Privacy Policy
Last updated: July 2026

CrossGen Health ("we," "us," "CrossGen Health") is committed to protecting your personal data privacy in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") of Hong Kong.

1. Who We Are
CrossGen Health is operated by Kristen Carusos, based in Hong Kong, and is the "data user" under the PDPO for personal data collected through this website and our services. CrossGen Health is not a medical provider and does not provide clinical services. Contact: kristen@crossgenhealth.com

2. What Information We Collect
Contact and identification details; demographic information; health and medical information you or your parents choose to share (diagnoses, medications, allergies, family history, goals); session notes and health summaries. We also use website analytics/cookies to understand site usage; you can control cookies via your browser settings.

3. How We Use Your Information
To prepare and deliver consultations and health summaries, and to improve our forms and workflow. We do not use identifiable data for direct marketing, and do not sell or rent data. Any future marketing use requires your express, prior consent under Part VIA of the PDPO.

4. Where Your Information Is Stored
Health information is stored in Healthie, our third-party data processor. Scheduling/correspondence may pass through standard email services. No paper files are used except where securely destroyed after use.

5. Who Can Access Your Information
Accessed only by Kristen Carusos for the described purposes; not shared with third parties without your explicit agreement, unless legally required or to protect vital interests.

6. Cross-Border Data Transfers
Providers like Healthie may store data outside Hong Kong; we take practicable steps to ensure appropriate safeguards and will update practices as Section 33 provisions come into force.

7. Data Retention
Identifiable health data is kept typically no longer than 3-6 months after delivery of your summary, then deleted or de-identified. Anonymised insights may be retained.

8. Data Security
Reasonable steps are taken including access controls, passwords, and MFA where possible; no system guarantees absolute security.

9. Your Rights
You may request access, correction, or deletion of your personal data, subject to PDPO limits. Contact kristen@crossgenhealth.com

10. Complaints
You may contact us directly or lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD), Hong Kong.

11. Data Breach Handling
CrossGen Health maintains an internal breach response procedure to identify, contain, assess, and notify where appropriate.

12. Changes to This Policy
Updates may occur; material changes affecting marketing use require prior notice and opt-in/opt-out choice.