Sustainable development
Livzon Pharmaceutical Group Inc. Information Security and Privacy Policy.pdf
The Company strictly adheres to the Responsible Artificial Intelligence Policy and implements specialized controls over high-risk AI systems that may affect personal health, safety, or fundamental rights. In 2025, the Group established a high-risk AI capability inventory and an authorization control matrix, explicitly including clinical auxiliary diagnosis, treatment recommendations, key decisions in pharmaceutical quality control, detection of adverse drug reactions, determination of clinical trial inclusion and exclusion criteria, and facial recognition (except for legitimate purposes such as security protection) within the scope of the inventory. Prior to system deployment, risk assessment and review must be completed. Only authorized designated personnel are permitted to invoke the relevant capabilities, and the use scenarios (such as limited to internal compliance testing and specific necessary business scenarios) as well as operational boundaries are strictly defined.
In 2025, in scenarios involving critical information data or key business processes, we require that all AI-generated text, images, and other content must be marked with the “AI-generated” attribute through explicit watermarks or metadata embedding. For non-critical scenarios or general auxiliary content, business units implement this flexibly according to the actual level of risk. At the decision-making level, important business decision results automatically output by AI (such as R&D priorities and risk assessment levels) are accompanied by unique identification codes and “AI-assisted decision” statements to ensure traceability. All internal AI applications retain complete audit logs to support regulatory inspections and post-event tracing, and the identification rules are incorporated into daily quality inspection items.
The Company follows the Responsible Artificial Intelligence Policy and has established a model performance monitoring and error-correction mechanism covering the full lifecycle. In 2025, we implemented continuous monitoring of AI models in the production environment. Core dimensions include model performance degradation, data/concept drift, bias drift, abnormal output rate, and abnormal resource consumption. Once monitoring indicators trigger preset early-warning thresholds, the operations and maintenance responsible person must initiate diagnosis within the specified time limit and take targeted corrective measures based on the causes, such as retraining with new datasets or adjusting model operating parameters.
The Company actively reduces the energy consumption and carbon footprint of AI computing power. In 2025, we prioritized the adoption of lightweight model architectures (such as model pruning, distillation, and sparse computing) to reduce the computational volume during training and inference stages. At the computing power layer, we improved GPU utilization through elastic scheduling and resource-sharing mechanisms, and cooperated with data center suppliers to preferentially select nodes that have passed green data center certification and have lower PUE. At the same time, training tasks are preferentially scheduled during periods with a high proportion of green electricity. We have included AI energy consumption and carbon footprint in the annual ESG data collection scope and established an AI carbon emission accounting method.
The Company has opened an objection and appeal channel applicable to situations such as infringement arising from AI involvement in the processing of personal health information, pharmaceutical quality disputes, or disputes over adverse event determinations. Appellants may file appeals through the Company’s official website, reporting hotlines (0756-8135299, 0756-8135948), or written correspondence. Internal investigation and assessment are completed within 30 calendar days, and the handling conclusions are provided in writing within 10 working days. If it is verified that the AI decision is indeed erroneous, remedial measures such as correcting the decision, restoring rights and interests, improving the system, or adjusting processes are taken. In 2025, we did not receive any relevant appeal cases.
In 2025, we established an evaluation framework covering key indicators such as “resource savings,” “operational efficiency improvement rate,” and “carbon emission avoidance.” We conducted trial calculations on multiple pilot AI projects (such as AI-assisted target screening and intelligent energy consumption management) to measure the energy conservation, emission reduction, and efficiency improvement data resulting from reductions in experimental resource consumption and optimization of equipment operating duration.
In 2025, we formulated annual training plans for all employees and technical position personnel respectively. The training content covers compliance requirements, system security, ethical guidelines (including bias identification, fairness, and transparency), and responsible AI application practices. The technical team additionally receives specialized in-depth training on AI ethics and security, focusing on enhancing the ability to identify bias and AI hallucinations, and learning the requirements for human intervention in high-risk scenarios. In addition, the Group expands learning channels through various methods such as establishing AI clubs, organizing AI hackathon competitions, and jointly holding special AI and Agent work seminars with external AI experts, and regularly conducts training effectiveness evaluations, continuously optimizing content design based on the evaluation results.
In addition, regarding information security management, during the reporting period, the company continuously maintained and enhanced its information security level through its business continuity plan, combined with proactive monitoring and passive protection measures, striving to minimize the likelihood of information security incidents.
In 2025, the company will regularly conduct proactive vulnerability analyses on business systems, promptly initiate active defense strategies for high-risk incidents, and engage third-party professional organizations to conduct vulnerability detection and follow-up risk assessment. To ensure the stable operation of information systems and controllable data security, the company has entrusted independent third-party organizations to audit the Group's IT infrastructure and information security management system in accordance with ISO 27001 standards, and actively implement corrective and improvement measures based on the audit results, continuously enhancing the ability to prevent information and data security risks. In 2025, the company strictly adhered to information security standards, with zero incidents of customer privacy breaches or data security events.