AIA Vitality is a health and wellness programme, encouraging you to get healthier and earn great rewards. In order for AIA Vitality-related services to be provided to you, it will be necessary for us to collect, use and share certain personal data about you. Customers and potential customers expect us to maintain their information accurately, protected against manipulation and errors, secure from theft and free from unwarranted disclosure. We protect the data security of our customers and potential customers by complying with the Personal Data (Privacy) Ordinance, and all relevant local laws, and ensure compliance by our staff with strict standards of security and confidentiality.

This statement ("Vitality PIC Statement") provides you with notice as to why your personal data is collected, how it is intended to be used, to whom your personal data may be provided, from whom your personal data may be collected and how to access, review and amend your personal data. The provision of your personal data is voluntary: you may choose not to provide us with the requested data, but failure to do so may inhibit AIA Vitality's ability to provide you with its services

AIA Vitality is operated by AIA Group Limited, AIA Company Limited, AIA International Limited (collectively, the "AIA Vitality Operator"), members of the AIA group of companies ("AIA Group"). The AIA Vitality Operator will receive ongoing support from Discovery Limited (a company based in South Africa) and/or its affiliates ("DSY"), the [global operators of the AIA Vitality programme].

It is also important for you to note that [the underwriting and claims departments of] AIA Company Limited, AIA International Limited, or any other insurer within the AIA Group ("AIA Insurers") will not have access to your personal data (including health and medical information) provided to, or collected via, AIA Vitality. Accordingly, where you are applying for a new insurance policy from the AIA Insurers, you acknowledge that any health, medical or other information that may affect the risk under an insurance policy needs to be separately notified to the AIA Insurers even if you have already provided the information to the AIA Vitality Operator or the AIA Vitality Partners (as defined below). Similarly, if you are currently under any obligation to notify the AIA Insurers of the occurrence of any event or of the onset of any condition, or of the cessation of any such event or condition, then you will need to separately notify the AIA Insurers of the same even if you have already provided the information to the AIA Vitality Operator or the AIA Vitality Partners (as defined below).

By using this website, you are accepting the practices and policies in this Vitality PIC Statement. If you object to any practices and policies in this Vitality PIC Statement, please do not use this website to submit your personal information towards the AIA Vitality programme.

This website is for general information purpose only. While we use reasonable efforts to ensure the accuracy of the information on this website, AIA Vitality Operator and AIA Vitality Partners (as defined below) do not warrant its absolute accuracy or accept any liability for any loss or damage resulting from any inaccuracy or omission. Without prior permission from AIA Vitality Operator, no information contained on this website may be copied, except for personal use, or redistributed.

This website and our social media platforms are not intended for persons in jurisdictions that restrict the distribution of information by us or use of such social media platforms. If this is applicable to you, we would advise you to inform yourself about and observe the relevant restrictions. AIA Vitality Operator and AIA Vitality Partners (as defined below) do not accept liability in this respect.

Personal data is collected for the following purposes:

• to process, administer, implement and effect the requests, transactions or membership services under AIA Vitality. In this regard, in addition to any personal data that the AIA Vitality Operator may collect directly from you, the AIA Vitality Operator may also need to collect from the AIA Vitality Partners (as defined below) information regarding your use of, and participation in (including progress and results from), the membership goods or services provided by the AIA Vitality Partners (as defined below);
• to design new or to enhance existing services to be provided under AIA Vitality;
• to communicate with you regarding updates and future changes to AIA Vitality, your AIA Vitality membership and account, or this Vitality PIC Statement;
• to provide other AIA Vitality and/or loyalty programme-related services such as online shopping at AIA Vitality website or AIA Vitality purchases;
• for statistical or actuarial research undertaken by the AIA Group, our partners who provide goods and services under AIA Vitality ("AIA Vitality Partners"), the financial services industry or our respective regulators;
• to facilitate payment for products and/or services provided by AIA Vitality Operator, any other member of the AIA Group or any AIA Vitality Partner, including but not limited to for the verification of credit card details with credit card issuers or other third party service providers, obtaining consumer credit reports from a credit reference agency and conducting match making procedures against databases of known fraudulent transactions maintained by AIA Vitality Operator, any other member of the AIA Group, any AIA Vitality Partner or third party;
• to assist in law enforcement purposes, investigations by police or other government or regulatory authorities and to meet requirements imposed by law or agreed to with government or regulatory authorities; and
• other purposes directly relating to any of the above.

For our policy on using your personal data for promotional or marketing purposes relating to AIA Vitality, please see the sectionFor our policy on using your personal data for promotional or marketing purposes relating to AIA Vitality, please see the section "Use of Personal Data for Direct Marketing Purposes" below.

Personal data will be kept confidential but may, where such disclosure is necessary to satisfy any of the abovementioned purposes, be provided to the following parties:

• any of our affiliates and to DSY for the purposes specified above;
• any person authorised to act as an agent of the AIA Vitality Operator for the distribution of information in relation to AIA Vitality;
• the AIA Vitality Partners and their agents for the provision of membership goods and/or services, and programme administration;
• any agent, contractor or third party service provider who provides membership servicing support including but not limited to administration, data processing, data storage, call center services, mailing, system infrastructure and operation, website administration, marketing, finance, rewards, invoicing and training;
• other companies who help gather your information or communicate with you, such as research companies and ratings agencies, in order to enhance the services to be provided under AIA Vitality
• government or regulatory bodies or any person to whom the AIA Vitality Operator (or another AIA Group company) or an AIA Vitality Partner is to make disclosure: (a) under a legal and / or regulatory obligation in that jurisdiction applicable to that particular AIA Group company or AIA Vitality Partner; or (b) which the AIA Group company or AIA Vitality Partner has agreed to make disclosures.

From time to time, the AIA Group may purchase a business or sell one or more of its businesses (or portions thereof) and your personal data may be transferred or disclosed as part of the purchase or sale or a proposed purchase or sale. In the event that the AIA Group purchase a business, the personal data received with that business, to the extent that it is relevant to AIA Vitality, will be treated in accordance with this Vitality PIC Statement. In the event that the AIA Group sell a business, to the extent that it is relevant to AIA Vitality, a provision will be included in the selling contract requiring the purchase to treat your personal data in the same manner required by this Vitality PIC Statement

For our policy on sharing your personal data for promotional or marketing purposes relating to AIA Vitality, please see the section "Use of Personal Data for Direct Marketing Purposes" below.

You have the right to:

• verify whether the AIA Vitality Operator holds any personal data about you in relation to AIA Vitality and to access any such data;
• require the AIA Vitality Operator to correct any personal data relating to you held under AIA Vitality which is inaccurate; and
• • ascertain the AIA Vitality Operator's policies and practices in relation to personal data.

Requests for access, correction or other queries relating to you under the AIA Vitality programme should be addressed to:

AIA Company Limited 181 Surawongse Road, Bangkok 10500, Thailand.

The AIA Vitality Operator has the right to charge costs which are directly related to and necessary for the processing of any personal data access request.

As well as for the purposes set out above, the AIA Group intends to use your name and contact details for promotional or marketing purposes including sending you promotional materials and conducting direct marketing in relation to the following products, services, advice and subjects: insurance; annuities; MPF/ORSO; wealth management; investment; banking; financial services; credit cards; medical/health treatment; educational; recruitment; training; reward/loyalty/privilege programmes; travel; accommodation; apparel; concerts; sporting and special events; food and beverage; household; media; social networking; spa and similar relaxation activities and other leisure services; telecommunication and mobile services; internet; other retail/consumer products and services; wellness and charitable/non-profitable causes ("Classes of Marketing Subjects").

For the purposes of direct marketing, we may provide your personal information to providers (and their agents) (whether within or outside of the AIA Group) of any of the Classes of Marketing Subjects described above so that they can contact you and/or send you promotional materials and conduct direct marketing in relation to the products and services that they offer (these materials may be sent to you by postal mail, email or other means). We may provide your personal data to providers (whether within or outside of the AIA Group) of any of the Classes of Marketing Subjects for gain.

Before using your personal data for the purposes and to the transferees set out above, we must obtain your written consent, and only after having obtained such written consent may we use and/or provide your personal data for any promotional or marketing purpose.

The types of personal data that the AIA Group intends to use and provide for direct marketing purposes as described above are your name and contact details.

You may in future withdraw your consent to the use and provision to a third party by the AIA Vitality Operator of your personal data for direct marketing purposes and thereafter the AIA Vitality Operator shall cease to use such data for direct marketing purposes.

If you wish to withdraw your consent, please inform us by writing to the address in the section on "Access Rights to Personal Data" or sending us an email. Any such request should clearly state details of the personal data in respect of which the request is being made.

Cookies are unique identifiers placed on your computer or other device by a web server, which contains information that can later be read by the server that issued the cookie to you. AIA Vitality Operator may use cookies on various websites we maintain. The information collected (including but not limited to: your IP addresses (and domain names), browser software, types and configurations of your browser, language settings, geo-locations, operating systems, referring website, pages and content viewed, and durations of visit) will be used for compiling aggregate statistics on how our visitors reach and browse our websites to help us understand how we can improve your experience on it. Such information is collected anonymously and you cannot be identified unless you have logged on as a member. We use such data only for website enhancement and optimisation purposes. The cookies also enable our website to remember you and your preferences, and tailor the website for your needs. Advertising cookies will allow us to provide advertisements on our websites that are as relevant to you as possible, e.g. by selecting interest-based advertisements for you, or preventing the same advisement from constantly reappearing to you.

Most web browsers are initially set up to accept cookies. If you do not want to receive cookies, you can disable this function in your browser settings. However, by doing so you may not be able to fully enjoy the benefits of our websites and certain features may not work properly.

If any part of this website contains links to other websites, those sites may not operate under this Vitality PIC Statement. You are advised to check the privacy statements on those websites to understand their policies on the collection, usage, transferal and disclosure of personal data.

The AIA Vitality Operator reserves the right, at any time and without notice, to add to, change, update or modify this Vitality PIC Statement, simply by notifying you of such change, update or modification. If we decide to change our personal data policy, those changes will be notified to you either on our website or in writing so that you are always aware of what information we collect, how we use the information and under what circumstances the information is disclosed. Any such change, update or modification will be effective immediately upon posting.

Should you have any questions on any part of this Vitality PIC Statement or would like additional information regarding the AIA Vitality Operator's data privacy policies and practices, please do not hesitate to contact us