隐私政策 Privacy Policy

1. Introduction 简介

韓醫館 HanYiGuan TCM ("we," "our," or "us") is committed to protecting your personal data in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA"). This Privacy Policy explains how we collect, use, disclose, and protect your personal data.

韓醫館（以下简称"我们"）致力于根据新加坡《2012年个人数据保护法》（"PDPA"）保护您的个人数据。本隐私政策说明我们如何收集、使用、披露和保护您的个人数据。

By providing your personal data to us, you consent to the collection, use, and disclosure of your personal data in accordance with this Privacy Policy.

向我们提供您的个人数据即表示您同意按照本隐私政策收集、使用和披露您的个人数据。

2. Data Protection Officer 数据保护官

We have appointed a Data Protection Officer (DPO) to oversee our compliance with the PDPA. For any inquiries, requests, or complaints regarding your personal data, please contact:

我们已任命数据保护官（DPO）负责监督我们遵守PDPA的情况。如有任何关于您个人数据的查询、请求或投诉，请联系：

3. Types of Personal Data Collected 收集的个人数据类型

We may collect the following types of personal data:

我们可能收集以下类型的个人数据：

3.1 Identity Data 身份数据

• Full name, NRIC/FIN/Passport number (for medical records) 全名、身份证/FIN/护照号码（用于医疗记录）
• Date of birth, gender, nationality 出生日期、性别、国籍

3.2 Contact Data 联系数据

• Residential address, email address 住址、电子邮件地址
• Phone number(s), including mobile number 电话号码，包括手机号码

3.3 Health Data 健康数据

• Medical history, current symptoms, and health conditions 病史、当前症状和健康状况
• Diagnosis, treatment records, and prescriptions 诊断、治疗记录和处方
• Allergies, current medications, and lifestyle information 过敏史、目前用药和生活方式信息

3.4 Technical Data 技术数据

• IP address, browser type, device information IP地址、浏览器类型、设备信息
• Website usage data and cookies 网站使用数据和Cookie

4. Purposes for Collection, Use, and Disclosure 收集、使用和披露的目的

We collect, use, and disclose your personal data for the following purposes:

我们为以下目的收集、使用和披露您的个人数据：

4.1 Healthcare Services 医疗服务

• To provide Traditional Chinese Medicine consultation and treatment 提供中医咨询和治疗
• To maintain your medical records as required by law 按法律要求维护您的医疗记录
• To process MediSave/insurance claims where applicable 处理保健储蓄/保险索赔（如适用）

4.2 Administrative Purposes 行政目的

• To schedule and manage appointments 安排和管理预约
• To send appointment reminders via SMS, WhatsApp, or email 通过短信、WhatsApp或电子邮件发送预约提醒
• To process payments and issue receipts 处理付款和开具收据

4.3 Communication 沟通

• To respond to your enquiries and feedback 回应您的查询和反馈
• To send health tips and wellness information (with your consent) 发送健康提示和养生信息（经您同意）

4.4 Legal and Regulatory Compliance 法律和监管合规

• To comply with TCM Practitioners Board requirements 遵守中医管理委员会的要求
• To comply with Ministry of Health regulations 遵守卫生部规定
• To respond to lawful requests from government authorities 响应政府机构的合法请求

5. Consent 同意

We will obtain your consent before collecting, using, or disclosing your personal data, unless permitted by law to do so without consent. Consent may be expressed or deemed.

在收集、使用或披露您的个人数据之前，我们会征得您的同意，除非法律允许我们在未经同意的情况下这样做。同意可以是明示的或推定的。

Deemed consent: By voluntarily providing your personal data for a stated purpose (e.g., booking an appointment), you are deemed to have consented to our collection, use, and disclosure of your data for that purpose.

推定同意：通过自愿为某一明确目的（如预约）提供您的个人数据，即视为您同意我们为该目的收集、使用和披露您的数据。

6. Withdrawal of Consent 撤回同意

You may withdraw your consent for us to collect, use, or disclose your personal data at any time by contacting our Data Protection Officer. Please note:

您可以随时联系我们的数据保护官，撤回您对我们收集、使用或披露您个人数据的同意。请注意：

• We will process your withdrawal request within 10 business days 我们将在10个工作日内处理您的撤回请求
• Withdrawal may affect our ability to provide services to you 撤回可能影响我们向您提供服务的能力
• Withdrawal does not affect the legality of data processing before withdrawal 撤回不影响撤回前数据处理的合法性
• We may retain data required by law (e.g., medical records) 我们可能保留法律要求的数据（如医疗记录）

7. Access and Correction 访问和更正

Under the PDPA, you have the right to:

根据PDPA，您有权：

• Access your personal data held by us and information about how it has been used or disclosed in the past year 访问我们持有的您的个人数据以及过去一年内如何使用或披露的信息
• Correct any error or omission in your personal data 更正您个人数据中的任何错误或遗漏

To make an access or correction request, please contact our Data Protection Officer in writing. We will respond within 30 days and may charge a reasonable fee for access requests.

如需提出访问或更正请求，请以书面形式联系我们的数据保护官。我们将在30天内回复，访问请求可能收取合理费用。

8. Disclosure to Third Parties 向第三方披露

We may disclose your personal data to the following third parties for the purposes stated:

我们可能为所述目的向以下第三方披露您的个人数据：

• Healthcare providers: For referrals or collaborative care 医疗服务提供者：用于转诊或协作护理
• Insurance companies: To process claims (with your consent) 保险公司：处理索赔（经您同意）
• Government authorities: As required by law (MOH, TCM Practitioners Board) 政府机构：按法律要求（卫生部、中医管理委员会）
• Service providers: IT services, payment processing (under strict confidentiality) 服务提供商：IT服务、付款处理（严格保密）

We do not sell your personal data to any third party.

我们不会将您的个人数据出售给任何第三方。

9. Data Retention 数据保留

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

我们仅在实现收集目的所需的时间内或法律要求的时间内保留您的个人数据：

• Medical records: Minimum 6 years from last visit (as per MOH guidelines) 医疗记录：自最后一次就诊起至少6年（根据卫生部指南）
• Financial records: 5 years (as per IRAS requirements) 财务记录：5年（根据税务局要求）
• Marketing data: Until consent is withdrawn 营销数据：直到同意被撤回

When personal data is no longer needed, we will securely dispose of or anonymize it.

当不再需要个人数据时，我们会安全地处理或匿名化。

10. Data Protection 数据保护

We implement appropriate technical and organizational measures to protect your personal data, including:

我们采取适当的技术和组织措施保护您的个人数据，包括：

• Secure storage of physical records in locked cabinets 将实体记录安全存放在上锁的柜子中
• Password-protected electronic systems with access controls 有访问控制的密码保护电子系统
• Encryption of sensitive data during transmission 传输过程中对敏感数据进行加密
• Staff training on data protection obligations 员工数据保护义务培训
• Regular security reviews and updates 定期安全审查和更新

11. Data Breach Notification 数据泄露通知

In the event of a data breach that is likely to result in significant harm to affected individuals, we will:

如果发生可能对受影响个人造成重大伤害的数据泄露，我们将：

• Notify the Personal Data Protection Commission (PDPC) within 3 calendar days of assessment 在评估后3个日历日内通知个人数据保护委员会（PDPC）
• Notify affected individuals as soon as practicable 尽快通知受影响的个人
• Take remedial actions to address the breach 采取补救措施解决泄露问题

12. Transfer of Data Outside Singapore 向新加坡境外传输数据

We generally do not transfer your personal data outside Singapore. If such transfer becomes necessary, we will ensure that the recipient provides a comparable standard of protection as required under the PDPA.

我们通常不会将您的个人数据传输到新加坡境外。如需进行此类传输，我们将确保接收方提供PDPA要求的同等保护标准。

13. Do Not Call (DNC) Registry 拒绝来电（DNC）登记处

If your phone number is registered with Singapore's DNC Registry, we will not send you marketing messages via voice calls, SMS, or fax unless you have given us clear consent to do so.

如果您的电话号码已在新加坡DNC登记处注册，除非您明确同意，否则我们不会通过语音通话、短信或传真向您发送营销信息。

14. Cookies and Website Analytics Cookie和网站分析

Our website may use cookies and analytics tools (such as Google Analytics) to improve user experience and understand website usage. These tools may collect:

我们的网站可能使用Cookie和分析工具（如Google Analytics）来改善用户体验并了解网站使用情况。这些工具可能收集：

• Pages visited and time spent on the site 访问的页面和在网站上花费的时间
• Device and browser information 设备和浏览器信息
• Referring website and general geographic location 来源网站和大致地理位置

You can configure your browser to reject cookies, though this may affect website functionality.

您可以配置浏览器拒绝Cookie，但这可能影响网站功能。

15. Updates to This Policy 政策更新

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated policy will be posted on this page with a new "Last updated" date. We encourage you to review this policy periodically.

我们可能会不时更新本隐私政策，以反映我们的做法或法律要求的变化。更新后的政策将发布在本页面，并附上新的"最后更新"日期。我们建议您定期查阅本政策。

16. Contact and Complaints 联系和投诉

If you have questions, concerns, or complaints about how we handle your personal data, please contact our Data Protection Officer:

如果您对我们如何处理您的个人数据有疑问、担忧或投诉，请联系我们的数据保护官：

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

如果您对我们的回复不满意，可以向个人数据保护委员会（PDPC）投诉：www.pdpc.gov.sg。