Umbrella+

Privacy Policy

Last updated: May 2026 (v2.1)

1. Introduction

Umbrella+ ("we", "our", or "the Platform") is committed to safeguarding the personal data entrusted to us. This Privacy Policy sets out the basis on which we collect, use, disclose, store and otherwise process your personal data in accordance with the Personal Data Protection Act 2012 (Singapore) ("PDPA"), including amendments in force from 1 February 2021. By accessing or using our services, you acknowledge and agree to the terms of this Privacy Policy.

2. Personal Data We Collect

We may collect personal data that you voluntarily provide or that arises from your use of the Platform, including but not limited to:

  • Account and identity verification details, including ID type and last four characters of your identification number;
  • Profile information, including date of birth, address, and postal code;
  • Contact details, including email address and mobile number;
  • Authentication data generated in connection with identity verification processes, including one-time passwords transmitted via email or SMS;
  • Insurance-related documents and policy information, including documents you upload and information extracted or derived from those documents through automated processing;
  • Connection relationship data, including the existence and nature of your authorised connections with advisers or family members on the Platform;
  • Adviser professional information, including MAS licence number, professional affiliation, and display credentials, where applicable;
  • Platform usage data, including device identifiers, access logs, session information, and technical diagnostics.

3. Purpose of Collection, Use and Disclosure

We collect, use, and/or disclose your personal data for the following purposes:

  • To verify your identity and maintain your account;
  • To store, organise and manage your insurance documents and policy records;
  • To parse, extract and structure information from your uploaded documents using automated tools and AI-assisted processing, for the purpose of creating and maintaining your insurance record on the Platform;
  • To facilitate authorised connections with advisers, family members, or other parties you expressly approve;
  • To provide notifications, reminders, and administrative communications related to your account and policies;
  • To maintain audit records of access events, including document access by connected parties, for security and accountability purposes;
  • To enhance the safety, security, and performance of the Platform;
  • To comply with applicable laws and regulatory requests;
  • To contact you for service-related matters, including clarification or verification of information contained in your uploaded documents or extracted through automated tools;
  • For any other purpose for which you have provided your consent.

4. Disclosure of Personal Data

We may disclose your personal data to:

  • Third-party technology providers engaged to support the Platform's operations, including cloud infrastructure, AI-assisted document processing, file storage, and communication service providers. We conduct due diligence on such providers and take reasonable steps to ensure they are bound by appropriate data protection obligations consistent with the PDPA. Where data is processed by AI systems, this is performed within the scope of the purposes described in Section 3 above;
  • Parties expressly authorised by you, such as advisers or family members, strictly within the scope of the permissions you have granted;
  • Governmental, regulatory, or law enforcement authorities where required under applicable law.

We do not sell or rent your personal data to third parties.

5. Cross-Border Data Transfers

Some of the third-party technology providers we engage may process or store data on servers located outside Singapore. Where personal data is transferred outside Singapore, we take reasonable steps to ensure that the recipient provides a standard of protection comparable to that under the PDPA, including through contractual arrangements or other recognised safeguards, in accordance with Section 26 of the PDPA.

6. Protection of Personal Data

We adopt reasonable administrative, technical, and physical safeguards to protect personal data in our possession or control against unauthorised access, collection, use, disclosure, or similar risks. These measures include access controls, encryption in transit, session-scoped data handling, and audit logging of document access events. Notwithstanding the foregoing, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, or as required under applicable laws and regulations. Insurance-related documents are retained for a minimum period consistent with applicable insurance and record-keeping regulations, or such longer period as required by law. Upon request for deletion of your account, we will take reasonable steps to securely delete or anonymise your personal data, unless retention is required or permitted by law.

8. Your Rights

Subject to the PDPA, you have the right to:

  • Request access to your personal data held by us;
  • Request correction of any inaccurate or incomplete personal data;
  • Withdraw consent to the collection, use, or disclosure of your personal data at any time, subject to legal or contractual restrictions. Withdrawal of consent may affect your ability to use certain features of the Platform;
  • Be notified in the event of a data breach that is likely to result in significant harm to you, in accordance with our obligations under the PDPA.

Requests to exercise these rights may be subject to verification requirements. Please direct requests to the contact address in Section 13 below.

9. Data Breach Notification

In the event of a data breach that is notifiable under the PDPA, we will notify the Personal Data Protection Commission ("PDPC") within the timeframe required by law, and will notify affected individuals where the breach is likely to result in significant harm. We will take reasonable steps to contain the breach and mitigate any harm arising from it.

10. Minors

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected personal data from a minor, please contact us so we can take appropriate steps.

11. Third-Party Sites

Our Platform may contain links to external websites. We do not control and are not responsible for the privacy practices of such third-party sites. We encourage you to review the privacy policies of any external sites you visit.

12. Changes to This Privacy Policy

We may amend this Privacy Policy from time to time. Material changes will be notified through appropriate channels, including in-platform notifications or email. Continued use of the Platform following notification of changes constitutes your acknowledgement of the updated policy.

13. Contact

For enquiries or requests regarding this Privacy Policy, including requests to access, correct, or withdraw consent in relation to your personal data, please contact us at: contact@umbrellaplus.co