Personal Information Collection Statement

Hong Kong Institute of AI for Science (“HKAI-SCI”, “we”, “our” or “us”) values your privacy. We are committed to ensuring that all personal data we collected are handled in compliance with the Personal Data (Privacy) Ordinance.

This Personal Information Collection Statement (“PICS”) applies to your use of our SciencePal platform and the associated software applications and websites (collectively, “Services”) and sets out our policies and practices regarding your personal data. By registering an account for or using the Services, you agree to be bound by this PICS.

How do we collect your data?

We may collect your personal data in the following ways:

• when you visit our website at sciencepal.ai (the “Website”) or contact us at iaissciencepal@cityu.edu.hk;
• when you create an account for the Services; and
• when you voluntarily provide personal data through the Services (e.g. personal data included in prompts, uploaded documents, or other interactions with the Services); and
• when you voluntarily provide personal data to any third-party websites or applications accessible via the Services (“Third-Party Platforms”). For example, when you provide your feedback to the user feedback group on WeChat accessible by scanning the QR code after any output generated by the Services.

It is voluntary for you to provide your personal data.  However, if you do not provide the requisite information, we may not be able to provide our Services to you.

We do not own or control the Third-Party Platforms, and are not responsible for the privacy practices of those Third Party Platforms. We encourage you to remain alert if you follow any links to leave our Website, and to review the privacy policies of those Third Party Platforms so that you are aware of how your personal data may be collected and used by such third parties.

Types of data we collect

The personal data we may collect from you include:

• Identifying information, such as your name;
• Contact information, such as your email address; and
• Other information that you voluntarily provide.

Please ensure that you are legally authorised to share with us any information that contains personal data of another person. Consent from another person shall be obtained before you share his/her personal data with us.

How do we use your personal data?

We collect and use your personal data or other information you provide for the following purposes:

• Administer, operate, and maintain your account and provide customer support (e.g., update your account, verify your identity);
• Provide, maintain, and improve the Services (e.g. optimise and iterate the Services and related offerings);
• Analyse your input or feedback to generate insights and enhance user experience;
• Follow up with you regarding your feedback if you have joined a user feedback group by scanning the QR code we provide;
• Investigate or handle any incidents, claims or disputes, defend or bring any claims or actions, or comply with applicable law or any requests from any regulatory authority, court or government agency.

Who do we share your information with?

To fulfil any of the above purposes, we may share your personal data with:

• Third-Party AI Model Providers - To enable the functionality of our Services, we may share data contained in your prompts, documents or other materials submitted to us with third-party providers whose AI models are integrated into our Services.
• Third-Party Service Providers and Agents - We may share your data with third-party service providers or agents who possess the data on our behalf to carry out any of the purposes set out in this Privacy Policy. These service providers and agents may include IT vendors, data management and analytics service providers.

• Our Staff Member - We may share your information with our staff, both within and outside Hong Kong, who require access to fulfill their duties.
• Internal CityUHK Departments - As part of the City University of Hong Kong (“CityUHK”), we may share your personal data with the departments of CityUHK that require access for administration, support, or investigation in accordance with university policies.
• Professional Advisors and Other Parties -  We may share your data with our legal counsel, auditors, and other professional advisors, as well as any third parties involved in institutional restructuring or similar scenarios, all subject to confidentiality obligations.
• Government and Regulatory Authorities - We may disclose your information to government, regulatory, law enforcement, or judicial bodies as required or permitted by applicable law.

Security, accuracy and retention

We take reasonable and practicable steps to safeguard your personal data against unauthorised or accidental access, processing, erasure, loss or use, including through administrative, technical and physical measures, access controls and regular security reviews. Only authorised personnel, agents and service providers with a need to know will be granted access and they are subject to confidentiality obligations.

We take all reasonably practicable steps to ensure that the personal data we hold is accurate, having regard to the purposes for which it is to be used. Please notify us promptly of any changes to your personal data so that we can keep our records up to date.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected (including any directly related purposes), or as required or permitted by applicable laws or university policies, after which we will take practicable steps to erase, anonymise or de‑identify such data. Without prejudice to the foregoing, operational logs and backups may be retained for a limited period for security, audit and compliance purposes. Where you have accidentally submitted personal data in contravention of our input rules, we may retain limited records to investigate, remediate and prevent recurrence.

Data hosting and cross-border transfers

Hosting locations. We host the Services on a combination of HKAI‑SCI/CityUHK‑operated infrastructure in Hong Kong (SciencePal) and public cloud infrastructure under CityUHK’s enterprise account with one or more reputable cloud providers (currently including Tencent Cloud). We may process your personal data in Hong Kong and in other regions that we may activate from time to time to support availability, security and performance.

Third‑Party AI Model Providers and agents. When you use features that rely on Third‑Party AI Models or other service providers, your personal data in prompts or uploads may be processed in the hosting locations used by those providers, which may be outside Hong Kong.

Minors

Our Services are intended for users aged 18 or above. We do not knowingly collect personal data from individuals under 18 years of age. If you are under 18, you should not register for an account or provide any personal data through the Services.

Your rights

You have the right to request access to and correction of your personal data held by us at any time, by sending an email to us at iaissciencepal@cityu.edu.hk.

Contact Us

If you have any questions or comments about this PICS, or you would like to exercise your legal rights concerning your personal data, you can contact us at iaissciencepal@cityu.edu.hk. We endeavour to respond within 30 days.