Personal Data Privacy Policy

Mescells respects privacy and is committed to protecting the personal data of customers, patients, trainees, partners, experts, website users and other related individuals.

This Personal Data Protection Policy sets out how Mescells collects, uses, processes, stores, shares and protects personal data in the course of operating the Mescells.com website, providing information and services, receiving consultation requests and carrying out research, training, healthcare and regenerative medicine activities.

This Policy is based on the Law on Personal Data Protection No. 91/2025/QH15, Decree No. 356/2025/NĐ-CP and other relevant legal regulations.

1. Scope of application

This Policy applies to personal data collected and processed by Mescells through:

• The Mescells.com website;
• Registration, contact and consultation forms on the website;
• Registration for and participation in training programs;
• Consultation and care activities for customers and patients;
• Research and application of cell technology and regenerative medicine within the scope permitted by law;
• Programs, conferences and events organized or attended by Mescells;
• Recruitment activities;
• Email, telephone and other official Mescells contact channels;
• Other online platforms, systems or services lawfully managed or used by Mescells.

This Policy applies to customers, patients, website users, trainees, partners, experts, job applicants and other individuals whose data is processed by Mescells.

2. About Mescells

Mescells is a system operating in the field of regenerative medicine and cell therapy, with an ecosystem comprising cell technology research, a tissue bank, training and the application of regenerative medicine in healthcare. The Mescells.com website currently provides information on Mescells’ research, cell technology, tissue bank, training, health knowledge and related activities.

Mescells contact information:

• Website: Mescells.com
• Phone: 0866 022 097
• Email: institute@mescells.com
• Address: TT21, No. 204 Nguyen Tuan, Thanh Xuan Ward, Hanoi, Vietnam
• Tax code: 0109755129

Mescells may update its contact information when changes occur.

3. Types of personal data Mescells may collect

Depending on the purpose and the relationship between the individual and Mescells, we may collect the following categories of data.

3.1. Identification and contact data

This may include:

• Full name;
• Date of birth, where necessary;
• Phone number;
• Email address;
• Contact address;
• Account information;
• Occupation and workplace information, where necessary;
• Other information voluntarily provided by the individual.

3.2. Data for consultation and healthcare

Where an individual uses our services or submits a health-related consultation request, Mescells may process information that the individual voluntarily provides and that is necessary for the purpose of consultation, care or service provision.

Depending on the case, this information may include:

• The content of the consultation request;
• Information relating to health status;
• Medical history or past illnesses provided by the individual;
• Test results, diagnoses or medical records, where necessary and lawfully provided;
• Information relating to the use of medical services.

This is a category of information that must be protected to an appropriate level in accordance with the law.

Mescells only collects and processes information that is necessary for a specific purpose and on an appropriate legal basis.

3.3. Data of trainees and training participants

For training programs organized by Mescells, the information may include:

• Full name;
• Contact information;
• Workplace;
• Professional title;
• Course registration information;
• Learning results, assessments and other information needed to issue a certificate or confirm course completion.

3.4. Job applicant data

For job applicants, Mescells may process:

• Full name;
• Contact information;
• CV/application documents;
• Professional qualifications;
• Education and employment history;
• Professional experience;
• Other information provided by the applicant for recruitment purposes.

3.5. Technical data when accessing the website

When users visit Mescells.com, certain technical information may be recorded automatically, including:

• IP address;
• Device type;
• Operating system;
• Browser type;
• Time of access;
• Pages visited;
• Referral source;
• Information about activity on the website;
• Cookies and similar technologies.

This data is used mainly to operate, secure, analyze and improve the website.

4. Purposes of processing personal data

Mescells processes personal data for appropriate and lawful purposes, including:

• Receiving and responding to users’ contact requests;
• Providing information and advice about Mescells’ activities, products and services;
• Receiving consultation requests relating to regenerative medicine and healthcare;
• Performing and managing the services that customers register for;
• Caring for customers and patients;
• Managing trainees and organizing training programs;
• Issuing certificates, confirmations or other documents relating to training activities, where necessary;
• Receiving and processing job applications;
• Organizing conferences, seminars, events and professional activities;
• Carrying out research activities within the scope permitted by law;
• Managing, operating and securing the website;
• Analyzing, evaluating and improving the user experience;
• Sending information, news, programs or communications where there is an appropriate legal basis;
• Preventing fraud, abuse or information security risks;
• Fulfilling obligations under the law;
• Protecting the legitimate rights and interests of Mescells and related parties.

Mescells does not use personal data for purposes that are inconsistent with the notified purposes or that have no legal basis.

5. Legal bases for processing personal data

Mescells processes personal data on bases consistent with the law, which may include:

• The consent of the data subject;
• Performance of a contract or agreement;
• Compliance with a legal obligation;
• Protection of legitimate rights and interests;
• Carrying out activities permitted by law.

Where the law requires consent, Mescells will collect and record consent in accordance with the regulations.

6. Consent of the data subject

Where consent is required, Mescells will provide appropriate information so that the data subject is aware of the personal data processing activities.

Depending on the case, the information provided may include:

• The types of data processed;
• The purposes of processing;
• The methods of processing;
• The parties involved in the processing;
• The storage period;
• The rights of the data subject;
• Other information as required by law.

Consent is given voluntarily, clearly and in accordance with the law.

The data subject has the right to withdraw consent where permitted by law. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Principles of personal data protection and processing

Mescells is committed to:

• Processing personal data lawfully;
• Being transparent in its processing activities;
• Collecting only data that is appropriate and necessary;
• Using data for the stated purposes;
• Ensuring the accuracy of data;
• Applying appropriate protective measures;
• Limiting access to data;
• Not buying or selling personal data in violation of the law;
• Respecting the legitimate rights and interests of data subjects.

8. Sharing and disclosure of personal data

Mescells does not sell the personal data of customers, patients, trainees or users to third parties in violation of the law.

To the extent necessary, personal data may be provided to or shared with:

• Authorized departments of Mescells;
• Relevant professional teams, medical personnel or experts;
• Information technology service providers;
• Data storage service providers;
• Customer care service providers;
• Payment service providers or providers of other necessary services;
• Partners performing services upon lawful request;
• Competent state authorities in accordance with the law;
• Other parties where the data subject consents or the law permits.

Mescells requires parties with access to data to implement appropriate security measures.

9. Personal data in medical and research activities

As Mescells operates in the fields of regenerative medicine, cell therapy, and cell technology research and application, some activities may involve the processing of health-related data.

Mescells is committed to:

• Collecting only the data necessary for a specific purpose;
• Keeping the information of customers and patients confidential;
• Controlling access to information;
• Not using health information beyond the permitted scope;
• Complying with legal requirements relating to health data and personal data;
• Applying protective measures appropriate to the sensitivity of the data.

For research activities that use personal data, Mescells complies with the law, professional procedures and relevant research ethics requirements.

10. Engaging personal data processors

Mescells may use external service providers to support certain activities such as:

• Data storage;
• Website administration;
• Information technology;
• Email;
• Website analytics;
• Customer care;
• Marketing and communications;
• Other technical services.

Where a third party is involved in processing personal data, Mescells will apply appropriate management measures to ensure that data is processed within the proper scope and for the proper purposes.

11. Transfer of personal data abroad

Some technology platforms, cloud storage, email, website analytics or technical services used by Mescells may have servers or infrastructure located outside the territory of Vietnam.

Where cross-border transfers of personal data arise, Mescells fulfils the obligations and protective measures required by Vietnamese law on personal data protection.

12. Cookies and tracking technologies

Mescells.com may use cookies or similar technologies to:

• Maintain website functionality;
• Remember user preferences;
• Analyze traffic;
• Improve the experience;
• Evaluate content effectiveness;
• Improve communications activities;
• Detect unusual activity and strengthen security.

Users can adjust cookie settings through their browser or device.

13. Data retention period

Mescells retains personal data for the period necessary to:

• Fulfil the purposes of processing;
• Provide products and services;
• Perform contracts;
• Comply with legal obligations;
• Resolve complaints and disputes;
• Protect the legitimate rights and interests of Mescells.

When data is no longer necessary and is not required to be retained under the regulations, Mescells will delete, destroy or otherwise appropriately handle it.

14. Personal data protection measures

Mescells applies appropriate management, organizational and technical measures to protect personal data against:

• Unauthorized access;
• Misuse;
• Unauthorized disclosure;
• Loss;
• Unauthorized alteration;
• Destruction;
• Other infringements.

These measures may include:

• Access control;
• User permission management;
• Account management;
• System security;
• Data backup;
• Vendor controls;
• Staff training;
• Monitoring and handling of information security risks.

Mescells regularly reviews and improves its data protection measures in line with its actual operations and level of risk.

15. Handling personal data breaches

Upon detecting an incident that may affect personal data, Mescells will take appropriate measures, including:

• Detecting and assessing the incident;
• Containing it and limiting its impact;
• Remedying the cause;
• Protecting data against further infringement;
• Retaining the information needed for investigation;
• Fulfilling notification and reporting obligations as required by law.

Where necessary, Mescells will coordinate with the competent authorities and related parties to handle the incident.

16. Responsibilities of users

Users are responsible for:

• Providing accurate information;
• Not unlawfully providing other people’s personal data;
• Keeping their own accounts and authentication information secure;
• Notifying Mescells upon discovering a data security risk;
• Complying with the law when using the Mescells website and services.

17. Links to third-party websites and platforms

Mescells.com may contain links to third-party websites or platforms.

This Policy does not apply to the data processing activities of those third parties.

Users should read each party’s privacy policy and personal data policy before providing information.

18. Responsibilities of Mescells

Mescells is committed to:

• Complying with the law on personal data protection;
• Being transparent about data processing activities;
• Protecting personal data within its control;
• Limiting access to data;
• Managing third parties involved in data processing;
• Receiving and handling lawful requests from data subjects;
• Training staff and raising their awareness;
• Reviewing and updating data protection measures;
• Updating this Policy when there are changes in its operations or in the law.

19. Changes to the Personal Data Protection Policy

Mescells may update this Policy when:

• Business activities change;
• The website or technology systems change;
• New services are introduced;
• Data processing methods change;
• The law on personal data protection changes;
• New data governance and security requirements arise.

The updated version will be published on Mescells.com with the date of the update.

Where a change significantly affects the rights and interests of data subjects, Mescells will give appropriate notice in accordance with the law.

20. Effect of the Policy

This Policy is drawn up and applied in accordance with the Law on Personal Data Protection No. 91/2025/QH15, Decree No. 356/2025/NĐ-CP and other relevant legal regulations.

In the event of any discrepancy between this Policy and mandatory legal provisions, the legal provisions shall prevail.