Privacy Policy
Last Updated: May 1, 2026
Sirio Pharma Co., Ltd. and its subsidiaries established in the People’s Republic of China (“China”) (collectively, “SIRIO”, “We”, “Us” or “Our”) attach great importance to the protection of personal information. We strictly comply with the Personal Information Protection Law of the People’s Republic of China (“PIPL”) and other applicable laws and regulations, and adhere to the principles of lawfulness, legitimacy, necessity, and good faith in order to protect your personal information rights and interests and ensure data security.
This Privacy Policy applies to all products and services provided by Us, including, without limitation, the official website of SIRIO (https://www.siriopharma.com/), our WeChat Official Account (Sirio Pharma), events organized by us, and services provided at your request (collectively, the “Services”). Where specific products or services are subject to separate privacy policies or notices, such separate privacy policies or notices shall prevail to the extent of any inconsistency. This Privacy Policy explains how we collect, use, store, share, transfer, disclose, and otherwise process your personal information in connection with your use of the Services.
As the personal information processor, SIRIO determines the purposes and means of the processing of personal information generated in connection with your use of the Services. Our contact details are as follows:
Address: No. 83 Taishan Road, Shantou, Guangdong Province
Email of Personal Information Protection Office: sales@siriopharma.com
Please read this Privacy Policy carefully before submitting your personal information to us, and ensure that you fully understand its contents and the corresponding legal consequences.
Provisions that may materially affect your rights and interests, as well as provisions relating to sensitive personal information, are highlighted in bold or by other reasonable means and should be read with particular care.
This Privacy Policy will help you understand the following:
I. Definitions and Legal Bases
II. How We Collect and Use Your Personal Information
III. How We Use Cookies and Similar Technologies
IV. How We Share, Transfer, Publicly Disclose, and Store Your Personal Information
V. How We Protect Cross-Border Transfers of Your Personal Information
VI. How We Protect the Security of Your Personal Information
VII. How We Protect Your Rights
VIII. How We Handle Minors’ Personal Information
IX. How We Update This Privacy Policy
X. How to Contact Us
I. Definitions and Legal Bases
1 Definitions
“Personal information” means all kinds of information, recorded electronically or by other means, relating to an identified or identifiable natural person, including, without limitation, name, date of birth, identification document number, personal biometric information, address, and telephone number, but excluding anonymized information.
“Sensitive personal information” means personal information that, once leaked or illegally used, may easily result in an infringement of the dignity of a natural person or harm to personal or property safety. In general, biometric information, religious beliefs, specific identity, medical and health information, financial accounts, location tracking information, and personal information of minors under the age of fourteen are regarded as sensitive personal information.
2 Legal Basis
We strictly comply with the PIPL and other applicable laws and regulations in collecting and processing your personal information. We will generally collect, use, disclose, or otherwise process your personal information for the purposes described in this Privacy Policy based on your consent, or where otherwise permitted or required by applicable law, including, without limitation, under the following circumstances:
where your consent has been obtained;
where processing is necessary for the conclusion or performance of a contract to which you are a party;
where processing is necessary for the performance of statutory duties or obligations;
where processing is necessary to respond to a public health emergency, or to protect the life, health, and property safety of natural persons in emergency circumstances;
where personal information is processed within a reasonable scope for news reporting, public opinion supervision, or other activities carried out in the public interest;
where personal information that has been voluntarily disclosed by the individual or otherwise lawfully disclosed is processed within a reasonable scope in accordance with the PIPL; or
other circumstances as provided by laws and administrative regulations.
II. How We Collect and Use Your Personal Information
We collect and use your personal information in accordance with the principles of legitimacy, minimum necessity, and transparency for the following purposes:
1 Contacting Our Sales Representatives or Conducting Business Cooperation
When you contact our sales representatives or engage in business cooperation through the SIRIO website or other channels, we may collect your name, gender, telephone number, email address, employer, job title, and any other information voluntarily provided by you, for the purposes of contacting you, verifying your identity, and providing the services you request.
2 Providing Event Registration Services
We may offer various online and offline events. If you choose to register for such events, you may be required to provide your name, contact information, and work-related information (such as your employer and position), depending on the relevant event. Registration for events is voluntary, and your decision not to register for an event will not affect your normal use of other functions or Services.
3 Assisting You in Following Our Social Media Accounts
When you follow our WeChat Official Account or other social media accounts, we may collect your contact information and technical and network activity information through WeChat or other relevant social media platforms.
4 Providing Security Assurance
In order to improve the security of the Services, protect you, other users, or the public from harm to personal or property safety, better prevent security risks such as phishing websites, fraud, network vulnerabilities, computer viruses, cyber-attacks, and network intrusions, and more accurately identify violations of laws, regulations, or agreements and rules relating to the Services, we may use or integrate your relevant technical and network activity information, as well as information shared by our partners with your authorization or as otherwise permitted by law, to comprehensively detect and prevent security incidents and to take necessary recording, auditing, analysis, and handling measures in accordance with law.
5 Performing Statutory and Regulatory Obligations
We may process your personal information as necessary to comply with obligations imposed by applicable laws and regulations, such as completing required operational filings and cooperating with inspections by competent authorities. In order to protect your personal information rights and ensure data security, we will adopt technical measures, such as anonymization, to ensure that the data provided cannot be directly or indirectly associated with you. For the purpose of fulfilling other related statutory obligations, we will use your personal information to the extent required by applicable laws, regulations, and regulatory requirements.
6 Circumstances in Which Your Consent Is Not Required
Please note that, in accordance with applicable laws, regulations, and national standards, we may collect, use, and otherwise process your personal information without your authorization or consent under the following circumstances:
where processing is necessary for the conclusion or performance of a contract to which you are a party;
where processing is necessary for the performance of statutory duties or obligations;
where processing is necessary to respond to a public health emergency, or to protect the life, health, and property safety of natural persons in emergency circumstances;
where personal information is processed within a reasonable scope for news reporting, public opinion supervision, or other activities carried out in the public interest;
where your personal information that has been voluntarily disclosed by you or otherwise lawfully disclosed is processed within a reasonable scope as provided by law; or
other circumstances as provided by laws and administrative regulations.
III. How We Use Cookies and Similar Technologies
Cookies and similar device identification technologies are widely used on the Internet. We may use cookies, web beacons, pixel tags, and similar technologies in connection with the Services for a variety of purposes, including loading and displaying pages, analyzing usage of the Services, and improving user experience.
Most browsers allow you to block or delete cookies stored on your device. However, if you disable or remove cookies, certain Services or functions that depend on such technologies may not operate properly.
IV. How We Share, Transfer, Publicly Disclose, and Store Your Personal Information
1 Sharing
We will not share your personal information with any third party, except in the following circumstances:
Disclosure required by law: We may share your personal information with external parties in accordance with applicable laws and regulations, for the purposes of litigation or dispute resolution, or where required by administrative or judicial authorities in accordance with law.
Sharing with partners as necessary for service provision: We may share your personal information with third parties such as our partners to ensure the smooth provision of Services to you. However, we will only share such information for lawful, legitimate, necessary, specific, and explicit purposes, and only to the extent necessary to achieve the purposes described in this Privacy Policy. Our partners are not permitted to use the shared personal information for any purpose other than those expressly authorized by us.
Sharing with your explicit consent: With your explicit consent, we may provide your personal information to other third parties. You have the right to be informed of the name of the recipient, its contact information, the purpose and method of processing, and the categories of personal information involved. If you would like to obtain further information, you may contact us at any time in the manner set out in Section 10 of this Privacy Policy.
2 Transfer
We will not transfer your personal information to any third party, except in the following circumstances:
where we have obtained your consent or authorization for such transfer;
where required by applicable laws and regulations, mandatory administrative enforcement, or judicial requirements; or
in the event of a transfer of personal information arising from an asset transfer, acquisition, merger, reorganization, or bankruptcy liquidation, in which case we will inform you of the relevant circumstances and require the new company or organization holding your personal information to continue to be bound by this Privacy Policy; otherwise, we will require such company or organization to obtain your authorization and consent again.
3 Public Disclosure
We will not publicly disclose your personal information unless:
we have obtained your explicit consent or such disclosure is based on your voluntary choice; or
such disclosure is required by applicable laws and regulations, mandatory administrative enforcement, or judicial requirements.
4 Storage
Personal information collected and generated during our operations within China will, in principle, be stored within China.
We will retain your personal information only for:
the period necessary to achieve the purposes stated in this Privacy Policy;
any retention period separately required by applicable laws and regulations; or
any other retention period separately authorized and consented to by you,
whichever is longer.
Upon expiration of the applicable retention period, or after you cancel your account (if applicable), we will delete or anonymize your personal information, or otherwise render such personal information incapable of directly or indirectly identifying you, unless otherwise required by applicable law.
We have implemented a series of technical, administrative, and organizational measures to protect stored personal information and minimize the risks of unauthorized use, disclosure, alteration, loss, or unavailability. Such security measures include, without limitation, data masking, data encryption, firewalls, and access control mechanisms.
V. How We Protect Cross-Border Transfer of Your Personal Information
In principle, we do not transfer your personal information to any overseas third party outside China. However, as SIRIO operates globally, it may be necessary for us to transfer your personal information to SIRIO’s overseas affiliates or overseas third parties.
Where required by applicable laws and regulations, prior to any cross-border transfer of personal information, we will conduct a personal information protection impact assessment and require overseas recipients, through agreements or other legally valid mechanisms, to process personal information strictly in accordance with the agreed purposes and to fulfill their obligations regarding the protection of personal information security.
We will rely on our established global compliance framework to ensure that your personal information receives a level of protection not lower than that required under applicable laws and regulations of China.
VI. How We Protect the Security of Your Personal Information
We use a variety of security technologies and procedures to prevent the loss, misuse, unauthorized access, disclosure, alteration, or destruction of information. We will use encryption technologies (such as SSL), anonymization, and other reasonable and practicable measures to protect your personal information, and will implement security protection mechanisms to prevent malicious attacks on your personal information.
However, please understand that, due to technological limitations and the existence of various malicious methods, no information security measure can guarantee absolute security. Accordingly, we strongly recommend that you also take appropriate steps to help protect the security of your personal information.
We will use encryption technology to ensure the confidentiality of personal information, adopt reliable protection mechanisms to prevent data from malicious attacks, and implement access control mechanisms to ensure that only authorized personnel may access personal information. We will establish dedicated privacy compliance organizations and management systems for employees, third parties, and other relevant personnel. We will also conduct regular security and privacy protection training to enhance employees’ awareness of the importance of protecting personal information, and prudently select service providers and business partners while conducting regular personal information protection audits.
In the event of a personal information security incident, we will activate our emergency response plan in accordance with legal requirements and promptly inform you of the basic circumstances and possible impact of the incident, the measures we have taken or will take, recommendations for you to independently prevent and mitigate risks, and remedial measures available to you. We will notify you of relevant circumstances by email, letter, telephone, push notification, or other appropriate means. Where it is difficult to notify each personal information subject individually, we will issue announcements in a reasonable and effective manner. At the same time, we will report the handling of the personal information security incident to the competent regulatory authorities as required by law.
Please note that, by clicking on third-party links on our website, you may be redirected to third-party websites or platforms. We do not control such third-party websites or platforms. You are advised to review the personal information protection practices of such third parties in advance. We assume no responsibility for the content, conduct, or policies of any third party.
VII. How We Protect Your Rights
1 Right to Be Informed and Right of Access, Copy, Correction, and Supplementation
In accordance with the PIPL, you have the right to access, review, and copy your personal information, except where otherwise provided by law. You also have the right to correct or supplement the personal information you have provided to us and that we have collected.
You may submit a request to access, correct, supplement, or copy your personal information through online contact/consultation channels or by sending us an email as set out in Section 10. We will verify your identity and respond to your request within no more than fifteen (15) working days after successful verification.
Where technically feasible, such as where data interfaces are compatible and the relevant conditions prescribed by the national cyberspace administration are satisfied, we may, at your request, directly transfer a copy of your personal information to a third party designated by you.
2 Deletion of Your Personal Information
In accordance with the PIPL, under the following circumstances, you have the right to request that we delete personal information relating to you, or otherwise render such personal information incapable of directly or indirectly identifying you:
where our processing of personal information violates applicable laws and regulations;
where we collect or use your personal information without obtaining your consent where consent is required;
where our processing of personal information violates our agreement with you;
where the purpose of processing has been achieved, cannot be achieved, or is no longer necessary to achieve the purpose of processing; or
where you withdraw your authorization and consent for our processing of your personal information.
If we decide to honor your deletion request, we will also notify third parties and affiliated parties that have obtained your personal information from us and require them to delete such information in a timely manner, unless otherwise provided by applicable laws and regulations or unless such parties have independently obtained your separate authorization.
3 Withdrawal of Consent
You may contact us at any time using the contact details set out in this Privacy Policy to withdraw your consent. After you withdraw your authorization and consent, we will no longer process the corresponding personal information. However, if the relevant information is necessary for us to provide the relevant Services to you, we may be unable to continue providing such Services.
Your withdrawal of consent will not affect the validity of any personal information processing activities conducted on the basis of your consent before such withdrawal.
4 Response to Your Requests and Complaints
To protect your personal information rights and ensure data security, we may need to verify your identity before processing your request. We will provide feedback on the measures taken in response to your request within fifteen (15) days from the date of receipt of your request.
If you are dissatisfied, you may file a complaint through the online contact/consultation channels or by email as set out in Section 10.
In the following circumstances, we may be unable to respond to your request:
where the request is related to our performance of obligations required by laws and regulations;
where the request is directly related to national security or national defense security;
where the request is directly related to public safety, public health, or other major public interests;
where the request is directly related to criminal investigation, prosecution, trial, or enforcement of judgments;
where we have sufficient evidence to demonstrate that you are acting with subjective malice or abusing your rights;
where responding to your request is necessary to protect your or another individual’s significant lawful rights and interests, such as life or property, but obtaining your consent is difficult;
where responding to your request would cause serious damage to the lawful rights and interests of you, other individuals, or organizations; or
where trade secrets are involved.
VIII. How We Handle Minors’ Personal Information
For the purposes of this Privacy Policy, “children” means minors under the age of fourteen. Our products and Services are primarily intended for adults, and we do not knowingly collect personal information from children.
If we discover, or are informed, that we have collected personal information from a child without valid consent from the child’s guardian, please notify us using the contact details in Section X, and we will promptly take steps to delete the relevant information in accordance with applicable law.
IX. How We Update This Privacy Policy
We reserve the right to amend this Privacy Policy from time to time. If any changes are material, we will provide you with prominent notice and, where required by applicable law, obtain your consent again before such changes take effect.
Without your explicit consent, we will not reduce your rights under this Privacy Policy.
For the purposes of this Privacy Policy, “material changes” include, without limitation:
significant changes to the purposes, methods, or scope of our collection and use of personal information;
significant changes in our corporate or organizational structure, such as major business adjustments, bankruptcy, mergers, or acquisitions;
significant changes to the main recipients of personal information sharing, transfer, or public disclosure;
significant changes to your rights relating to participation in personal information processing and the methods by which you may exercise such rights; and
changes to the department responsible for personal information protection, its contact details, or complaint channels.
X. How to Contact Us
If you have any questions regarding this Privacy Policy, or any inquiries, complaints, or suggestions regarding the implementation of this Privacy Policy or our personal information protection practices, or if you believe that your personal information may have been disclosed, or that it is necessary to withdraw, correct, or delete your authorization relating to your personal information, or if you require the contact details of the person in charge of personal information protection, you may contact us by any of the following means:
Online Contact or Consultation: Click “Consult Now” or “Contact Us”;
Email: Send an email to sales@siriopharma.com.
We will respond to your request within fifteen (15) days of receipt, or within such other period as required by applicable laws and regulations.