measures regularly both in readiness and appropriateness of equipment, technique, and organization of the security measures when processing your Personal Data.

Furthermore, the personnel of Meticuly shall be trained to handle Personal Data safely and with respect to your privacy. If they fail to comply therewith, the Company shall take disciplinary punishment.

Third-Party User Data, including Google user data, is transmitted using TLS 1.2 or above, is encrypted at rest, and is stored in Meticuly storage. Access is restricted to authorised Meticuly personnel on a documented need-to-know basis, and all access is logged and reviewed periodically.

The Company uses Cookies on certain websites and/or platforms of Meticuly to collect information about the users of the website of the Company (such as user settings and recording session information). Cookies are text files with small pieces of data that the website or application sends to your browser for collecting certain information in your system. The Company uses various types of Cookies for different purposes. You can adjust the settings in your browser or within your mobile devices, and you can be notified when you have received Cookies in the system. Also, you can inactivate the use of Cookies at all times by changing the settings in your browser, and you can do it through your mobile device as well. However, by changing your settings, you may not use certain functions or visit the website of the Company.

If you wish to have more information on how the Company uses Cookies, please read the policy on Cookies of the Company that the Company has published on the website of the Company.

Additional agreements for customers residing in the European Economic Area (EEA)

A. Automated Processing

To provide the services and/or products of the Company, the Processing of your Personal Data may include analyzing your profiling by using your behavior analyzing software to calculate results and risks. The Company may rely on the profiling analyses and/or other automated means for making decisions on activities of the Company about you as specified in this Privacy Notice.

B. Transfer of the Personal Data outside the European Economic Area (EEA)

Your Personal Data may be transferred to be processed in a country an associated company or a service provider of the Company is operating its business or shall be in accordance with laws. The Company shall perform all necessary and appropriate stages to ensure that your Personal Data has been securely stored and shall be in accordance with this Privacy Notice as well as provisions under the relevant laws on Personal Data protection. In certain cases, it may include entering into relevant standard contracts of the European Union (EU) (or equivalent measures) with a party outside the European Economic Area. (For more information, see this link:

https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/rules-international-data-transfers_en)

Any agreement for customers residing in the EEA shall not apply to those who are not residing in such EEA.

Contact of the Data Protection Officer (DPO)

Should you have any questions or inquiries regarding the protection of your Personal Data, you can contact the Data Protection Officer (DPO) of the Company who is responsible for the protection of your Personal Data, by sending to:

Data Protection Officer (DPO)

email: DPO@meticuly.com

The United States: Meticuly Incorporated

300 Delaware Ave. Suite 210 #359, Wilmington, DE 19801, United States

Tel: +1 (302) 779-0040

The United Kingdom: Meticuly Innovations Ltd

Office 235, 23 King Street, Cambridge, CB1 1AH, UK: England

Outside the above region: Meticuly Company Limited

924 Block 28, Rm. B116-118, B210-212, Soi Chula 7, Wang Mai,Pathum Wan, Bangkok, Thailand 10330

Tel: +66 (2) 334-0539

Change of the Privacy Notice and your duty to notify the change of the Personal Data

This Privacy Notice has been updated on the date as above written. You can request to have the previous Privacy Notice by contacting the Company. The Company may improve and alter this Privacy Notice from time to time to be in conformity with the practice and/or relevant laws as well as the provision of services of the Company. The Company shall notify you of the latest update to the Privacy Notice through the communication channels of the Company.

Please inform the Company of any change of your Personal Data (if any) throughout the time of maintaining the relationship with the Company to enable the Company to correct your Personal Data to be accurate and updated.