Scope of this statement
LYLA MEDICAL ("the clinic") is committed to protecting the privacy of personal data and to complying with the requirements of the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. This statement explains what personal data the clinic holds, why it is held, who it may be shared with, how long it is kept, and what rights you have in respect of it.
It covers both data collected through this website and data collected in the course of providing medical care at the clinic.
Personal data collected
The clinic collects only the data it needs for the purposes set out below.
- Identity and contact data — name, Hong Kong identity card or passport number, date of birth, sex, telephone number, email address and correspondence address.
- Medical data — presenting complaint, medical, surgical, medication and allergy history, examination findings, clinical photographs, investigation and pathology results, operation records, and treatment and follow-up notes.
- Payment and insurance data — billing details and, where a claim is made, insurance policy and claim information.
- Website enquiry data — the name, telephone number, area of concern and message you choose to enter in the enquiry form on this site.
Providing personal data to the clinic is voluntary. However, if the identity, contact and medical data requested is not provided, the clinic may be unable to provide a consultation or treatment safely.
How personal data is used
Personal data held by the clinic is used for the following purposes:
- providing medical consultation, treatment, surgery and follow-up care;
- making and confirming appointments, and contacting you about your care;
- arranging admission, operating theatre time, anaesthesia, pathology, imaging and other services on your behalf;
- billing, payment processing and the handling of insurance claims at your request;
- maintaining medical records as required for clinical and professional purposes; and
- complying with the law and with the requirements of the Medical Council of Hong Kong, the Department of Health and other regulatory or judicial authorities.
Direct marketing
The clinic does not use personal data for direct marketing, and does not sell, rent or otherwise provide personal data to any third party for that party's direct marketing. No promotional material is sent to patients or to website enquirers. Should this ever change, the clinic would first obtain your consent in the manner required by the Personal Data (Privacy) Ordinance.
Disclosure and transfer
Medical data is confidential and is not disclosed without consent, except where disclosure is permitted or required by law. Data may be transferred to:
- hospitals, day procedure centres, anaesthetists, pathology and imaging providers and other healthcare professionals involved in your care;
- your insurer or its agent, where you have asked the clinic to support a claim;
- the clinic's professional advisers and service providers, who are bound to keep the data confidential and to use it only for the purpose for which it was given to them; and
- a regulatory, law enforcement or judicial authority, where required by law.
Personal data is held in Hong Kong.
Security
The clinic takes practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. Paper records are kept in locked storage in the clinic premises; electronic records are held on access-controlled systems. Access is limited to the doctor and to clinic staff who need the data to do their work, all of whom are bound by a duty of confidentiality.
Retention
Personal data is kept only for as long as is necessary for the purposes for which it was collected, and is then erased or destroyed securely. Medical records are retained in line with the retention periods expected of a private medical practice in Hong Kong. Enquiries received through this website that do not lead to a consultation are deleted once the enquiry has been dealt with.
This website
This website does not set tracking cookies, does not run analytics, and does not create a profile of visitors. The enquiry form on this site has no server behind it: the details you enter are assembled into a message in your own browser and handed to WhatsApp or to your email application, which you then send yourself. Nothing is stored by this website.
Two third-party services are loaded to display the site: Google Fonts, which supplies the typefaces, and an embedded Google Map showing the clinic's location. Requests to those services are made by your browser and are subject to Google's own privacy policy. If you would rather not make them, your browser's content settings can block them; the rest of the site continues to work.
Please do not include sensitive medical details in a website enquiry or in an unencrypted email. Bring them to the consultation instead.
Access and correction
Under the Personal Data (Privacy) Ordinance you have the right to ask whether the clinic holds personal data about you, to request a copy of it, and to request correction of data that is inaccurate. Requests should be made in writing to the address or email below. The clinic will respond within 40 days. A reasonable fee may be charged for complying with a data access request, as permitted by the Ordinance.
Contact
Enquiries, requests and complaints about personal data should be addressed to:
Privacy Compliance
LYLA MEDICAL
Rm 1008, 10/F, Bank of America Tower, 12 Harcourt Road, Central, Hong Kong
Email: info@lylamedical.com
Tel: 2116 5220
Changes to this statement
The clinic may revise this statement from time to time. The version published on this page is the current one, and the date it was last updated is shown at the top of the page.