Sustainable Living Lab Pte Ltd | UEN: 201211858M

StayCool Data Protection Notice for Participants

A community heat-resilience programme delivered by Sustainable Living Lab (SL2), supported by the SG Eco Fund

This Data Protection Notice ("Notice") sets out the basis upon which Sustainable Living Lab Pte Ltd ("SL2", "we", "us" or "our") collects, uses, discloses or otherwise processes the personal data of StayCool participants, in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA") and all associated regulations and guidelines issued from time to time by the Personal Data Protection Commission ("PDPC").

This Notice applies to personal data in our possession or under our control, including personal data in the possession of organisations we have engaged to collect, use, disclose or process personal data on our behalf and for our purposes ("data intermediaries").

1. Definitions

1. "Participant" means an individual who (a) has contacted us through any means to find out more about the StayCool programme; (b) has entered, or may enter, into a participation agreement with us for the StayCool programme; or (c) has been referred to us by any community partner organisation, including but not limited to Voluntary Welfare Organisation ("VWO"), Active Ageing Centre ("AAC"), the Agency for Integrated Care ("AIC"), or a grassroots body.
2. "Personal data" means data, whether true or not, about an individual (whether a prospective participant, current participant, participant's authorised representative, caregiver, next-of-kin, or other household member) who can be identified: (a) from that data; or (b) from that data and other information to which we have, or are likely to have, access.
3. Other terms used in this Notice shall have the meanings given to them in the PDPA, where the context so permits.

2. Personal Data We Collect

The personal data we collect from you depends on the nature of your interaction with us. This may include:

Important: None of the StayCool devices, including the environmental sensors, the wearable, andany associated equipment, contains a camera or microphone.None of the equipment is capable of audio or video recording. The environmental sensors measure only temperature and humidity.

3. How We Collect Your Personal Data

We collect personal data about you in the following ways:

1. Directly from you (or your authorised representative) when you sign up for or participate in the StayCool programme, complete surveys, attend a training/onboarding session, or interact with the StayCool app;
2. Passively, through the environmental sensors and physiological wearable devices installed or issued to your household as part of the programme;
3. From community partner organisations, including but not limited to VWOs, AACs, grassroots organisations, or AIC, where you have been referred to us through those channels;
4. From trained StayCool volunteers who visit or contact your household and record observations strictly in connection with programme activities (e.g. confirming a device is working, noting a welfare concern to be followed up by our team); and
5. From our technology partners who develop and operate the sensors, wearables, and StayCool app on our behalf (see Section 6 below).

4. How We Use Your Personal Data

We may collect, use and disclose your personal data for the following purposes:

Programme Delivery

1. To assess your eligibility,onboard your household, and set up devices under the StayCool programme;
2. To deliver personalised heat-health alerts and cooling advice through the StayCool app and AI engine;
3. To schedule and coordinate volunteer visits and physical support activities;
4. To follow up on where programme devices have not been activated, or whereconcerns are flagged; and
5. To organise and/or arrange volunteers for your household based on availability, language, and need.

Research and Evaluation

1. To measure indoor thermal comfort and physiological heat strain at the household level;
2. To assess the effectiveness of cooling advice and physical interventions over the programme period;
3. To produce findings that contribute to Singapore's climate-health evidence base; and
4. To publish aggregated and anonymised findings in a publicly accessible report upon programme completion. No individually identifiable data will be published.

Programme Operations and Compliance

1. To manage participant communications and programme scheduling;
2. To enable our technology partners to develop, operate, maintain, and improve the sensors, wearables, app, and AI engine used to deliver the programme;
3. To meet our grant reporting obligations to the SG Eco Fund (Grant Reference: 2506OR048) under the Ministry of Sustainability and the Environment ("MSE");
4. To maintain records required by applicable law or regulation; and
5. To handle feedback, complaints, or enquiries relating to the programme.

The purposes listed above may continue to apply even after your participation in the StayCool programme has ended, to the extent reasonably necessary to fulfil those purposes or as required by law.

5. Our Basis for Collecting, Using, and Disclosing Your Personal Data

1. Before we collect, use, or disclose your personal data, we will notify you of the purpose for doing so and obtain your consent (or that of your authorised representative), except where the PDPA permits us to do so without consent.
2. You (or your authorised representative) may be taken to have given deemed consent where you voluntarily provide personal data to us for an obvious purpose (for example, providing your contact number so that a volunteer can reach you).
3. Where you have been referred to us by a community partner organisation, we will still independently notify you of our purposes and obtain your consent at the point of sign-up, before collecting or using your personal data for StayCool's purposes.
4. We may, in limited circumstances permitted under the PDPA, collect, use or disclose personal data without consent, for example, where necessary to respond to an emergency threatening your life, health or safety; where necessary in the national interest or for an investigation; or where we rely on the research or business improvement exceptions to analyse anonymised programme data for the purposes described in Section 4 above.
5. If you choose not to provide certain personal data, we may not be able to enrol or continue supporting your household in the programme. We will explain the likely consequences to you before processing any such decision.

6. Disclosure of Your Personal Data to Third Parties

We will not sell, rent, or trade your personal data to any third party. We may disclose your personal data only to the following categories of recipients, strictly for the purposes set out in this Notice:

Sharing data about other people: If you give us personal data about a third party, such asyour next-of-kin, caregiver, or another household member, you confirm that you have informed that individual and obtained their consent for us to collect, use, and disclose their personal data for the purposes described in this Notice.

7. Overseas Transfer of Personal Data

1. In the course of delivering StayCool, your personal data (in anonymised or pseudonymised form, where stated) may be transferred to, or processed in, the following overseas locations: Indonesia (by our software partner, PT Nusa Aksara Teknologi, for cloud hosting, AI processing and app operation) and India (by SL2's scientific research team, for data analysis and research).
2. Before making such transfers, we take steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection for your personal data that is comparable to the protection under the PDPA. This is achieved through written contracts, data transfer agreements, and restrictions on the recipient's further use, disclosure or re-identification of the data.
3. We do not transfer your personal data to any other overseas location without either your consent or appropriate safeguards consistent with the PDPA's Transfer Limitation Obligation.

8. Photographs, Video and Other Recordings

1. Where we take photographs or video recordings of you in your home, or of you individually (such as during onboarding or device installation), , we will do so only with your prior consent and for the stated purpose (for example, internal reporting or publicity for StayCool).
2. At public outreach events (such as market booths, grassroots talks, or community sessions) where group or general photographs may be taken, you may ask not to be photographed or have your image removed.
3. You may withdraw your consent for the future use, retention or publication of such photographs or recordings at any time, by contacting us using the details in Section 16. We will cease further use or disclosure following your withdrawal, save where we are required or authorised to retain or use the material under the PDPA or other written law (for example, where it has already been made publicly available). We are not able to recall copies that have already been lawfully distributed prior to your withdrawal.
4. No closed-circuit television, audio recording device, camera or microphone is installed in your home as part of the StayCool programme.

9. Anonymisation and Use of Data for Research

1. During the active monitoring period, your household's environmental sensor and wearable data is identifiable at the household level, as this is necessary to generate personalised alerts and cooling advice for you.
2. Before this data is used for research, evaluation or publication, we anonymise it in line with the PDPC's published guidance on anonymisation, including the removal of direct and indirect identifiers, aggregation across households, and periodic review of re-identification risk.
3. Findings arising from the programme will be published only in a form that does not identify any individual participant or household.

10. Protection of Your Personal Data

1. We have implemented appropriate administrative, technical and physical measures to protect your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. These measures are implemented in accordance with PDPC guidelines and include:
1. Data minimisation: Only personal data that is necessary for programme participation and research outcomes is collected from participants;
2. Device and household privacy: No cameras or microphones are deployed in any participating household at any time. Data collected by sensors and wearables are transmitted to our secure cloud system via an encrypted connection, independent of your home Wi-Fi;
3. Access controls: Access to personal data is restricted to authorised SL2 personnel and trained volunteers on a need-to-know basis, supported by strong password practices and need-to-basis data disclosure;
4. Authentication: One-Time Passwords (OTP), Two-Factor Authentication (2FA), or Multi-Factor Authentication (MFA) are used to secure access to systems handling personal data;
5. Encryption: Data is encrypted in transit and at rest to ensure end-to-end protection of all transmitted information;
6. System security: Up-to-date antivirus protection and regular patching of operating systems and software are maintained to guard against vulnerabilities;
7. Security reviews: Regular security reviews and testing are performed to proactively identify and address potential risks; and
8. Volunteer obligations: Volunteers are trained on data confidentiality obligations before being assigned to any household.
2. Where we disclose your personal data to a data intermediary (such as ADI-Designs Pte Ltd or PT Nusa Aksara Teknologi), we require them, by written contract, to implement security measures that provide a comparable standard of protection.
3. No method of transmission over the internet, or method of electronic storage, is completely secure. While we cannot guarantee absolute security, we take reasonable steps to protect your personal data and regularly review our security measures.
4. Data breach notification: In the event of a data breach that is notifiable under the Personal Data Protection (Notification of Data Breaches) Regulations 2021, we will notify the PDPC no later than three (3) calendar days after determining that the breach is notifiable, and will notify you without undue delay where the breach is likely to result in significant harm to you.

11. Accuracy of Personal Data

1. We will take reasonable steps to ensure that your personal data collected by us is accurate, complete and up-to-date.
2. Please notify us promptly of any changes to your personal data by contacting us using the details set out in Section 16 below.

12. Retention of Personal Data

1. We will cease to retain your personal data, or remove the means by which it can be associated with you, as soon as it is reasonable to conclude that the purpose for which it was collected is no longer being served by retention, and retention is no longer necessary for legal or business purposes.
2. As a general guide:
1. Participant contact and identity data will be retained for the duration of the StayCool programme (ending 1 April 2028) and deleted within 12 months of programme completion, unless retention is required for legal or regulatory purposes;
2. Sensor, wearable, and survey data will be retained for the programme duration and for a reasonable period thereafter, as required for grant audit, reporting, or dispute resolution purposes; and
3. Anonymised or aggregated research data may be retained indefinitely for public-good research and programme improvement purposes.

13. Your Rights

1. You (or your authorised representative) may, at any time, request:
1. Access the personal data about you that is in our possession or under our control;
2. Correct any personal data about you that is inaccurate, incomplete, misleading or not up to date; or
3. Withdraw your consent to our collection, use or disclosure of your personal data.
2. To exercise these rights, please submit a request to our Data Protection Officer using the contact details in Section 16. We will respond within ten (10) business days of receiving your request. If we require more time, we will inform you of the time frame required in order for us to respond with a substantive update. We may charge a reasonable fee for processing an access request, and will inform you of the fee before proceeding.
3. If you withdraw your consent, depending on the nature of your withdrawal, we may not be in a position to continue supporting your household's participation in StayCool (for example, where withdrawal requires us to recover installed devices). We will explain the likely consequences to you before processing your request.
4. Your withdrawal of consent does not affect our right to continue to collect, use or disclose personal data where this is permitted or required under the PDPA or other applicable law, and does not affect the lawfulness of anything we did with your data before your withdrawal took effect.

14. Minors and Other Household Members

StayCool household participants include, but are not limited to, seniors aged 60 and above, a person with a chronic condition, or an expectant mother. Where information about a minor (an individual below 18 years of age) in your household is incidentally collected, for example, as part of household composition, or because the minor is present during a volunteer visit or photograph, we will only collect, use or disclose that minor's personal data with the consent of the minor's parent or legal guardian, save where an exception under the PDPA applies.

15. Important Notes

1. Not a medical device. The StayCool sensor and wearable are not medical devices. They are designed to detect environmental and physiological heat risk and to prompt simple protective action.They are not a substitute for medical advice, diagnosis or treatment, and any guidance in the app is general in nature. Please consult your doctor about any medical condition, and continue to follow any advice your doctor has already given you, including on fluid intake, medication, or activity. .
2. Voluntary with no cost involved. Participation in StayCool is entirely voluntary and free of charge. There is nothing to buy, no sales involved, and no obligation to continue if you change your mind. Choosing not to take part, or stopping later, will not affect any other service or support you receive from us or from our community partners.
3. Visits to your home. Any visit to your home will only take place with your prior consent. You may ask to see the identification of any StayCool team member or volunteer before allowing them entry, and you may ask them to stop or leave at any time.
4. No recording in your home. No camera, microphone, or other recording device is placed in your home under the StayCool programme. The sensors measure only temperature and humidity. (See Sections 2 and 8.)
5. You stay in control of your data. You can ask to see the personal data we hold about you, ask us to correct it, or withdraw your consent at any time, by contacting our Data Protection Officer (Section 16). We will explain what withdrawing means for your participation before we act on it. (See Section 13.)

16. Data Protection Officer / Contact Us

SL2 has appointed a Data Protection Officer (“DPO”) to oversee management of personal data in accordance with the PDPA. If youhave any questions about this Notice, or how SL2 manages, protects and/or processes your personal data, please contact our DPO at dpo@sustainablelivinglab.org

17. Updates to This Notice

We may update this Notice from time to time to ensure it remains consistent with our practices and with any changes to applicable law. Where a change is material, we will notify you through the StayCool app or by direct communication before the change takes effect. The date of the most recent update is indicated at the top of this Notice.