Our services involve the exchange, storage and analysis of highly confidential information, including detailed personal and financial information and medical data regarding our clients, through a variety of electronic and non-electronic means, and our reputation and business operations are highly dependent on our ability to safeguard the confidential personal data and information of our clients. We rely on a network of process and software controls to protect the confidentiality of data provided to us or stored on our systems. We face various security threats on a regular basis, including cyber-security threats to and attacks on our technology systems that are intended to gain access to our confidential information, destroy data or disable our systems.
Our medical examination centers, clinics and internet hospitals collect and maintain medical data and treatment records of our clients. PRC laws and regulations generally require medical institutions and their medical personnel to protect the privacy of their customers and prohibit unauthorized disclosure of personal information. Such medical institutions and their medical personnel will be liable for damage caused by divulging the customers' private or medical records without consent. We have taken measures to maintain the confidentiality of our customers' medical records, including encrypting such information in our information technology system so that it cannot be viewed without proper authorization and setting internal rules requiring our employees to maintain the confidentiality of our customers' medical records. However, these measures may not always be effective in protecting our customers' medical records. Our information technology systems could be breached through hacking. Personal information could be leaked due to any theft or misuse of personal information due to misconduct or negligence. In addition, although we do not make the customers' medical records available to the public, we use such data on an aggregated basis after redacting personally identifiable information for marketing purposes.
Regulatory authorities in China have implemented, and are considering, a number of legislative and regulatory proposals concerning data protection. For example, the Cyber Security Law of PRC, or the Cyber Security Law, which became effective in June 2017, created China's first national-level data protection for "network operators" which may include all network service providers in China. The PRC Civil Code, which became effective on January 1, 2021, also stipulates that the personal information of a natural person shall be protected by the law.
The PRC Data Security Law, which was promulgated by the Standing Committee of the National People's Congress ("SCNPC") on June 10, 2021 and took effect on September 1, 2021, requires data collection to be conducted in a legitimate and proper manner, and stipulates that, for the purpose of data protection, data processing activities must be conducted based on data classification and hierarchical protection system for data security. Furthermore, the recently issued Opinions on Strictly Cracking Down Illegal Securities Activities in Accordance with the Law require (i) speeding up the revision of the provisions on strengthening the confidentiality and archives management relating to overseas issuance and listing of securities and solidifying the primary responsibility for information security of overseas listed companies, and (ii) improving the laws and regulations relating to data security, cross-border data flow, and management of confidential information.
In addition, the PRC State Administration for Market Regulation ("SAMR") and the PRC Standardization Administration jointly issued the Standard of Information Security Technology - Personal Information Security Specification (2020 edition), which took effect on October 2020. Pursuant to this standard, any person or entity who has the authority or right to determine the purposes for and methods of using or processing personal information is considered a personal information controller. Such personal information controller is required to collect information in accordance with applicable laws, and except in certain specific events that are expressly exempted in the standard, prior to collecting such data, the information provider's consent is required. On April 19, 2021, the PRC Standardization Administration issued the Information Security Technology - Personal Information Security Measurement and Evaluation Specification in Mobile Internet Applications (Revised Draft for Comments), or the Measures for Mobile Internet Applications, to collect public comments. The deadline for collecting comments is June 18, 2021. Based on the Information Security Technology - Personal Information Security Specification (2020 edition), the Measures for Mobile Internet Applications put forward the personal information security requirements, stipulate the implementation process and evaluation method of App personal information security assessment. To provide reference for identifying App's illegal collection and use of personal information, the Cyberspace Administration of China (CAC), the PRC Ministry of Industry and Information Technology (MIIT), the SAMR and the PRC Ministry of Public Security (MPS), collectively released the Notice on Promulgation of the Method for Identifying the Illegal Collection and Use of Personal Information by Apps, on November 28, 2019, which took effect on the same day. On March 12, 2021, the MIIT, the SAMR and the MPS released the Notice on Promulgation of the Rules on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications, effected on May 1, 2021, which stipulates that operators of mobile Internet applications (APPS) shall not deny users access to basic App functions because users do not agree to collect unnecessary personal information. According to Notice on Promulgation of the Rules on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications, for the investment and wealth management APPs, the basic functional services include, among others, investment and wealth management services relating to shares, futures, funds, bonds.
We are in the process of applying for certificates of cybersecurity with respect to our operating subsidiaries. The compliance with the regulations could be expensive, and the reduction in our ability to collect, transfer and use data due to tightened regulations could also have an adverse effect on our business.
Furthermore, the CAC issued the Provisions on the Cyber Protection of Children's Personal Information, which took effect on October 1, 2019. According to these provisions, no person or entity is allowed to produce, release, or disseminate information that infringes upon the personal information security of children aged below 14. Network operators collecting, storing, using, transferring, or disclosing children's personal information are required to enact special protections for such information.
The Announcement of Launching Special Crackdown Against Illegal Collection and Use of Personal Information by Mobile Apps was issued with effect on January 23, 2019 and commenced coordinated efforts among the CAC, the MIIT, the MPS, and the SAMR to combat the illegal collection and use of personal information by mobile apps throughout China. On October 31, 2019, the MIIT issued the Notice on the Special Rectification of Mobile Apps Infringing Users' Rights and Interests, pursuant to which application providers were required to promptly rectify issues that the MIIT designated as infringing application users' rights such as collecting personal information in violation of PRC regulations and setting obstacles for user account deactivation. In July 2020, the MIIT issued the Notice on Conducting Special Rectification Actions in Depth Against the Infringement upon Users' Rights and Interests by Applications, to rectify the following issues: (i) illegal collection and use of personal information of users by an application and a software development kit, (ii) setting up obstacles and frequently harassing users, (iii) cheating and misleading users, and (iv) inadequate implementation of application distribution platforms' responsibilities.
If we do not take adequate measures to prevent security breaches and maintain adequate internal controls or fail to implement new or improved controls, data, including personal information, could be misappropriated or confidentiality could otherwise be breached. We could be subject to liability if we inappropriately disclose any client's personal information, or if third parties are able to penetrate our network security or otherwise gain access to any client's name, address, portfolio holdings, or other personal information. Any such failure could subject us to claims for identity theft or other similar fraud claims or claims for other misuses of personal information, such as unauthorized marketing or unauthorized access to personal information. In addition, such events would cause our clients to lose their trust and confidence in us, which may result in a material adverse effect on our business, results of operations and financial condition. At the same time, compliance with the regulations could be expensive, and the reduction in our ability to collect, transfer and use data due to increased regulation could also have an adverse effect on our business. In addition, although we believe our current usage of clients' medical records is in compliance with applicable laws and regulations governing the use of such information, any change in such laws and regulations could affect our ability to use medical data and subject us to liability for the use of such data. Failure to protect clients' medical records, or any restriction on or liability as a result of, our use of medical data, could have a material adverse effect on our business.