Privacy Policy - Equipia.io

Equipia Solutions Ltd
Last updated: May 2026

1. Our Commitment to Privacy

Equipia Solutions Ltd is committed to protecting the privacy, confidentiality, and security of the personal data we hold, in compliance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”). We are equally committed to ensuring that all our staff and service providers uphold these obligations.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Equipia platform at equipia.io, including our AI-powered medical equipment cutsheet generation and product specification library services.

2. What Personal Data We Collect

We collect the following categories of personal data:

Account Data:

Full name
Organisation name
Email address (mandatory for account creation)
Password (stored in encrypted/hashed form; we do not store plaintext passwords)
Account creation date and timestamp

Usage Data:

URLs and links submitted to the AI Feature
AI-generated cutsheets and product specifications produced for your Account
Feature usage history and timestamps

Technical Data:

IP address
Browser type and version
Device type and operating system
Pages visited and session duration on equipia.io

Communications Data:

Email correspondence with our support team
Newsletter and marketing email engagement data (open rates, unsubscribe actions)

3. Why We Collect Your Personal Data

We collect and use your personal data for the following purposes:

(a) Account management — to create and maintain your Account and provide you with access to the Service;

(b) Service delivery — to process URLs you submit and generate AI-powered cutsheets and product specifications;

(c) Newsletter and marketing communications — to send you newsletters and product updates; you are enrolled by creating an Account and may unsubscribe at any time;

(d) Service improvement — to compile anonymised, aggregate statistics on how the Service is used. We do not use personally identifiable data for this purpose;

(e) Security and fraud prevention — to detect and prevent unauthorised access or misuse of the Service;

(f) Legal compliance — to comply with applicable laws and lawful requests from authorities.

The supply of your full name, organisation name, and email address is mandatory to create an Account. All other data collection is either automatically generated by your use of the Service or voluntary.

4. Personal Information Collection Statement

When you register for an Account on equipia.io, we collect your full name, organisation name, email address, and password for the purposes described in Section 3. At the point of registration, you will be asked to confirm your agreement to these Terms and Conditions and this Privacy Policy. By completing registration, you also agree to receive the Equipia newsletter, from which you may unsubscribe at any time.

You have the right to request access to and correction of any personal data we hold about you. Please contact us at data@equipia.io. We will respond within 40 days in accordance with the PDPO.

5. How We Store Your Data

Storage location: Your personal data is stored and processed on servers located in the United States. See Section 6 for details.

Security measures:

Passwords are stored in hashed/encrypted form and are never stored in plaintext
All data transmitted between your browser and equipia.io is encrypted using HTTPS/TLS
Access to personal data is restricted to authorised personnel on a need-to-know basis
Our database infrastructure provider maintains SOC 2 Type 2 certification

Retention:

Active accounts: We retain your personal data for as long as your Account remains active.
Account deletion: Upon deletion of your Account, your personal data (email address and account credentials) will be anonymised within [X] days. Anonymised usage data and Generated Content may be retained indefinitely.
Marketing data: If you unsubscribe, we retain a record of your unsubscribe request to ensure we do not contact you again.

6. Cross-Border Data Storage

Equipia Solutions Ltd is a Hong Kong company. Your personal data is stored and processed outside of Hong Kong as follows:

Provider	Purpose	Location	Data Protection Commitment
Supabase	Database storage and infrastructure	United States	SOC 2 Type 2 certified; supabase.com/legal/dpa

By using the Service and creating an Account, you acknowledge and consent to your personal data being stored and processed in the United States for the purposes described in this Policy.

7. Newsletter and Direct Marketing

7.1. Newsletter Enrolment: By creating an Account, you agree to receive newsletters and marketing communications from Equipia Solutions Ltd at the email address provided. You may unsubscribe at any time as described in Section 7.3.

7.2. What we send: Our newsletters may include product updates, new features, industry news related to medical equipment, and promotional information about the Service.

7.3. Opt-out: You may withdraw your consent at any time by clicking the unsubscribe link in any marketing email or by contacting us at data@equipia.io.

7.4. Processing time: We will process all unsubscribe requests within 10 business days.

7.5. Email identification: All marketing emails will clearly identify us as the sender and will not use deceptive subject lines.

7.6. No third-party marketing: We will not provide your personal data to third parties for use in direct marketing without your separate and explicit consent.

8. Disclosure of Personal Data to Third Parties

We do not sell your personal data. We share data only with the following service providers who process it on our behalf:

Provider	Data Shared	Purpose	Privacy Reference
Supabase	Account data, usage data, Generated Content	Database storage and infrastructure	supabase.com/privacy
Resend	Email address	Newsletter and marketing email delivery	resend.com/legal/privacy-policy

We may also disclose personal data if required by law or court order, or in connection with a merger or acquisition subject to equivalent privacy protections.

We will not disclose your personal data to any other third party without your prior consent.

9. Aggregated Platform Metrics

Equipia Solutions Ltd may share aggregated, anonymised platform metrics with verified medical device manufacturers for commercial and informational purposes. Examples include total registered users, platform usage trends by device category, or aggregate search volumes by product type.

Such information does not identify you or any specific individual and does not constitute personal data under the PDPO. We will never share your personal data, email address, or individual usage history with manufacturers or any other third party without your explicit prior consent.

10. Your Rights Under the PDPO

Under the PDPO, you have the right to request access to and correction of the personal data we hold about you.

To exercise these rights, please contact:

Equipia Solutions Ltd
data@equipia.io

We will respond within 40 days of receipt. We may charge a reasonable fee for data access requests and will verify your identity before processing any request.

11. Cookies and Technical Data

When you visit equipia.io, we may use cookies to maintain your login session, compile anonymised usage statistics, and ensure the security and proper functioning of the Service. We do not use cookies for advertising or cross-site tracking.

You may disable cookies in your browser settings. Disabling certain cookies may affect your ability to remain logged in to your Account.

12. Data Security

We protect your personal data through:

Encryption in transit: HTTPS/TLS for all data transmission
Encryption at rest: Provided by our database infrastructure provider
Access controls: Restricted to authorised Equipia personnel on a need-to-know basis
Third-party security: Our AI processing provider does not use your data to train AI models and does not share it with third parties
SOC 2 certification: Our database provider is independently audited annually

In the event of a data breach posing real risk of harm, we will notify the PCPD and affected users as appropriate.

13. Children’s Privacy

The Service is intended for individuals aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe we have inadvertently done so, please contact us at data@equipia.io and we will delete such data promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on equipia.io and, where appropriate, by email. Your continued use of the Service after an update constitutes your acceptance of the revised Policy.

15. Contact and Enquiries

For any enquiries, complaints, or requests regarding this Privacy Policy or your personal data, please contact: