Quality HealthCare Group Privacy Policy relating to the Personal Data (Privacy) Ordinance (Cap. 486) (the “Ordinance”)

1. Introduction

1.1 Quality HealthCare Group (“QHC”, “Company”, “we” or “us”) is committed to protecting the privacy and security of your personal information. This Privacy Policy is provided to you in connection with your dealings and provision of data or information to QHC entities and brands including, without limitation, Quality HealthCare Group Limited, Quality HealthCare Medical Centre Limited, Quality HealthCare Medical Services Limited, Quality HealthCare Dental Services Limited, Quality HealthCare Diagnostic & Imaging Services Limited, Central Medical Diagnostic Centre Limited, Alpha Medical MRI (TST) Limited, Quality HealthCare Professional Services Limited, Quality HealthCare Chinese Medicine Services Limited, Eplushealth Limited and Quality HealthCare Nursing Agency Limited (QHNA). Unless advised otherwise, all references to QHC, “Company”, “we” or “us” in this Privacy Policy includes, individually or collectively, QHC entities and brands located in Hong Kong that process personal data as data users. This Privacy Policy also applies to Bupa branded medical and dental centres, namely “Bupa Medical Centre” and “Bupa Dental Centre” which are operated by, and under the same common ownership group of, QHC. The rights and obligations of each Company under this Privacy Policy are several and not joint. No Company shall be liable for any act or omission by another Company.

1.2 This Privacy Policy is prepared in accordance with the Ordinance and the Electronic Health Record Sharing System Ordinance (Cap. 625). This Privacy Policy also operates as the Personal Information Collection Statement which we will provide, or make available, to you on or before the collection of your personal information by the Company.

1.3 For the purposes of this Privacy Policy, “Group Company” means Company and its holding companies, branches, subsidiaries, representative offices and affiliates, wherever situated, and any one of them. Affiliates include branches, subsidiaries, representative offices and affiliates of the Company’s holding companies, wherever situated (collectively, the “Group”).

1.4 If you have any queries regarding our Privacy Policy, please contact our Customer Service Manager at (852) 8301 8301 or info@qhms.com.

1.5 Failure to supply personal information requested by the Company may result in the Company being unable to process your application, request for information or services, enquiries and/or provide services or products to you if the processing of such personal information is necessary for such purpose(s).

1.6 Separate privacy notices apply for recruitment or employment purposes.

1.7 This Privacy Policy is intended to ensure that you can make informed decisions about providing your personal information to QHC in accordance with this Privacy Policy. Please be aware that this Privacy Policy replaces any notice or statement of similar nature that may have been provided to you previously. When you click on “I Agree” or select any options with similar content, or log in, confirm, agree to, use or accept this Privacy Policy we provide via registration procedure or any other way, you consent to your personal information being collected, stored, used, processed, transferred, disclosed or shared in accordance with this Privacy Policy.

1.8 If you provide us with the personal information about other individuals, you must tell those individuals that you have provided us with their details and let them know where they can find a copy of this Privacy Policy.

2. Personal Information We Collect

2.1 The Company may collect your personal information for the purposes as set out in this Privacy Policy.

2.2 The personal information we collect and/or hold from time to time may include your personal identification information, contact information, transaction records, financial background, medical and health records, biometric data and your location and activities when you access or browse our website(s) or use our mobile application(s) or portal(s) (including any diagnostic or health-monitoring tools thereon and the Bluetooth and/or wearable device that are used to collect data for the purposes of such tools) .

2.3 We will always try to collect your personal information from you through the course of your relationship with us and in a range of ways. However, there may be instances where we will need to collect your personal information from third parties or sources in certain circumstances, such as a family member or someone else acting on your behalf, your employers, medical personnel, business/asset acquisition transactions of QHC, business partners, or public databases.

2.4 If you are under the age of 18, you should obtain consent from your parent or guardian before you provide the Company with your personal information.

2.5 Storage of personal information may be in various forms including, physical (paper) form, digital customer systems or applications, electronic medical record systems, data management software or systems in the usual course of business practices, clinical images taken for diagnostic or treatment purposes on some diagnostic equipment where you have undergone a diagnostic procedure using such equipment at facilities operated by the Company, depending on your engagement with the Company.

3. Purposes of Collection

3.1 Your personal information collected may be used, stored, processed, transferred, disclosed or shared by the Company for the following purposes from time to time:

(a) processing, accessing and determining any applications or requests, enquiries or complaints for or in relation to the services or products provided by us;

(b) registering you as a user or a member of services or information provided or to be provided by us on the website(s), mobile application(s) or portal(s) managed and/or operated by us;

(d) coordinating your care within QHC entities to achieve better patient outcomes;

(e) providing you with personalised medical information, health information and information about our services or products, and personalised website, mobile application or portal interface;

(f) providing you with appropriate medical, health, insurance administration, wellness or other related services (including, without limitation, e-ticketing, appointment booking and clinic / medical professional search and service and product redemption functions on the website(s), mobile application(s) or portal(s)) managed and/or operated by us) or products;

(g) communicating with you regarding the administration, features and renewal of the medical, dental or health services plans that you subscribe to;

(h) operating, maintaining, evaluating, improving, troubleshooting problems, and understanding your preference(s) with our website(s), mobile application(s) or portal(s);

(i) providing telemedicine and related healthcare services electronically to you;

(j) processing billing and payments or collecting outstanding amounts due from you;

(k) performing any functions and activities related to the services or products provided by the Company including, without limitation, audit, reporting, marketing research, general servicing, maintenance of online and other services, identity verification, data matching, research, data analytics and statistical analysis;

(l) exercising the Company’s rights in connection with the provision of medical, health, insurance, wellness or other related services or products to you;

(m) managing our relationship with you, our business and organisations who work with us in relation to providing our products or services to you (including, with limitation, futures changes to this Privacy Policy);

(n) with your consent, marketing services, products and other subjects by us, any member of the Group Companies and/or other third parties (please see further details in paragraph 5 below);

(o) making disclosure to satisfy the requirements of any laws, rules and regulations, codes of practice, guidance notes or guidelines binding on the Company;

(p) communication with you in relation to any of the purposes set out in this Privacy Policy; and

(q) fulfilling any other purposes directly related to (a) to (p) above.

4. Transfer of Personal Information

4.1 Personal information collected or held by the Company relating to you will be kept confidential, but the Company may transfer such personal information inside or outside the Hong Kong Special Administrative Region of the People’s Republic of China, for the purposes specified in paragraph 3 above to the following classes of transferees:

(a) any member and/or brand of the Group Companies who provides medical, health, insurance, wellness or other related services or products;

(b) any third parties engaged in connection with a member of the Group Company’s business who provides medical, health, insurance, wellness or other related services or products;

(c) any agent, contractor or other third party service providers who provides administrative, telecommunications, computer, payment, data processing, storage of analytics, cloud, printing, research, telemedicine, distribution or other services to the Company in connection with the operation of the business (including, without limitation, insurers, banks, lawyers and accountants);

(d) your employer, if your employer is paying for the services or products we are providing;

(e) any member of the Group Companies (such as Bupa (Asia) Limited, our affiliate) or third parties involved in the marketing of services, products and other subjects (please see further details in paragraph 5 below);

(f) any persons, bodies corporate or organisations who are clients of QHNA and indicated interest to engage you as an independent contractor to provide them with nursing care, care assistance or related services (for applicants and/or registered independent contractors to QHNA’s panel only);

(g) third party reward, loyalty, co-branding and privileges programme providers and co-branding partners of a member of the Group Companies;

(h) financial institutions engaged by the Company or you for billing and payment purposes;

(i) any actual or proposed assignee, transferee, participant or sub-participant of all or a substantial part of our rights or business; and

(j) any person to whom the Company is under an obligation to make disclosure under the requirements of any law, rules, regulations, codes of practice or guidelines binding on us including, without limitation, any applicable regulators, governmental bodies, industry recognised bodies, the Courts, and where otherwise required by law.

4.2 We will only disclose personal information limited to that which is necessary to the above parties for the relevant purposes, who may process (including, without limitation, by recording, organising, structuring, storing, adapting, altering, retrieving, using, aligning, combining or erasing) your personal information for the relevant purposes set out in paragraph 3 above.

4.3 In the event that we complete the acquisition of a new healthcare company or brand, we shall communicate with you through the communication channels you provided to us, and any personal information shall be treated in accordance with this Privacy Policy if it is practicable and permissible to do so.

5. Use of Personal Information in Direct Marketing

5.1 Only with your consent (which includes an indication of no objection), the Company, any member of the Group Companies and/or the third parties stated under paragraphs 3.1(n) and 5.2(b) to (e) may use your personal information (including your name, contact details, products and services portfolio, transaction pattern and behaviour) collected from time to time to provide you with marketing communications (including by email, SMS, mobile application, social media, instant messenger or other means that become available from time to time) relating to the following services or products:

(a) insurance, medical, dental, healthcare, wellness, personal development, beauty, lifestyle, entertainment, financial, and related services and products;

(b) rewards, benefits, discounts, member activities, loyalty or privileges programmes and related services and products;

(d) donations and contributions for charitable and/or non-profit making purposes.

5.2 The above services, products and subjects may be provided or (in the case of donations and contributions) solicited by the Company and/or:

(a) any member of the Group Companies;

(b) third party service providers;

(d) co-branding partners of a member of the Group Companies; and

(e) charitable or non-profit making organisations.

5.3 We will not use your personal information for direct marketing purposes unless we have received your consent. For the avoidance of doubt, the latest instruction (for example, consent or indication of no objection, or request for opt-out) received from you shall override any previous instruction given to the Company in this regard in relation to all of your personal information collected or held by the Company from time to time.

5.4 If you choose to personalise your services where such options are available, we will use personal information that we collect so that we can offer you those personalised services or communications. If you do not wish to accept those personalised services or communications, you can unsubscribe from those services at any time and we will cease to offer such services to you.

6. Use of Cookies

6.1 When you use our sites, we and third-party companies collect information by using cookies and other technologies such as pixel tags (for simplicity we refer to all such technologies as “cookies”). A cookie is a text file containing small amounts of information which a server may download to your computer, mobile or tablet when you visit a website or use an app. A pixel tag (sometimes called a web beacon) is an invisible image with a line of code which is placed within an email message or on a web page.

6.2 There are different types of cookies which are used to do different things. These include letting you navigate between different pages on a website efficiently, remembering preferences you have given and helping us to identify ways to improve your overall site experience. Others are used to provide you with advertising, which is more tailored to your interests, or to measure the number of site visits and the most popular pages. To find out more about cookies visit aboutcookies.org or allaboutcookies.org.

6.3 The information we obtain from our use of cookies will not usually contain your personal information. Although we may obtain information about your computer or accessing devices such as your domain, IP address, your browser type, operating system etc., this will not normally identify you personally. In certain circumstances, we may collect personal information about you - but only where you voluntarily provide it e.g. by completing an online inquiry form or where you purchase services from us.

6.4 Most web browsers automatically accept cookies, but you may refuse to accept cookies by modifying the browser settings on your computer. If you choose to decline cookies, you may be unable to use certain interactive features of our sites.

7. Other Websites

7.1 Our sites may provide links to other external websites over which we do not have control. You are advised to refer to the privacy policies of these websites for more information.

8. Security and Retention

8.1 The Company retains your personal information for as long as necessary for the purposes set out in this Privacy Policy, or otherwise agreed between you and us, unless otherwise required or permitted under applicable law.

8.2 Where the Company no longer requires your personal information for the purposes under this Privacy Policy, or otherwise required under law, we will take appropriate steps to securely delete or destroy your personal information.

8.3 We will take all practicable steps to protect your personal information against unauthorised or accidental access, processing, erasure, loss or use. This includes implementing a range of digital and physical security measures. In addition, we will restrict access to your personal information to those properly authorised to have access.

9. Data Access and Correction

9.1 You have the rights to:

(a) check whether the Company holds personal information relating to you and to access such personal information;

(b) require the Company to correct any personal information relating to you which is inaccurate;

(c) ascertain our policies and practices in relation to personal data and to be informed of the kind of personal data held by the Company;

(d) request the Company to cease using and/or processing your personal information; and

(e) change your preference in respect of our use of your personal information.

9.2 To exercise the above rights, please send your request in writing to:

By post:
Data Privacy Officer / Customer Service Manager
6/F, Tower 2
The Quayside, 77 Hoi Bun Road
Kwun Tong, Kowloon
Hong Kong

Or, by email:
info@qhms.com

9.3 We are entitled to charge a reasonable fee for processing your personal data access request.

10. Electronic Health Record Sharing System ("eHRSS")

10.1 Where applicable, our policies in relation to the eHRSS are only applicable to registered participants in that system. Please refer to our information statement in relation to eHRSS, which is available on our corporate webpage at www.qhms.com and/or https://www.qhms.com/en/others/is-ehrss, for further information.

11. Nothing in this Privacy Policy shall limit your rights under the Ordinance.

12. In case of discrepancies between the English and Chinese versions of this Privacy Policy, the English version shall prevail.

13. This Privacy Policy may be amended by the Company from time to time.

September 2024