Privacy Policy and Personal Information Collection Statement

This document is both our Privacy Policy and our Personal Information Collection Statement.

1. Who we are

The Clearness Organizational Accountability Diagnostic ("the Diagnostic" or "the Service") is provided by Clearness Coaching Limited ("we," "us," "our"), a consulting and coaching practice based in Hong Kong. We decide why and how your personal information is used, and we are responsible for it. The Diagnostic was previously named the "Organizational Accountability Chain Snapshot", and you may still see that name in some places.

Privacy contact: Lucy Qian, Founder, Clearness Coaching Limited, lucy.qian@clearnesscoaching.com. Requests to access or correct your personal data, and any other privacy request, may be addressed to this contact.

2. What we collect, and whether it is required

If you do not provide the required information, you cannot complete the Diagnostic. If your organization gave us your email address so that we could invite you, we hold it from the time of the invitation.

We do not store your IP address in our survey database. Our hosting and email providers may keep technical logs that include IP addresses.

The Diagnostic does not ask for sensitive personal information such as health, financial accounts, religious belief or precise location. Please do not include this kind of information in your written answer.

Before you begin, you will be asked to read this policy and to give your consent. Your responses are saved only after you do so.

3. Why we use it, and on what basis

We use your information to:

• Show you your results and let you download your individual report.
• Send you the emails described below.
• Allow your coach at Clearness Coaching to review your results as part of a professional consulting engagement.
• Prepare a team report for your organization, as described in Section 4.
• Improve the Diagnostic itself, using only data that no longer identifies you (see Section 6).

We process your personal information on the basis of your consent, which you give before you begin. You can withdraw it at any time (see Section 9). We do not use your information for advertising, and we do not sell it.

Emails we send. If you provide an email address, we may send you: a link to resume your progress (at most once per response), a confirmation when you complete the Diagnostic, and up to two reminders if you have not finished. You can ask us to stop the reminders at any time. We do not automatically email your report to you. You can download it from your results page, and we may email it to you if you ask.

4. Who can see your responses

You. Your results page and your individual report show only your own answers.

Your coach. Lucy Qian, the coach at Clearness Coaching Limited who runs your engagement, can see your individual responses, including your name, your email address, and your written answer. She uses them to prepare for coaching conversations and to produce the team report.

Your organization. Your employer and your colleagues do not receive your individual responses, your name alongside your answers, or your individual scores.

With your organization's sponsor (usually the CEO or another senior leader who commissioned the engagement), we share a team report. The team report:

• combines the responses of everyone from your organization who completed the Diagnostic, including yours, without identifying anyone;
• is produced only when at least three people from your organization have completed the Diagnostic;
• shows group-level results only, such as team averages and how responses are distributed;
• does not list names, individual scores, or individual answers;
• includes a short summary of the themes in the written answers, which we write ourselves. We do not quote individual comments or attribute any theme to a person.

When you complete the Diagnostic, your responses are included in the team report by default. If you do not want them included, tell us before the team report is produced and we will leave them out. You can still download your own report.

5. Who we share it with

We use a small number of service providers to operate the Diagnostic. They process your information on our behalf and not for their own purposes:

• Supabase: our database and file storage provider. Your data is stored in a data center in Singapore.
• Postmark (operated by AC PM LLC, United States): our email delivery provider. It receives your email address, your name and the content of the emails we send you.
• Lovable: hosts the web application. Its hosting locations are listed in Lovable's published sub-processor list at trust.lovable.dev.

We do not otherwise share, sell, or disclose your personal data to any third party, except where required by law.

6. How long we keep your information

We keep your identifiable information for 36 months from the date your record is created, which is when you first start the Diagnostic. We may extend this period in a particular case only if you ask us to or the law requires it, and we will tell you.

After that, your record is anonymized rather than deleted outright. Your name, email address, browser information, individual answers (including your written answer), and your report file are permanently removed. We keep your section scores, an overall result category, your language, and the organization code, so that we can understand patterns across many respondents. This data no longer identifies you. We also keep a record that you gave your consent: when, which version of this policy, and in which language.

Our email provider keeps message content and delivery logs for up to 45 days.

Team reports contain group-level results only. We keep them for the duration of the engagement and a reasonable period afterward, and we delete them on request.

If you would like your data deleted earlier, see Section 8.

7. Where your information is processed

Your survey data is stored in a data center in Singapore. Our coach reviews it from Hong Kong. Some of our service providers process limited information outside Singapore, as shown below. If you are located in Mainland China, each of these is a transfer outside Mainland China. Before you begin, the consent box you tick links to this section, and you consent to it together with the rest of this policy.

8. Your rights

You have the right to:

• Access the personal data we hold about you, and ask for a copy.
• Correct or complete any inaccurate or incomplete personal data.
• Request deletion of your data before the 36-month period ends.
• Ask us to explain how we handle your personal information.
• Withdraw your consent at any time (see Section 9).
• Ask us to stop sending you reminder emails.

To exercise any of these rights, contact us using the details in Section 1. We aim to respond within 30 days. This is shorter than the 40 days allowed under Hong Kong law. To exercise your rights against an overseas recipient in Section 7, contact us and we will help, or contact the recipient directly.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data in Hong Kong. If you are located in Mainland China, you may also complain to the competent authorities there.

9. Withdrawing your consent

You can withdraw the consent you gave before you began at any time by emailing lucy.qian@clearnesscoaching.com. Withdrawal does not affect the handling of your information before you withdrew. If you withdraw, we will stop processing your information and, on request, delete it. We will no longer be able to provide the online Diagnostic to you. If a team report has not yet been produced, we will leave your responses out of it. A team report that has already been issued cannot be changed, because individual responses cannot be separated out of group-level results.

10. Security

We take reasonable technical measures to protect your data, including:

• Encryption of data in transit (HTTPS) and at rest.
• Restricted access: only authorized administrators can view respondent data, and they must sign in with a password and a second verification factor.
• A logged record of administrative actions taken on respondent data.

No system can guarantee absolute security. We take these precautions seriously because of the professional nature of the information you share.

11. Children's data

The Diagnostic is a professional tool for adult executives and organizational leaders. We do not knowingly collect data from anyone under 18, and the Service is not directed at them.

12. If you are located in Mainland China

We aim to meet the notice and consent requirements of the laws of the People's Republic of China that apply to your personal information. This policy, together with the consent statement you tick before you begin, is our notice to you. The rights in Section 8 and the right to withdraw consent in Section 9 apply to you.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date above shows the latest revision. We will post material changes on this page before they take effect, and we will ask for your consent again where the law requires it.

14. Contact us

Questions about this policy or about your data can be sent to the privacy contact in Section 1.