Privacy Policy & Global Data Security Compliance

1. Global Compliance Framework & Data Governance

At Oaxis, data privacy, system security, and regulatory compliance are integrated directly into our hardware design, embedded firmware, mobile apps, and cloud backends. As an established manufacturer and OEM/ODM provider serving tier-one retailers, telecom operators, and brand partners across North America, Europe, Asia-Pacific, and the Middle East, we enforce strict technical and organizational measures to safeguard user data.

Our global data management framework fully aligns with international compliance mandates, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and Children's Online Privacy Protection Rule (COPPA).

2. Children's Data Protection & Safety Protocols (COPPA & GDPR-K)

Specialized safety mechanisms govern all Oaxis family and kids tech platforms (including kids GPS smartwatch phones and companion apps). Protecting children's personal identity and geolocation data is paramount to our operational design.

2.1 Parental Control & Express Consent

Under COPPA and GDPR-K regulations, accounts for minors can only be activated under direct parental supervision. Parents or legal guardians retain exclusive ownership over the device's whitelist contact list, real-time LBS/GPS tracking access, voice message logs, and SOS emergency dispatch settings.

2.2 Geolocation & Biometric Data Safeguards

• Real-Time Location Encryption: All GPS coordinate streams transmitted between kids smartwatches and mobile applications utilize TLS 1.3 encrypted tunnels. Location history logs are retained solely for operational features (such as safe zone fencing) and are automatically scrubbed on scheduled retention cycles.
• Zero Unsolicited Third-Party Advertising: We strictly prohibit third-party ad networks, behavioural tracking scripts, or data brokers inside our children's ecosystem. Minors' profile data is never commercialized, monetized, or shared.

3. Information Collection & Technical Processing Scope

To deliver reliable hardware functionality—such as step tracking, heart rate monitoring, body composition analytics, and location-based safety features—Oaxis processes specific categories of user information under defined legal bases.

3.1 Account & Identity Credentials

When creating an account via the Oaxis companion app, users provide basic credentials such as email address, system username, and encrypted password hashes. Plain-text passwords are never stored or logged on our infrastructure.

3.2 IoT Device Telemetry & Health Metrics

Connected hardware (including heart rate bands, hybrid smartwatches, and smart body composition scales) records functional metrics including daily steps, distance, calories, optical PPG heart rate, sleep duration, and BIA body composition data. Health-related metrics are processed under explicit user consent and are utilized exclusively to calculate personalized health analytics within the app dashboard.

3.3 Payment & B2B Partner Information

For corporate purchasing teams and retail partners acquiring merchandise or hardware samples, financial processing details (such as credit card routing numbers and billing data) are processed directly by certified PCI-DSS compliant payment gateways. Oaxis maintains order history, shipping addresses, and corporate verification records solely for contract fulfillment and supply-chain logistics.

4. Hardware Security, Cloud Architecture & Data Transfers

Oaxis maintains end-to-end oversight over the firmware development cycle, mobile software updates, and server infrastructure to eliminate vulnerabilities.

4.1 Secure Server Infrastructure

Our backend architectures operate within ISO/IEC 27001 certified and SOC 2 compliant data centers. All persistent databases use AES-256 encryption at rest, preventing unauthorized physical or logical extraction.

4.2 White-Label & OEM Data Partitioning

For overseas brand clients utilizing our OEM/ODM custom app skinning or private cloud backend services, Oaxis provides strict multi-tenant logical isolation. Private-label client telemetry data is isolated to designated cloud instances, preventing cross-tenant access and ensuring enterprise data sovereignty.

5. User & Corporate Data Rights (EEA & Global Rights)

Every end consumer and enterprise partner retains full sovereignty over their personal data. Regardless of geographical location, Oaxis grants the following data management capabilities:

• Right to Access & Portability: Users may request a structured export of their account records, historical health telemetry, and device activity logs.
• Right to Rectification & Erasure: Account profiles and underlying server databases can be permanently deleted upon verified request. Upon account termination, personal identifiers are purged from active production systems immediately.
• Consent Revocation: Users can revoke permission for location tracking, health telemetry sync, or communication updates directly within smartphone application settings or system permissions.