Privacy Policy

Relating to the Personal Data (Privacy) Ordinance (Cap. 486) (the "Ordinance")

1. Introduction

1.1 Your privacy and the security of your personal information are important to us. This Policy is prepared in accordance with the Ordinance and operates as our Personal Information Collection Statement, which we will provide or make available to you on or before we collect your personal information. When you become our customer, you agree that we will handle your personal information as described in this Policy. This Policy replaces any policy or statement of a similar nature that may have been provided to you previously.

1.2 ProHealth Medical Group Ltd ("PMG", "we", "us" or "our") is a healthcare group in Hong Kong. In this Policy, "we", "us" and "our" refer, individually or collectively, to PMG and its holding companies, branches, subsidiaries, representative offices and affiliates in Hong Kong (each a "Company"). The rights and obligations of each Company under this Policy are several and not joint. No Company shall be liable for any act or omission of another Company.

1.3 Which Company looks after and uses your information as a data user depends on which services you are using or with which you are interacting. Where necessary or appropriate, we will tell you when you are dealing with a different Company within PMG.

1.4 For the purposes of this Policy, "Group Company" means the Company and its holding companies, branches, subsidiaries, representative offices and affiliates, wherever situated, and any one of them. Affiliates include branches, subsidiaries, representative offices and affiliates of the Company's holding companies, wherever situated (collectively, the "Group").

1.5 If you provide us with personal information about other individuals, you confirm that you have their consent and have informed them where they can find a copy of this Policy.

1.6 If you are located outside Hong Kong, by submitting your application to us or by accessing or continuing to use any of our services, products or digital portals, you give explicit consent to your personal information being received, collected, stored, used, processed, disclosed, transmitted and transferred outside your place of residence or country in accordance with the protections described in this Policy.

2. Personal Information We Collect

2.1 From time to time, it is necessary for you, or other persons covered by your policy, subscription plan, membership or any other service plan (each a "Member"), to supply the Company with certain personal information (including, where relevant, credit information and claims history) when you interact with us, apply for and use our products and services.

2.2 Failure to supply personal information requested by the Company may result in the Company being unable to process your application, request for information or services, enquiries and/or provide services or products to you or the Member.

2.3 The personal information we collect and/or hold from time to time may include:

(a) your personal identification information;
(b) your contact information;
(c) your transaction records;
(d) your financial background;
(e) your medical and health records;
(f) your biometric data; and
(g) your location and activities when you access or browse our website(s) or use our mobile application(s) or portal(s) (including any diagnostic or health-monitoring tools thereon and the Bluetooth and/or wearable devices that are used to collect data for the purposes of such tools).

2.4 We will always try to collect your personal information from you through the course of your relationship with us and in a range of ways. However, there may be instances where we will need to collect your personal information from third parties or sources in certain circumstances, such as a family member or someone else acting on your behalf, your employers, medical personnel, business or asset acquisition transactions of the Company, business partners, or public databases. Data may also be generated or combined with other information available to the Company or any member of the Group Company.

2.5 If you are under the age of 18, you should obtain consent from your parent or guardian before you provide the Company with your personal information. If you are between 13 and 17 years old, you may use our mobile application only with the consent and supervision of a parent or legal guardian who agrees to be bound by our Terms and Conditions.

2.6 Storage of personal information may be in various forms, including physical (paper) form, digital customer systems or applications, data management software or systems in the usual course of business practices, electronic medical record systems, and clinical images taken for diagnostic or treatment purposes on diagnostic equipment where you have undergone a diagnostic procedure using such equipment at facilities operated by the Company, depending on your engagement with the Company.

2.7 Separate privacy notices apply for recruitment or employment purposes.

3. Purposes of Collection

3.1 Your personal information collected may be used, stored, processed, transferred, disclosed or shared by the Company for the following purposes from time to time:

(a) processing, assessing and determining any applications for products and services;
(b) verifying your identity before providing our products or services to you;
(c) offering and providing products and services to you or the Member, and processing requests made by you or the Member from time to time, including but not limited to requests for addition, alteration, deletion, maintenance, management and operation of benefits or membership;
(d) registering you or the Member as a user or a member of services or information provided or to be provided by us on the website(s), mobile application(s) or portal(s) managed and/or operated by us;
(e) coordinating your care, or the Member's care, within Group Companies to achieve better health management outcomes;
(f) any purposes in connection with claims made by, against, or otherwise involving you or the Member in respect of any products and/or services provided by the Company, including, without limitation, making, defending, analysing, investigating, detecting and preventing fraud (whether or not relating to the policy issued in respect of any application or claim), and processing, assessing, determining, settling or responding to such claims;
(g) performing any functions and activities related to the products and/or services provided by the Company, including, without limitation, audit, reporting, market research, general servicing, maintenance of online and other services, identity verification, data matching, research, automated decision-making processes (including profiling), data analytics, big data compilation and aggregation, statistical analysis, benchmarking, product and service development, and reinsurance arrangements (please see further details in paragraph 8 below);
(h) providing you with personalised health information and information about our services or products, and a personalised website, mobile application or portal interface;
(i) providing you with appropriate medical, health, product administration, wellness or other related services (including, without limitation, e-ticketing, appointment booking, clinic or medical professional search, and service and product redemption functions on the website(s), mobile application(s) or portal(s) managed and/or operated by us, and seminars, webinars, events, lucky draws, contests or any other similar activities you choose to register for) or products;
(j) communicating with you regarding the administration, features and renewal of your policy, subscription plan, membership or any other service plan that you subscribe to;
(k) operating, maintaining, evaluating, improving and troubleshooting our website(s), mobile application(s) or portal(s), and understanding your preferences;
(l) provision and design of products and services of the Company;
(m) exercising the Company's rights in connection with the provision of any products and services to you or the Member from time to time, for example, to determine any amount of indebtedness from you, and collecting and recovering amounts owing from you or any person who has provided any security or undertaking for your liabilities;
(n) communication with you or the Member (or with you on behalf of the Member) in relation to any of the purposes set out in this Policy;
(o) with your consent, marketing services, products and other subjects by us, any member and/or brand of the Group Companies and/or other third parties, including customised and personalised marketing based on your preferences, usage, transaction history and profile (please see further details in paragraph 5 below);
(p) managing our relationship with you, our business and organisations who work with us in relation to providing our products or services to you or the Member (including, without limitation, future changes to this Policy);
(q) enabling an actual or proposed assignee, transferee, participant or sub-participant of all or a substantial part of the Company's rights or business to evaluate the transaction intended to be the subject of the assignment, transfer, participation or sub-participation;
(r) making disclosure to satisfy the requirements of any laws, rules and regulations, codes of practice, guidance notes or guidelines binding on the Company;
(s) any other purposes which we notify you of at the time of obtaining your consent; and
(t) fulfilling any other purposes directly related to (a) to (s) above.

4. Transfer of Personal Information

4.1 Personal information collected or held by the Company relating to you or the Member will be kept confidential, but the Company may transfer such personal information inside or outside the Hong Kong Special Administrative Region of the People's Republic of China, for the purposes specified in paragraph 3, to the following classes of transferees:

(a) any member and/or brand of the Group Companies;
(b) any insurance adjusters, agents and brokers;
(c) any reinsurance companies authorised by the Company;
(d) any relevant policyholders or main member of the subscription and/or service plan;
(e) any funders who arrange products or services on your behalf;
(f) any payment recipients, or anyone whose data is provided for receiving benefits under the plan or otherwise;
(g) healthcare professionals and hospitals;
(h) any third parties engaged in connection with a member of the Group Company's business who provide medical, health, insurance, wellness or other related services or products;
(i) any persons, bodies corporate or organisations who are clients of our nursing agency (if applicable);
(j) with your consent, eHealth (for registered participants under the Electronic Health Record Sharing System Ordinance (Cap. 625));
(k) any agent, contractor or third-party service provider who provides administrative, telecommunications, computer, payment, data processing, storage or analytics, technology, cloud, printing, research, advertising, distribution or other services to the Company in connection with the operation of its business;
(l) with your consent, third parties (within or outside the Group Companies) in relation to direct marketing (please see further details in paragraph 5 below);
(m) third-party reward, loyalty, co-branding and privileges programme providers and co-branding partners of a member of the Group Companies;
(n) financial institutions engaged by the Company or you for billing and payment purposes;
(o) any actual or proposed assignee, transferee, participant or sub-participant of all or a substantial part of the Company's rights or business;
(p) any party to whom you have consented to the disclosure of your personal information; and
(q) any person to whom the Company is under an obligation to make disclosure under the requirements of any law, rules, regulations, codes of practice or guidelines binding on the Company.

4.2 We will only disclose personal information to the extent necessary to the above parties for the relevant purposes. Such parties may process your personal information for the relevant purposes set out in paragraph 3 above.

4.3 In the event that we complete the acquisition of a new business or brand, we shall communicate with you through the communication channels you provided to us, and any personal information shall be treated in accordance with this Policy if it is practicable and permissible to do so.

4.4 Where we transfer personal information outside Hong Kong, we will take reasonable steps to ensure that the information receives a comparable level of protection, including through contractual safeguards with the recipient.

5. Use of Personal Information in Direct Marketing

5.1 We will not use your personal information for direct marketing purposes unless we have received your consent (which includes an indication of no objection). Consent to direct marketing is not a condition of us providing services to you.

5.2 Only with your consent, the Company, any member and/or brand of the Group Companies, and/or the third parties stated in paragraphs 3.1(o) and 5.3(b) to (e) may use your personal information (including your name, contact details, products and services portfolio, and transaction pattern and behaviour) collected from time to time to provide you with marketing communications relating to the following products and services:

(a) insurance, medical, dental, healthcare, wellness, personal development, beauty, sporting activities and membership, lifestyle, entertainment, financial, and related services and products;
(b) rewards, benefits, discounts, member activities, loyalty or privileges programmes and related services and products;
(c) services and products offered by the Company's co-branding partners; and
(d) donations and contributions for charitable and/or non-profit-making purposes.

5.3 The above services, products and subjects may be provided or (in the case of donations and contributions) solicited by the Company and/or:

(a) any member and/or brand of the Group Companies;
(b) third-party service providers;
(c) third-party reward, loyalty, co-branding or privileges programme providers;
(d) co-branding partners of a member of the Group Companies; and
(e) charitable or non-profit-making organisations.

5.4 We will not provide your personal information to third parties for their direct marketing purposes unless we have received your written consent (which includes an indication of no objection). You may opt out at any time without charge.

5.5 For the avoidance of doubt, the latest instruction (for example, consent or indication of no objection, or request for opt-out) received from you shall override any previous instruction given to the Company in this regard in relation to all of your personal information collected or held by the Company from time to time.

5.6 If you agree to receive marketing communications but do not wish to receive them in the future, you may inform us by the following applicable means:

(a) unsubscribing by following the "Unsubscribe" instructions in our mobile applications;
(b) following the unsubscribe instructions or hyperlink in the email;
(c) unsubscribing by following the "Unsubscribe" instructions contained in the marketing text message;
(d) notifying us during our marketing calls that you no longer wish to receive marketing communications; or
(e) contacting us by the communications stated in paragraph 9 below.

5.7 If you choose to personalise your services where such options are available, we will use personal information that we collect so that we can offer you those personalised services or communications. If you do not wish to accept those personalised services or communications, you can unsubscribe from those services at any time and we will cease to offer such services to you.

5.8 For the avoidance of doubt, whether or not you consent to receive marketing communications of the type described in this paragraph 5, the Company may still communicate with you regarding the administration, features and renewal of your policy, subscription plan, membership or any other service plan that you subscribe to.

5.9 Customised and Personalised Marketing. With your consent, we may use your personal information (including your name, contact details, products and services portfolio, transaction pattern and behaviour, preferences, and usage data) to:

(a) create a profile of your preferences and interests;
(b) segment you into audience groups;
(c) deliver customised and personalised marketing communications, offers and recommendations; and
(d) measure the effectiveness of our marketing.

You may opt out of customised and personalised marketing at any time by contacting us using the details in paragraph 9, or by using the unsubscribe options in paragraph 5.6.

6. Security and Retention

6.1 The Company retains your personal information for as long as necessary for the purposes set out in this Policy, or otherwise agreed between you and us, unless otherwise required or permitted under applicable law. Retention periods vary depending on the type of information:

(a) medical and health records: retained in accordance with applicable laws and professional guidelines;
(b) financial and transaction records: retained for the period required for accounting, tax and audit purposes;
(c) marketing data: retained until you opt out or as otherwise permitted by law; and
(d) website and application usage data: retained for a reasonable period for analytics and security purposes.

6.2 Where the Company no longer requires your personal information for the purposes under this Policy, or as otherwise required under law, we will take appropriate steps to securely delete or destroy your personal information.

6.3 We will take all practicable steps to protect your personal information against unauthorised or accidental access, processing, erasure, loss or use. This includes implementing a range of digital and physical security measures, such as encryption of data in transit and at rest, access controls, and access logging.

6.4 We will impose contractual obligations on data processors to protect your personal information, including obligations relating to security, confidentiality, sub-processing, and notification of breaches.

6.5 Our online portals may have links to other external websites over which we do not have control. You are advised to refer to the privacy policies of these websites for more information.

6.6 Our websites, mobile applications or portals may incorporate software development kits ("SDKs") and AI tools provided by technology partners. We conduct security and privacy assessments on these third parties and the deployed SDKs and AI tools to protect your personal information. If you choose not to accept the SDK service providers or AI tools, certain services may not be accessible, but you can still access other digital services.

6.7 In the event of a data breach, we will notify affected individuals and the Privacy Commissioner for Personal Data as required by applicable law.

7. Use of Cookies

7.1 When you use our sites, we and third-party companies collect information by using cookies and other technologies such as pixel tags. You can also control, block or delete cookies through your web browser settings.

7.2 To find out more about cookies, please visit aboutcookies.org or allaboutcookies.org.

8. Artificial Intelligence, Profiling and Automated Decision Making

8.1 Like many businesses, we may use artificial intelligence (AI) and other automation technologies to provide products or services to you, which may involve the use of your personal information for the purposes described in this Policy.

8.2 Some of the ways we use these technologies include: underwriting and claim management; customer service; risk assessment and pricing; AI-assisted clinical summary; fraud detection; training our model; and AI via SDKs.

8.3 The data undergoes a de-identification process to perform the analysis. This means that we remove information from which you can be directly identified, e.g. your name, and replace it with a pseudonym or unique identifier.

8.4 Where an automated decision significantly affects you, you may request human review of that decision by contacting us using the details in paragraph 9.

8A. Big Data Compilation, Algorithm Fine-Tuning and AI Training

8A.1 Purposes. We may compile, aggregate, combine, analyse and use personal information for big data analytics, algorithm fine-tuning, machine learning and AI training, in order to improve the accuracy, safety and performance of our AI models; develop new products, services and features; conduct research, benchmarking and statistical analysis; detect and prevent fraud, abuse and security threats; improve clinical decision support tools (where applicable); and customise and personalise our services and communications.

8A.2 De-identification and Anonymisation. Where practicable, we will de-identify or anonymise personal information before using it for big data compilation, algorithm fine-tuning or AI training.

8A.3 Use of Identifiable Data. Where de-identification or anonymisation is not practicable, we will only use identifiable personal information for the purposes in paragraph 8A.1 with your consent, or as otherwise permitted by applicable law.

8A.4 Third-Party AI Providers. We may engage third-party AI providers, cloud providers and technology partners to process personal information for the purposes in paragraph 8A.1. We will impose contractual obligations on such providers relating to security, confidentiality, data minimisation, purpose limitation and deletion.

8A.5 Cross-Border Processing. AI training and big data processing may involve transfer of personal information outside Hong Kong. We will take reasonable steps to ensure comparable protection, including contractual safeguards.

8A.6 No Re-identification. We will not attempt to re-identify anonymised data, and we will impose contractual obligations on third parties not to do so.

8A.7 Opt-Out. Where our use of your personal information for AI training or big data compilation is based on consent, you may withdraw your consent at any time by contacting us using the details in paragraph 9.

8A.8 Human Review. Where an AI or automated decision significantly affects you, you may request human review in accordance with paragraph 8.4.

8A.9 Retention. Personal information used for AI training and big data compilation will be retained in accordance with paragraph 6.1 and deleted or anonymised when no longer required.

9. Data Access and Correction

9.1 Under and in accordance with the terms of the Ordinance, you have the following rights to:

(a) check whether the Company holds personal information relating to you or the Member and to access such personal information;
(b) require the Company to correct any personal information relating to you or the Member which is inaccurate;
(c) ascertain our policies and practices in relation to personal data and to be informed of the kind of personal data held by the Company;
(d) request the Company to cease using your personal information for direct marketing purposes; and
(e) change your preference in respect of our use of your personal information.

9.2 Requests can be made in writing to the Company at the following address:

Data Privacy Officer / Customer Service Manager
ProHealth Medical Group Ltd
Unit 105A, 1/F, Liberte Place, 833 Lai Chi Kok Road, Kowloon, Hong Kong
Email: privacy@prohealthmedical.com.hk

9.3 In accordance with the terms of the Ordinance, the Company has the right to charge a reasonable fee for the processing of any personal information access or correction request.

9.4 We will respond to access and correction requests within the timeframe required by the Ordinance (generally 40 days).

9.5 Nothing in this Policy shall limit the rights of customers under the Ordinance. If you are dissatisfied with our handling of your request, you may complain to the Privacy Commissioner for Personal Data.

10. Language

10.1 In the event of any inconsistency between the English and Chinese versions of this Policy, the English version shall prevail, except where applicable law requires otherwise.

10.2 This Policy may be amended by the Company from time to time. You may access and obtain a copy of this Policy, as amended from time to time, on our website.

This Privacy Policy is provided in English. A Chinese version is available on request. If there is any inconsistency between the English and Chinese versions, the English version prevails, except where applicable law requires otherwise.