Terms of Service and Privacy Policy

This document consolidates the terms, conditions, and privacy notices relevant to the basic features of the Smile Migraine application and the Smile Migraine website into a single document, so that users may read, understand, and give consent once when first accessing the application. Note: This document covers the basic features of the Service only. Telemedicine services and in-app purchases (including purchases made through the Marketplace) require separate, explicit consent obtained before the user accesses those features, and are governed by separate terms. This English-language version is the global base version; localized versions in Korean, Japanese, and Traditional Chinese (Taiwan), covering the same basic features, will follow separately. This document consists of 7 main parts: (1) General Terms of Service (2) General Privacy Policy (3) Privacy Policy for the Online Migraine Community feature (4) Privacy Policy for connecting health data from wearable devices (5) Terms of Use for the Artificial Intelligence system (AI Chatbot) (6) Terms of Use for the Coin / Rewards Program (7) Subscription Service Terms and Refund Policy The Company provides the Service in multiple countries, including Thailand, the Republic of Korea, Taiwan, and Japan. These Terms are designed to be consistent with Thailand's Personal Data Protection Act (PDPA), Korea's Personal Information Protection Act (PIPA), Taiwan's Personal Data Protection Act, and Japan's Act on the Protection of Personal Information (APPI). Where the law of the country in which the user resides provides greater protection, that law shall prevail. [Note for localization: in the Korean, Japanese, and Taiwanese versions, references to Thai law below should be replaced with the equivalent provisions under the applicable local law.] Table of Contents 1. Introduction and Shared Definitions 2. Part 1 — General Terms of Service 3. Part 2 — General Privacy Policy 4. Part 3 — Community Privacy Policy 5. Part 4 — Privacy Policy for Wearable Device Health Data 6. Part 5 — AI Chatbot Terms 7. Part 6 — Coin / Rewards Program Terms 8. Part 7 — Subscription & Refund Policy 9. Consolidated Consent and Layered Consent Management 10. Contact Information Introduction and Shared Definitions This document (the "Consolidated Document") is issued by Smile Migraine Co., Ltd. and its affiliated entities that provide the Smile Migraine application in each country (collectively, the "Company") to set out the rules, methods, and conditions for providing the Service, and the collection, use, processing, disclosure, and protection of the personal data of users in connection with all features of the application and website. Definitions Company — Smile Migraine Co., Ltd. and its affiliated entities authorized to provide the Smile Migraine application in each country. Application / Website / Service — The Smile Migraine application on Android and iOS, the Smile Migraine website, back-end systems, and all related services. User / Patient — A natural person who registers for and uses the application or website, whether as a person recording health data, a user of the AI/Chatbot system, a community participant, a person connecting a wearable device, a Coin collector, or a Subscription subscriber. Doctor / Healthcare Personnel — A licensed medical practitioner or healthcare professional, licensed under the law of the country or jurisdiction in which the service is provided. Artificial Intelligence / Chatbot (AI / Chatbot) — An automated software system or algorithm used to process and provide supportive health-related information, which does not constitute a doctor and does not provide medical diagnosis or treatment. Personal Data — Any information that can directly or indirectly identify a user. Health Data — Personal data relating to physical or mental health, which is considered sensitive data under applicable data protection law. Wearable Device / IoT Device — An electronic device of the user, such as a smartwatch, or a third-party health application, that connects to the application via an API or the device's own health app system. Coin — A virtual point unit within the application that users earn through designated activities and may redeem for benefits under conditions set by the Company. Subscription — A service for which the user pays a recurring fee in advance (monthly/annual) to access special features or content within the application. Part 1 — General Terms of Service These Terms of Service apply to all users, whether patients, doctors, or healthcare providers who use the Smile Migraine application or website. If you do not wish to be bound by these Terms, you may choose not to use the Company's Service. 1.1 Scope of Service The Company provides services through the Smile Migraine application and website to support the healthcare and migraine management of users, comprising the following core services: A service for recording, analyzing, and tracking self-reported health data. An automated, artificial intelligence, and chatbot (AI/Chatbot) service that provides general health information, which does not constitute medical diagnosis or advice. See Part 5 for further details. A telemedicine/telehealth service with licensed healthcare personnel. This service is currently available only in designated jurisdictions that have the required regulatory approvals (such as Thailand), and may not be available or accessible to users residing outside those jurisdictions. Access to this feature, where available, requires separate, explicit consent obtained before use, under separate Telemedicine Terms. An Online Migraine Community service, available on both the application and the Smile Migraine website. See Part 3 for further details. A service for connecting data from wearable devices. See Part 4 for further details. A Coin/Rewards Program, as detailed in Part 6. A Subscription service, as detailed in Part 7. Where the application offers in-app purchases of products (e.g., through a Marketplace), this feature is likewise available only in designated jurisdictions and may not be available or accessible to users residing outside those jurisdictions. Such purchases require separate consent obtained before use, under separate purchase terms. 1.2 Consent to the Service Registering for and accessing the application or website constitutes acceptance of the General Terms of Service (Part 1) and the General Privacy Policy (Part 2), which are necessary for the provision of the Service. The Company processes such data on the basis of Contractual Necessity and Legitimate Interest [under Sections 24(3) and (5) of Thailand's Personal Data Protection Act B.E. 2562 (2019), or the equivalent legal basis under the data protection law applicable in the user's country of residence]. For features involving sensitive health data — namely the Online Migraine Community (Part 3), the connection of health data from wearable devices (Part 4), and the artificial intelligence system (Part 5) — the Company will separately obtain explicit and freely given consent from the user only when the user chooses to access that feature [under Section 26 of the same Act, or the equivalent provision under applicable law]. Users may give or withdraw consent for each feature at any time via the "Privacy Settings" menu, without affecting their right to use the core Service. 1.3 Limitation of Liability and Safety Warning The Company's Service is not an emergency medical service. If a user experiences a severe or emergency condition, please contact the medical emergency number of the country in which you reside immediately [in Thailand: 1669; users in other countries should use their local emergency medical number]. Under no circumstances should the application or the AI system be used in an emergency situation. The Company applies data security measures consistent with international standards; however, no system can guarantee complete data security. The Company will be liable only for direct, foreseeable damages arising from a defect in the application, to the extent permitted by law. 1.4 Minors and Dependents A minor under 20 years of age [under Section 19 of the Thai Civil and Commercial Code, or the age of majority under the law applicable in the user's country of residence] may use the application only with the explicit consent and supervision of a parent or legal guardian. Telemedicine services and Subscription services for minors require a parent or legal guardian to jointly provide consent throughout the process. 1.5 Fees and Payment The Company may charge fees for telemedicine services, Subscription services, or other services, and will notify the applicable rates and conditions in advance through the application. Details of Subscription terms and the refund policy are set out in Part 7. 1.6 Intellectual Property The application, software, AI models, trademarks, and all other related elements are the property of the Company or its lawful licensors. Users are granted a temporary, non-exclusive licence to use the Service for personal use only. 1.7 Governing Law and Jurisdiction These Terms are governed by the law of the country in which the relevant Company affiliate provides the Service to the user (for this global English basic-feature version, the laws of Thailand apply by default), except where the consumer protection law or data privacy law of the country in which the user resides grants additional rights or protections — including the right to bring claims or disputes before the courts or authorities of that country — that cannot be contractually waived. In such cases, such local law and the competent local courts or authorities shall prevail. Part 2 — General Privacy Policy This Policy explains how the Company collects, uses, processes, discloses, and protects the personal data of users in their overall use of the Smile Migraine application and website. Specialized services (Community, wearable devices, AI Chatbot, the Coin Program, and Subscription) are described in further detail in Parts 3–7. 2.1 Categories of Data Collected Identification data, such as name-surname, date of birth, gender. Account and contact data, such as email and phone number. Health data and migraine symptom data self-recorded by the user. Data from interactions with the AI/Chatbot system — details of the collection and use of this data are set out in Section 5.4. Data relating to telemedicine services. Data from wearable devices or external systems (where the user chooses to connect them). System, device, and network usage data, such as IP address, device type, and cookies (for website use only). Transaction and payment data, including Subscription registration and renewal history. Communication data between users and the Company or healthcare personnel. 2.2 Purposes of Data Use To provide and manage the user's account. To support the user's healthcare and migraine management. To provide the AI/Chatbot and automated systems. To provide telemedicine services in accordance with applicable law. To process Subscriptions, payments, renewals, and cancellations. To analyze, improve, and develop the quality of the platform, including the development of AI models, in a form that cannot identify the individual (anonymized). To prevent fraud, misuse, or technical anomalies. To comply with the law, court orders, or orders of competent authorities in the relevant country. Users have the right to opt out of having their data used for AI model development via the settings in the application, without affecting their right to use the core Service. 2.3 Disclosure of Data to Third Parties The Company will not disclose personal data to third parties, except in the following cases: With the explicit consent of the user. To doctors and healthcare personnel involved in providing the Service. To technology, database, or payment service providers engaged by the Company, subject to strict data protection measures. To comply with the law, court orders, or orders of competent government authorities in the relevant country. 2.4 Rights of the Data Subject As the data subject, users have the following rights [under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA), or the equivalent data protection law applicable in the user's country of residence, such as Korea's Personal Information Protection Act (PIPA), Japan's Act on the Protection of Personal Information (APPI), or Taiwan's Personal Data Protection Act]: The right to access and request a copy of their personal data. The right to have their data corrected and kept up to date. The right to request deletion or destruction of data (right to erasure). The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. The right to request restriction of, or to object to, the processing of data in certain circumstances. The right to data portability. You may exercise these rights via the "Privacy Settings" menu in the application, or by contacting support@smilemigraine.com. The Company will act on such requests without undue delay, and in any event within 30 days of receipt, or such shorter period as required under applicable local law (for example, within one month under the EU General Data Protection Regulation (GDPR), where applicable). 2.5 Cross-Border Data Transfers As the Company provides the Service in multiple countries, a user's personal data may be stored or processed on servers located outside the country in which the user resides. Where required under applicable law, the Company will implement recognized safeguards for such transfers, such as Standard Contractual Clauses (SCCs) or other legally recognized cross-border data transfer mechanisms, to ensure that transfers comply with adequate data protection standards. 2.6 Data Retention and Security The Company will retain personal data only for as long as necessary for the purposes for which it was collected, or for such period as required by law, and will delete or de-identify the data once it is no longer needed. Part 3 — Privacy Policy for the Online Migraine Community The Online Migraine Community feature is an online space for users to share information and exchange experiences relating to migraine. This feature is available on both the Smile Migraine application and the Smile Migraine website, using the same user database and community content system. Users must sign in with a registered account before they can post or comment. This Policy applies in addition to Part 2, regardless of whether the feature is accessed via the application or the website. 3.1 Data Collected in the Community Feature (a) Data voluntarily provided by the user Community display name. Profile picture (if uploaded). Text, images, posts, or comments published in the community. Migraine symptoms or personal experiences the user chooses to share. (b) Data collected automatically (application) Device data, operating system, and application version. IP address and approximate location (if permitted by the user). Behavioral data on use of the community feature, to improve the user experience. (c) Data collected automatically (website) — additional When a user accesses the community feature via the Smile Migraine website, the Company will additionally collect: Essential cookies, to maintain login status and session security. Analytics cookies (e.g., Google Analytics), to measure traffic and improve website performance, in aggregated and de-identified form. Browser data (type, version, language) and screen size. Pages visited and navigation path. IP address, for security and to prevent attacks. Users may decline Analytics Cookies via the Cookie Banner displayed on first visiting the website, without affecting their ability to access community content. 3.2 Anonymous Use Users may use certain parts of the community without disclosing their identity. However, certain technical data, such as IP address, may still be recorded for security purposes and to prevent misuse, and will be processed in a manner that does not directly identify the individual. The Company will not attempt to identify anonymous users, except where required by an order of a competent authority. 3.3 Content Moderation and Disclosure The principle of non-disclosure of personal data to third parties under Section 2.3 continues to apply to data within the community feature. The Company reserves the right to remove, hide, or modify content that violates these Terms or is inappropriate, whether or not the poster has disclosed their identity, and regardless of whether the content was posted via the application or the website. 3.4 User Rights within the Community The basic rights of users to access, correct, delete, and withdraw consent set out in Section 2.4 continue to apply in full to data within the community feature. In addition, users have the following rights: The right to request deletion of specific posts, comments, or content they have published in the community, without needing to close their entire account. The right to change their community display name or profile picture at any time via settings in the application or website. To exercise these rights, users may do so directly via the application or website, or by contacting support@smilemigraine.com. Part 4 — Privacy Policy for Connecting Health Data from Wearable Devices (Smart Watch / Wearable / IoT) This Policy applies when a user chooses to connect the Smile Migraine application to their device, such as a smartwatch, an IoT device, or a third-party health application (e.g., Apple Health or Google Health Connect), enabling the Company to access and process the user's sensitive health data. 4.1 Health Data Collected from Devices Heart rate. Sleep patterns. Step count and physical activity. Blood oxygen level. Other health data supported by the user's device and to which the user grants access. This data will be used solely for analysis and to provide health-related recommendations within the application. 4.2 Purposes of Data Use To analyze health trends that may affect the user's migraine symptoms. To provide personalized recommendations on health-related behavior, such as stress management, sleep, and exercise. To track the effectiveness of the user's healthcare. To improve the quality of the Service within the application. 4.3 Disclosure and Sharing of Data The principle of non-disclosure of data to third parties under Section 2.3 continues to apply to health data from wearable devices, given its highly sensitive nature. The Company sets out the following additional conditions: Medical research: Data may be shared only in a de-identified (anonymized) form, and only after review and approval by the relevant research ethics committee. Health data analytics providers: Must sign a Data Processing Agreement and are prohibited from using the data for any purpose other than as specified. 4.4 User Rights and Withdrawal of Consent The basic rights set out in Section 2.4 continue to apply in full to health data obtained from wearable devices. Specifically for wearable device connections, users may withdraw consent through two channels: Via the "Privacy Settings" menu in the Smile Migraine application. By revoking access directly within the device's Health App (e.g., Apple Health or Google Health Connect). Withdrawal of consent takes effect immediately and does not affect the lawfulness of processing carried out prior to withdrawal. Disconnecting a device does not affect the user's ability to use other features of the application. Part 5 — AI Chatbot Terms of Use The artificial intelligence (AI) and chatbot system within the Smile Migraine application is a tool designed to provide preliminary, general health-related information only. It is not a tool for diagnosis, prescribing treatment, or replacing consultation with healthcare personnel. Use of this feature constitutes the user's acknowledgment and acceptance of all of the following terms. 5.1 Nature of the AI Information, analysis, or recommendations provided by the AI are generated from the system's database and learning processes, and are intended for preliminary information only. They cannot be used to confirm a diagnosis or medical condition. Diagnosis, treatment planning, and prescribing must be carried out only by a licensed doctor or healthcare professional. 5.2 Limitations of the AI The AI may provide information that is inaccurate, incomplete, or outdated, and may not cover every possible medical condition. The Company does not warrant or guarantee the accuracy of the AI system's output in any case. 5.3 User Responsibility Users are responsible for their own decisions and actions arising from the use of information provided by the AI. The Company will not be liable for any damage arising from the use of such information without consulting healthcare personnel. 5.4 Privacy of Conversation Data The Company will keep the user's conversation data with the AI system confidential in accordance with the Privacy Policy in Part 2. Please avoid providing identifiable information unnecessarily. The Company may use conversation data to develop and improve the quality of the AI system in a de-identified (anonymized) form. Users may opt out of this use without affecting their access to the core Service. Part 6 — Coin / Rewards Program Terms The Company operates a Coin ("Coin") rewards program within the Smile Migraine application to encourage users to engage consistently in their healthcare and use of the application's features. Participation in or use of the Coin program constitutes acceptance of the terms in this Part. 6.1 Eligibility and Participation Users with an active application account are automatically eligible to participate in the Coin program. Minors require parental consent as set out in Section 1.4. 6.2 How Coins Are Earned Users may earn Coins from in-app activities according to the categories and conditions set by the Company, divided into three main groups: (a) New User Activation Within the first 7 days of use, new users may earn Coins for activities including: registering and using the application continuously for 7 days; connecting health data; recording a diary entry for 5 consecutive days; making a first purchase via the Marketplace (available only where the Marketplace feature is offered, and subject to separate consent obtained before use); and booking a first doctor consultation (available only in countries/jurisdictions where the Telemedicine service is authorized, and subject to separate consent obtained before use). (b) Daily Engagement Users who use the application on an ongoing basis may earn Coins for activities such as: daily check-in; recording a migraine symptom diary; reading knowledge-base content; posting or sharing content in the community; rating and reviewing products purchased via the Marketplace (where available); and rating and reviewing a doctor after a consultation (where the Telemedicine service is available). (c) Referral Program A user who refers a new user, and the referred new user, may both earn Coins once the new user completes specified activities. The Company reserves the right to suspend or reclaim Coins if it detects fake account creation or dishonest use. 6.3 Coin Validity Period Coins are valid for 90 days from the date they are earned. If unused within that period, they will expire and cannot be reinstated. The Company will notify users before Coins expire. If a user closes their account or has their account suspended for violating these Terms, all remaining Coins will be forfeited without compensation. 6.4 Coin Value and Non-Transferability Coins have no monetary value, cannot be exchanged for cash, and cannot be transferred, sold, or given to any other person under any circumstances. Coins may be used only within the Smile Migraine application, to redeem discounts under the conditions set out in Section 6.5. 6.5 Terms and Procedure for Using Coins (Redemption Policy) (a) Order of discount calculation: (1) promotional campaign discounts → (2) membership benefits → (3) discount codes → (4) Coin discounts → (5) maximum total discount cap per bill (Final Cap). (b) Categories of Coin use [note: the following categories relate to services that may not be available in all countries, and are subject to separate consent obtained before use]: Purchases via the Marketplace: discount of up to 10%, capped at THB 100 (or the local currency equivalent) per bill. Doctor consultation fees: discount of up to 40%, capped at THB 100 (or the local currency equivalent) per bill. Medication fees: discount of up to 5%, capped at THB 100 (or the local currency equivalent) per bill. (c) Restrictions: Coins cannot be used together with a discount code in the same transaction; maximum of 100 Coins per day; usable once per day; and a maximum of 100 Coins per bill. 6.6 Data Collection and Privacy To operate the Coin program correctly and prevent fraud, the Company will collect data on Coin balances, Coin-earning history, Coin-redemption history, and related activity data, under the data protection principles set out in Part 2. Part 7 — Subscription Service Terms and Refund Policy This Part applies to users who subscribe to the Subscription service within the Smile Migraine application, which grants access to special features or content in addition to the free basic Service. 7.1 Subscription Plan Types and Details The Company may offer several types of Subscription plans, such as monthly or annual plans. Details of each plan (plan name, price, and benefits) will be clearly displayed on the subscription page within the application before confirmation. The Company reserves the right to add, remove, or modify Subscription plans, and will provide advance notice through the application. 7.2 Payment and Auto-Renewal Subscription fees are charged in advance on the date of subscription or renewal, via the user's chosen payment method. If a user does not cancel their Subscription before the end of the billing cycle, the system will automatically renew and charge for the next cycle (Auto-Renewal). The Company will provide advance notice before auto-renewal as required by law, to give users an opportunity to cancel before being charged. The Company does not directly store credit/debit card data. All payment data is processed by a PCI DSS-compliant payment service provider. 7.3 Cancelling a Subscription Users may cancel their Subscription at any time without penalty, by notifying support@smilemigraine.com at least 1 business day before the next billing cycle. After cancellation, the user's account will retain access to Subscription features until the end of the paid billing cycle. The Company will send a cancellation confirmation email within 1–3 business days. If no confirmation is received, please contact support@smilemigraine.com before the next billing cycle. 7.4 Subscription Refund Policy The Company reserves the right to decline refunds for Subscriptions in all cases except as set out in Section 7.5. Cases in which refunds will not be approved include: A change of mind after successfully paying for a Subscription, regardless of how much time has passed. Subscribing to the wrong plan (e.g., subscribing to an annual plan instead of a monthly plan) due to user error. Forgetting to apply a discount code, coupon, or gift voucher before payment. Not using the Service during a paid billing cycle. Wanting to stop using the Service while the platform continues to function normally. Auto-renewal that the user did not cancel in advance of the next cycle — this is not automatically eligible for a refund. However, if the user requests a refund within the first 24 hours of being charged, and it is confirmed that no special benefits were used during that billing cycle, the Company will agree to a full refund. Needing to withhold tax after having already paid in full — please contact the accounting department before making any payment. 7.5 Cases Eligible for a Subscription Refund The Company will consider refunds in the following cases, which must go through a review and be approved by the Company beforehand: The Company is unable to provide the Subscription service materially and continuously as advertised, due to a technical issue caused by the Company's own systems. A duplicate charge occurred due to a system error, confirmed by the Company's and the payment provider's transaction records. A charge was made to a user who never subscribed to the Subscription, under any circumstances. ⚠ A claim that a specified benefit was not received must be supported by clear evidence. The Company will approve refunds based on verifiable evidence and technical system records. If a user disagrees with the Company's decision, they may file a complaint with the competent consumer protection authority [in Thailand: the Office of the Consumer Protection Board (OCPB); users in other countries may contact the relevant local consumer protection authority] in accordance with their legal rights. 7.6 Subscription Refund Procedure (Where Approved) Notify support@smilemigraine.com with: (1) user account number; (2) date charged; (3) amount and payment method; and (4) reason for the refund request. The Company will review and respond within 5–7 business days. If approved, the refund will be issued via the original payment method within 7–15 business days, depending on the payment provider. The Company will confirm the refund by email. Note: The time for funds to reach the user's account depends on the credit card issuer/bank, and may take 7–30 business days. The Company cannot expedite the process of financial institutions. 7.7 Suspension and Termination of Account by the Company The Company reserves the right to suspend or terminate access to a Subscription without prior notice in the following cases: The user violates the terms and conditions set out in this document. Dishonest use of the Subscription is detected, such as account sharing or circumventing the system. Failure to pay fees when due. Where the Company terminates a Subscription without reasonable cause attributable to the user, the Company will refund the remaining balance on a pro-rata basis for the unused period. 7.8 Changes to Subscription Plans and Pricing The Company reserves the right to change the price, plans, or benefits of a Subscription, and will notify users at least 30 days before the change takes effect. Users who do not wish to accept the change may cancel their Subscription before the change takes effect, without penalty. Consolidated Consent and Layered Consent Management The Company has designed its consent process [in accordance with Section 19 of Thailand's Personal Data Protection Act B.E. 2562 (2019), or the equivalent provision under applicable law] into 2 layers, as set out in Section 1.2, as follows: Layer 1 — Mandatory Terms (Contract / Legitimate Interest basis) Clicking "Accept and Get Started" for the first time constitutes acceptance of the terms in Parts 1 and 2 (including Parts 6 and 7, where applicable), which are necessary for the provision of the Service, on the basis of Contractual Necessity rather than Consent, and therefore cannot be withdrawn while continuing to use the Service. Layer 2 — Voluntary Consent (Consent basis — withdrawable at any time) For features that process sensitive health data — namely Part 3 (Community), Part 4 (Wearable), and Part 5 (AI) — the Company will display a separate checkbox for each feature, allowing users to freely choose whether or not to give consent for each feature, and to withdraw consent at any time via the "Privacy Settings" menu, without affecting their right to use the Layer 1 Service. Evidence of Consent and Withdrawal The Company will record the date, time, channel, and details of consent given at each layer, including withdrawals, as evidence in accordance with applicable law, and will notify users through the application before any change to this document takes effect. Continued use of the application after such notice constitutes acceptance of the revised document with respect to Layer 1 only. Changes affecting Layer 2 will require new, explicit consent. For users who access the community feature via the Smile Migraine website for the first time, a Cookie Banner will be displayed, allowing users to accept or decline Analytics Cookies independently of the consent process within the application. Contact Information If you have any questions, complaints, or wish to exercise the rights set out in this document, you may contact the Company as follows: Email: support@smilemigraine.com LINE Official Account: @sm-clinic Phone: +66 95 687 9260 (Monday–Friday, 10:00–18:00) Facebook: Smile Migraine Address: Smile Migraine Co., Ltd., 22/4 Soi 5, Sirimangkalajarn Road, Suthep Sub-district, Mueang Chiang Mai District, Chiang Mai 50200, Thailand