We generate and process a large amount of personal, transaction, demographic and behavioral data including medical records and other personal information. We face risks inherent in handling large volumes of data and in securing and protecting such data. In particular, we face a number of data-related challenges related to our business operations, including:
- protecting the data in and hosted on our system, including against attacks on our system by external parties or fraudulent behavior by our employees;- addressing concerns related to privacy and sharing, safety, security and other factors; and - complying with applicable laws, rules and regulations relating to the collection, storage, use, processing, transmission, provision, disclosure, deletion or security of personal information, including any requests from regulatory and government authorities relating to such data.
Regulatory requirements regarding the protection of such data are constantly evolving and can be subject to change, making the extent of our responsibility in that regard uncertain. Under certain regulations, rules and measures promulgated by the Ministry of Industry and Information Technology of the People's Republic of China, or the MIIT, since 2011, any collection and use of a user's personal information by an internet services provider must be subject to the consent of the user, abide by the principles of legality, rationality and necessity, and be within the specified purposes, methods and scopes. The internet services provider must keep all information collected strictly confidential and is prohibited from divulging, tampering with or destroying any such information, or selling or providing such information to other parties.
The PRC Cyber Security Law, which took effective in June 2017, created China's first national-level data protection regime for "network operators," which may include all organizations in China that provide services over the internet or other information network. Furthermore, in August 2018, the Standing Committee of China's National People's Congress, or the SCNPC promulgated the E-Commerce Law of the People's Republic of China, or the E-Commerce Law, to regulate the e-commerce activities conducted within the territory of the PRC, which further strengthens the protection of consumers' personal data and privacy. In addition, the PRC Data Security Law took effect in September 2021. Numerous regulations, guidelines and other measures have been or are expected to be adopted under the umbrella of, or in addition to, the Cyber Security Law and Data Security Law. For example, Regulations on the Security Protection of Critical Information Infrastructure, or the CII Protection Regulations, became effective in September 2021. According to the CII Protection Regulations, a critical information infrastructure operator, or a CIIO, must take the responsibility to protect the CII's security by performing certain prescribed obligations. The Safety Assessment Measures for Data Outbound Transfer, which became effective on September 1, 2022, outlined the requirements and procedures for security assessments on export of important data or personal information collected or generated within the territory of mainland China under certain circumstances, and provided that the security assessment shall combine pre-assessment and continuous supervision, and risk self-assessment and security assessment to prevent data export security risks. According to the Measures for the Standard Contract for Outbound Transfer of Personal Information, where personal information is transferred outbound through entering into standard contract, combination of voluntarily contracting and filing management, rights protection and risk prevention shall be insisted, to guarantee the safety and freedom of the outbound transfer of personal information. For additional information, see "Item 4. Information on the Company-B. Business Overview- Regulations- Regulations relating to Internet Information Security and Privacy Protection." As of the date of this annual report, we have not been identified as a CIIO by the relevant regulatory authority.
The Personal Information Protection Law took effect in November 2021, integrates the various rules with respect to personal information rights and privacy protection. In December 2021, the Cyberspace Administration of China, or the CAC, and several other administrations jointly promulgated the amended Cybersecurity Review Measures, or the Cybersecurity Review Measures, which took effect in February 2022. Pursuant to the Cybersecurity Review Measures, if the relevant activity affects or may affect national security, a CIIO that purchases network products and services or an internet platform operator that conducts data process activities shall be subject to the cybersecurity review. The Cybersecurity Review Measures also expands the cybersecurity review requirement to cover "internet platform operators" in possession of personal information of over one million users if such operators intend to list their securities in a foreign country. See "-Risks Related to Doing Business in China- The approval, filing or other requirements of the China Securities Regulatory Commission or other PRC government authorities may be required under PRC law in connection with our issuance of securities overseas."
Furthermore, since September 2021, a series of laws and regulations relating to information security, privacy and data protection have been adopted. For more information, see "Item 4. Information on the Company-B. Business Overview- Regulations- Regulations relating to Internet Information Security and Privacy Protection."
Since these laws and regulations in China are relatively new, uncertainties still exist in relation to their interpretation and implementation. Any change in laws and regulations relating to privacy, data protection and information security and any enhanced governmental enforcement action of such laws and regulations could greatly increase our cost in providing our products and services, limit their use or adoption or require certain changes to be made to our operations. If we fail to comply with these new laws and regulations described above, we may be ordered to rectify and terminate any actions that are deemed illegal by the government authorities and become subject to fines and other government sanctions, which may materially and adversely affect our business, financial condition, and results of operations.
Our privacy policies and practices concerning the collection, storage, use, processing and disclosure of user data are posted on our mobile app. Any failure, or perceived failure, by us to comply with our privacy policies or with any applicable regulatory requirements or privacy protection-related laws, rules and regulations could result in proceedings or actions against us by governmental entities or others. These proceedings or actions may subject us to significant penalties and negative publicity, require us to change our business model or practices, increase our costs and severely disrupt our business, which may materially and adversely affect our business, financial condition, results of operations and prospects.