Work Talk Privacy Policy

This is Privacy Policy ("Policy") explains how RXILIENT HEALTH PTE LTD and its subsidiaries (collectively the "RXILIENT", "we", "us", or "our") collect, use, disclose, and protect personal data. This Policy applies to all personal data you provided to us or that we collect when you access Work Talk application ("Apps"), or services (the "Service").

By using our Work Talk application, or the Service, or by providing personal data to us, you consent to the practices described in this Policy. If you do not agree, please do not use the App or Services and contact your administrator to request account deletion.

1. Personal Data We Collect

1.1 Data collected directly from you

When you use our website, interact with our staff, or use our services, we may collect personal data directly from you. This may include, but is not limited to: -

• your contact information, including your (first and last) name, (billing and/or delivery) address, birthdate, email address, profile photo, job title, department and, your telephone number.

• other information required to process orders or to provide services (product or service details, banking or payment information);

• the preferences and interests stored in an online profile or account;

• details of any contact with our customer service team, including inquiries, complaints, and contact history; and/or

• where applicable and to the extent permitted by applicable employment law, data related to your use of App features for work purposes.

1.2 Data collected by automated means

Various technologies may be used on our mobile and web-based applications in order to make them more user-friendly, effective and secure. Such technologies may lead to data being collected automatically by us or by third parties on behalf of us. This data does not generally, but may, contain a user's personal data. Examples of such technologies include:

A. Usage and Technical Data: When you use the Service, the information below may be collected:

• Device and technical information: device model, operating system version, unique device identifiers (Android ID / IDFV), IP address, network type, screen resolution, and app version.

• Usage data: access timestamps, features used, in-app navigation, and click-stream data.

• Diagnostic data: crash logs, error reports, and performance metrics collected via Firebase Crashlytics and Firebase Analytics.

• Push notification token (FCM device token) to deliver service notifications.

• Approximate location inferred from your IP address for security and regional compliance purposes. We do not collect precise GPS location without your explicit consent.

B. Cookies and Similar Technologies (where applicable): Currently, we do not use cookies, web beacons, pixels, or similar tracking tools for the purposes described in this Policy. However, this Statement is provided to account for potential future use of such technologies, in compliance with applicable data protection laws.\ C. Flash cookies. In certain cases, Adobe Flash or similar technologies may store information on your device that cannot be deleted through the browser. These can be managed according to instructions provided by the software provider.

D. Social plug-ins: When interacting with social media features (e.g., Facebook, Twitter), information about your activity may be shared with those platforms. Please refer to their privacy policies for details.

E. Location-based services: Certain services may use GPS or other location data to provide maps, directions, or location-specific features. You can choose to enable or disable these services.

F. Analytics. We may use analytics services such as Google Analytics to collect and analyze website and application usage data, including click-stream data and cookie information. These services may help us improve usability, content relevance and functionality. Analytics data may also be linked to your online profile where applicable.

G. Advertising and retargeting technologies: We or our business partners may use tracking technologies to display advertisements based on your browsing behaviour. Such technologies collect non-personally identifiable information, and we do not store personal data with these tools.

Data collected by these automated means may be used to enhance user experience, deliver relevant content, improve services, detect and prevent fraud, and comply with legal or regulatory obligations. Some of these technologies may involve third-party providers who act on our behalf and are contractually required to protect your personal data in accordance with this Policy.

1.3 Sensitive Information and Health Data

In addition to the categories described above, we may collect sensitive information as defined under applicable local laws. This may include:

• Certain characteristics of protected classifications (e.g., race, gender, age, disability).

• Precise geolocation data (collected only with your explicit consent via an in-app opt-in prompt).

• Account login credentials and passwords.

• Health information, including health data as described below (where you voluntarily input health-related data into the AI Chat or CRM features. Work Talk, as an internal enterprise tool, does not require health data to function; you are not required to input such data, and choosing not to do so will not affect your access to any core feature).

• Financial information (where you voluntarily input financial data into the CRM feature).

Sensitive information and health data may be shared within RXILIENT and with service providers, professional advisors, or regulatory and government authorities, only as necessary to provide services, comply with legal obligations, or maintain the security and functionality of our operations. All such parties are contractually required to protect personal data in accordance with this Policy. For the purposes of this Policy, "health data" means any information about your physical or mental health that can identify you, such as medical records, diagnoses, treatment details, test results, genetic or biometric identifiers, and any other health‑related information that may be sensitive under Singapore law.

1.4 Data Minimization

RXILIENT collects only the personal data necessary to fulfil the purposes described in this Policy. We limit the collection, use, and disclosure of personal data to what is reasonably required for providing our products, services, and related business operations, or as otherwise permitted by law.

2. How personal data is used

2.1 Serving You

We use your personal data primarily to:

• provide you with the requested products and/or services;

• notify you the service status;

• ensure that your transactions / records on the Apps are safe and secure;

• contact you for your feedback;

• respond to inquiries or complaints;

• resolve any issues you may encounter in relation to our Apps or Services; and/or

• Provide you with newsletters, articles, alerts, announcements, invitations and other information.

• AI Features

Work Talk uses artificial intelligence to provide the following automated features:

• AI Meeting Assistant: meeting audio is transcribed and summarised by AI models. Transcripts and summaries may contain the contents of your meetings, including any personal data of participants.

• GPT AI Chat: your typed prompts and any uploaded documents are processed by AI models to generate responses. File uploads are processed solely for answering your document-based questions.

CRM Suggestions: AI-generated recommendations for customer relationship management based on data you have entered.

AI data processing by third-party providers:

Where AI features are powered by third-party model providers (e.g., OpenAI, Google Cloud AI, Microsoft Azure AI), your prompts, uploaded files, and meeting content may be transmitted to those providers for processing. All third-party AI providers are contractually bound to data protection standards consistent with this Policy and applicable data protection law. Data transmitted to AI providers is not used to train their models unless you have separately consented to such use via an explicit opt-in.

Human review: AI-generated outputs (including meeting transcripts, summaries, and CRM suggestions) are not subject to routine human review before being made available to you. Where AI outputs are used for high-stakes decisions, you should independently verify their accuracy.

You should not submit special categories of personal data (including health data, financial data, or biometric data), trade secrets, or third-party confidential information into the AI Chat or meeting recording features without appropriate.

** 2.3 Marketing and Communications**

With your consent, we may use your personal data to provide marketing information regarding products and services offered by RXILIENT or its strategic partners, including newsletters, special offers, promotions or events.

We may contact you using mail, fax, email, SMS, telephone, or other electronic means. You may withdraw consent or opt out of marketing communications at any time by contacting us at It@rxilient.com.

2.4 Legal and Regulatory Compliance

We may use and retain personal data to comply with applicable laws and regulations, enforce our terms, resolve disputes, and respond to lawful government or regulatory requests.

2.5 Handling Complaints and feedback

If you have contacted us with any complaints, feedback, comments, suggestions, we may use your personal data (including your contact history) to respond and provide the best service possible. If you request anonymity in a complaint, we will endeavour to protect your identity, although it may not always be feasible to process the complaint anonymously.

2.6 Anonymized and Aggregated Data

Personal data may also be anonymized or aggregated for analysis, research, planning or statistical purposes. In these cases, individual identification is not possible, and such data may be used without restriction.

2.7 Other Purposes

If we need to use your personal data for purposes not described above, we will notify you and obtain your consent beforehand.

3. Disclosure of information

3.1 Disclosure with Consent

We will only disclose your personal data to third parties where you have provided us consent, and in the situations expressly set out in in this Policy. If you have consented to receiving marketing information from us, our strategic partners and/or business associates, we will be disclosing your personal data to them.

3.2 Internal Sharing Within RXILIENT

Your personal data may be shared among RXILIENT and its subsidiaries for the purposes described in this Policy, including providing products, services, and support.

3.3 Service Providers and Professional Advisors

We may engage third-party companies or individuals to perform services on our behalf ("Providers"). Providers may have access to personal data, including through cookies, pixels, or similar technologies, to perform their functions. These services may include, for example, website hosting and maintenance, data analysis, email messaging, delivery services, payment processing, and verification of solvency or address.

In addition, we may share personal data with professional advisors such as accountants, lawyers, and auditors, as well as other parties assisting us in handling customer inquiries or correspondence, including complaints sent to our office. All such parties are required to use and protect your personal data in accordance with this Policy.

** 3.4 Website Functionalities and Sharing**

Personal data may be disclosed to comply with legal obligations or industry requirements. This includes disclosures to regulatory, governmental, tax, or law enforcement authorities, or where otherwise required by law.

3.5 Business Transfers

In the event that RXILIENT sells, merges, or transfers a business unit, subsidiary, or assets (including websites or other digital services) to another company, personal data may be transferred to the new entity. We will require that the recipient use and protect personal data in a manner consistent with this Policy. This also applies to companies formerly part of RXILIENT to which we provide transitional services.

3.6 Compliance with Legal Obligations

We may disclose personal data when required by law or when we believe disclosure is necessary to comply with a regulatory requirement, court order, government request, or legal process. Personal data may also be disclosed to protect the safety, rights, or property of our customers, the public, RXILIENT, or others.

4. Retention of Personal Data

We will retain your personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, resolve disputes, and enforce agreements. The criteria used to determine retention periods include:

• The length of our ongoing relationship with you and provision of services;

• Legal or regulatory obligations that require us to retain certain information; and

• Business needs or potential disputes that may require us to retain data.

The following retention schedule applies:

When your personal data is no longer required for the above purposes, we will securely delete, anonymise, or destroy it in accordance with our data disposal procedures. Account deletion requests may be submitted in-app (Settings > Personal Centre > Cancel Account) or by email to It@rxilient.com.

5. Cross-Border Transfers

Work Talk's cloud infrastructure may involve data storage and processing in jurisdictions outside Singapore, including but not limited to servers operated by AWS, Google Cloud Platform, Firebase, and AI model providers. Where personal data is transferred outside Singapore, RXILIENT ensures that the recipient provides a level of protection comparable to that afforded under the PDPA, through one or more of the following mechanisms:

• Contractual safeguards: data processing agreements incorporating PDPC-standard contractual clauses (as described in the PDPC Guide on Data Protection Clauses for Agreements Involving Personal Data, 2022);

• Binding corporate rules: intra-group data transfers governed by RXILIENT's approved binding corporate rules; or

• Transfer to PDPC-approved jurisdiction: transfers to jurisdictions recognised by the PDPC as providing adequate data protection.

A list of current third-party AI providers and their data processing locations is available upon written request to It@rxilient.com.

6. Your rights

6.1 Subject to applicable laws and certain exceptions, you have the following rights with respect to your personal data, free of charge:

• Access: You may request access to personal data that we hold about you and information about how it has been used or disclosed. Subject to applicable law, we may charge a reasonable administrative fee for responding to such requests and may decline requests that are manifestly unfounded, excessive, or repetitive.

• Correction: You may request that we correct any inaccurate or incomplete personal data by providing necessary supporting documents.

• Deletion: You may request that we delete your personal data where permitted by law. You may request deletion of your account and associated personal data at any time through either of the following methods:

• In-App: Go to Settings > Personal Centre > Cancel Account and follow the prompts.

• By Email: Send a request to It@rxilient.com with subject "Account Deletion Request", including your registered email address for identity verification.

We will complete deletion or anonymisation within 30 days of a verified request and send written confirmation by email. Some data may be retained where required by law or to resolve active disputes, in de-identified form only and not used to provide services.

Enterprise account users may need to coordinate with their enterprise administrator, whose policies may affect the scope of deletion.

• Data Portability: You may request to receive your data in a structured, machine-readable format.

• Withdrawal of Consent: You may withdraw any consent you have previously provided to RXILIENT for processing personal data, including for marketing or promotional purposes. Please note that withdrawing consent may affect our ability to provide you with certain products or services.

• Information: You may request information on how we process your personal data, including:

• Categories of personal data collected;

• Sources of personal data;

• Business purposes for collection;

• Third parties with whom we have disclosed your personal data; and/or

• Categories of personal data shared for business purposes.

6.2 Submitting Requests

To exercise your rights, please contact us at It@rxilient.com. We may ask for information to verify your identity and protect against fraudulent requests. Authorized agents may submit requests on your behalf with proper proof of authorization.

6.3 Authorized Representatives

You may authorize another person to act on your behalf to submit a request concerning your personal data. RXILIENT may require proof of authorization, such as a signed letter of consent or other documentation, to ensure the request is valid.

6.4 Right to Complain

If you believe RXILIENT has mishandled your personal data or has not complied with this Policy, you have the right to lodge a complaint with RXILIENT. All complaints will be evaluated by us in a timely manner. After the evaluation, we will respond to the person who submitted the complaint or feedback, with the results of the evaluation.

6.5 Limitations

RXILIENT may be prevented by law from complying with certain requests or may be required to retain personal data for legal or regulatory reasons. In such cases, we will inform you of the limitation and the applicable legal basis.

To exercise your rights, contact us at It@rxilient.com. We may request identity verification to protect against fraudulent requests.

7. Miscellaneous / Other Information

7.1 Children\ The Service is intended for use by adults in a workplace context and is not directed at children under the age of 18 (or a higher age where required by local law, such as 13 under US COPPA). We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data promptly. Please contact us at It@rxilient.com if you believe a child has provided personal data to us.

7.2 Policy Updates\ We may update this Policy from time to time. Any changes will take effect when we post the revised Policy on our website. If changes significantly affect how we process your personal data, we will provide notice or obtain consent where required. Minor updates that do not materially affect the use of personal data may be made without notice. We encourage you to periodically review this page for the latest information on our privacy practices.

7.3 Data Protection Officer

RXILIENT has designated a Data Protection Officer ("DPO") registered with the Personal Data Protection Commission ("PDPC") of Singapore, in compliance with the PDPA (s.11). The DPO can be contacted at:

Rxilient Health Pte. Ltd.

1 Coleman Street #08-01, The Adelphi,\ Singapore 179803

Email: legal@rxilient.com

We will respond to your inquiries in accordance with applicable laws.

8. Security

We endeavor to take precautions to ensure that the information you have provided is protected against unauthorised or unintended use, access or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Liability

To the maximum extent permitted by applicable law, RXILIENT shall not be liable for any indirect or consequential damages arising from unauthorised or unintended use, access, or disclosure of your personal data. This limitation does not apply to losses caused by RXILIENT's negligence or wilful default.

10. Contact Us

For any questions regarding this Policy or to exercise your individual rights, please contact us:

Email: it@rxilient.com

Address: Rxilient Health Pte. Ltd., 1 Coleman Street #08-01, The Adelphi, Singapore 179803