Personal data protection policy

Section 1 — Introduction

1. This is the personal data protection policy of Neurosurgery and Orthopaedic Clinic, by Basel Medical. In this policy, the terms "the Clinic", "we", "us" and "our" refer to Neurosurgery and Orthopaedic Clinic.
2. We value the privacy of every individual and are committed to protecting the personal data we collect, in accordance with the principles set out in this policy.
3. In accordance with the Personal Data Protection Act 2012 ("PDPA"), this policy describes how we may collect, use, disclose and manage your personal data. For general information on personal data protection, please visit the Personal Data Protection Commission ("PDPC") website at pdpc.gov.sg.
4. Where other regulatory or statutory requirements apply to us, such as the Human Organ Transplant Act or the Infectious Diseases Act, we comply with those as well. In the event of inconsistency between those written laws and the PDPA, the provisions of those other written laws may take precedence.
5. Terms used in this policy that are also defined in the PDPA, such as "individual", "personal data" or "reasonable", take the definition or interpretation given by the PDPA or the PDPC's advisory guidelines.
6. We may update this policy from time to time, so that our standards and practices remain relevant and comply with applicable laws and guidelines. The latest version supersedes earlier versions and applies to personal data provided to us previously. We encourage you to review this page from time to time.

Section 2 — Personal data

1. Personal data is defined as data, whether true or not, about an individual who can be identified from that data, or from that data together with other information to which the organisation has or is likely to have access. This may include your full name, identification number, passport name, nationality, date of birth, sex, contact details (address, email address, telephone numbers), NRIC, FIN or passport number, your image on our closed-circuit television (CCTV) and in photographs, your medical history, patient history, allergy information and any other medical and health records, as well as the name and residential address of any individual you have provided to us. Where required and medically necessary for diagnosis, treatment and record purposes, we may also take photographs of your wounds.
2. The PDPA does not apply to:
   • business contact information, meaning an individual's name, position name or title, business telephone number, business address, business email address, business fax number and any other similar information about the individual, not provided solely for the individual's personal purposes;
   • personal data that is anonymised, that is, where identifying information is removed such that the remaining data does not identify any particular individual. The PDPC will consider data anonymised only if the possibility of re-identification is trivial;
   • personal data of a deceased individual who has been dead for more than 10 years; and
   • personal data that has been falsified with the intent to commit fraud.
3. The PDPA recognises that a balance must be struck between protecting personal data and the need of organisations to collect, use or disclose it. In meeting those obligations, the PDPA considers what a reasonable person would regard as appropriate in the circumstances.

Section 3 — Consent, and the purposes for collection, use or disclosure

1. By applying this policy, you consent to our collection, use and disclosure of your personal data for the purposes that a reasonable person would consider appropriate in the circumstances.
2. Consent can be given expressly or deemed. Your provision of personal data to us is voluntary, and you are deemed to consent to our collection, use or disclosure of that data for the purpose under which it was collected. If you have consented to our disclosure of your personal data to another organisation for a particular purpose, they will use it only for the purposes you have consented to.
3. If you provide personal data belonging to others, such as family members or next of kin, you warrant that you have informed them of the purposes for which we are collecting their personal data, and that they have consented to your disclosure of it to us for those purposes.

We collect, use and disclose personal data for the following purposes.

Healthcare and other services

• providing inpatient and outpatient medical treatment and services, healthcare and allied healthcare services;
• management and coordination of your care, including follow-ups, step-down care and other continuity of care matters; and
• providing other services on request or as needed, including patient liaison, travel and accommodation arrangements, ambulance services, arrival and departure transport, security, and other products and services made available by us, other Group entities and our respective partners.

Administration

• appointments, bookings, admissions, transfers and discharge;
• processing and collecting payment for products, treatments and services;
• reimbursement of healthcare providers for services provided to you;
• creation, storage, hosting and backup of medical records and financial and other business records, whether for disaster recovery or other purposes;
• verifying identity, and conducting screenings, due diligence checks and credit checks;
• responding to queries or feedback;
• addressing or investigating complaints, claims or disputes;
• compliance with internal policies, procedures and directives;
• enforcing obligations owed to us; and
• complying with our legal obligations and requirements.

Business operations

• guarding and securing our premises;
• monitoring and assessing the provision of products and services;
• financial, regulatory and management reporting, risk management, audit and record keeping;
• business research, planning, statistical analysis and policy development; and
• enhancing and improving our services, including reviewing standards of care.

Health information sharing

• sharing medical records with other healthcare providers for medical treatment and healthcare purposes, where required or permitted by law or pursuant to our referrals, including by way of the National Electronic Health Record (NEHR) system, which enables health information to be shared throughout the Singapore healthcare ecosystem.

Teaching

• providing education and training for doctors and other medical, nursing or health professionals and students. You are entitled to say no at any time to such persons viewing or being granted access to your treatment and related information. Please tell your doctor before treatment if you do not wish this.

Research

• conducting research into new treatments, procedures and practices for the improvement of healthcare, subject always to applicable laws and codes of conduct, including those relating to the safety and confidentiality of research subjects.

Marketing and promotion

• with your consent, conducting marketing and promotion in relation to us, other Group entities and our respective partners;
• we will not send telemarketing messages to your Singapore telephone number by text message, telephone call or fax without your clear and unambiguous consent in writing or other recorded form, or if you have registered your number with the Do Not Call Registry.

Public health

• safeguarding public health and safety, and preventing or lessening a threat to your health and safety or that of others.

Photography and CCTV

• we may take photographs and make video or sound recordings in and around our premises occasionally, and you may be captured in them;
• we may use such photographs or recordings in our publications, websites and other communication channels, in third party media, or displayed in and around our premises or those of our Group;
• CCTV may be in operation in and around our premises as necessary in the interests of security;
• any other purposes relating to or arising out of the above.

Third parties we may disclose to

We may disclose personal data to third parties, whether in Singapore or elsewhere, in order to achieve the purposes stated in this policy. Such third parties include:

• the doctors and other healthcare professionals who treat or have treated you, and their staff;
• the Central Provident Fund Board of Singapore and your health insurance provider, for payment processing;
• other Group entities and our respective partners, for the provision of products and services at your request, or the conduct of marketing and promotions with your consent;
• our service providers, contractors and agents;
• third parties you have used to obtain or request our services, including referral agencies, business introducers and travel agencies;
• other Group entities for group-wide business purposes, or where such disclosure is required or permitted by law;
• healthcare providers, agencies or facilities for information sharing and exchange through the NEHR system or other health information exchange systems, where required or permitted by law;
• regulatory authorities, statutory bodies and public agencies for the purposes of complying with their requirements, policies and directives, or where disclosure is required or permitted by law, including the Ministry of Health, the Health Sciences Authority, the coroner, the police and other law enforcement agencies.

Section 4 — Protection of your personal data

1. We practise strong data protection as part of our IT policies and procedures, and in fulfilment of obligations under legislation such as the Private Hospitals and Medical Clinics Act and the Infectious Diseases Act.
2. While we take reasonable efforts to protect the personal data held by us, we cannot be held responsible for unauthorised and unintended access that is beyond our control.

Section 5 — Retention of your personal data

1. We review the personal data held by us regularly, to determine whether it is still needed. Your personal data will not be retained longer than needed for the purpose under which it was collected, unless there are business, industry or legal requirements to retain it. It will not be kept "just in case" it may be needed for other purposes of which you have not been notified.
2. We may anonymise personal data on record. An organisation is considered to have ceased retention of personal data when it no longer has the means to associate that data with particular individuals. Anonymisation is described in the PDPC's advisory guidelines on selected topics.
3. We retain employee personal data for a reasonable period of up to seven years, in accordance with our legal and business purposes, even after the person ceases to be employed by the Group. Medical records are retained for the duration stipulated by the Ministry of Health.

Section 6 — Transfer of your personal data out of Singapore

If we transfer your personal data to a country outside Singapore, we will ensure that it is protected to a standard comparable to that accorded under the PDPA. In summary, this means:

• the collection, use or disclosure of your personal data would be for the purposes for which you have given consent;
• steps would be taken to ensure accuracy and completeness when your personal data is used or disclosed to third parties;
• security arrangements would be made to protect it;
• it would be retained only if necessary for legal and business purposes; and
• anyone receiving your personal data from us is either in a jurisdiction with comparable data protection laws, or is otherwise bound to protect it.

Section 7 — Withdrawal of consent, access and correction

1. It is the obligation of the individual to ensure that all personal data submitted to us is true, accurate and complete.
2. You may access the personal data currently in our possession by contacting our Data Protection Officer. We will process your request in accordance with the access requirements of the PDPA, and provide the relevant personal data within a reasonable time. A fee may be charged for processing an access request.
3. You may request a correction to your personal data by contacting our Data Protection Officer. We will correct it as soon as practicable, unless we have reasonable grounds not to do so.
4. You may withdraw your consent for the collection, use and disclosure of your personal data by giving us reasonable notice. We are obliged to evaluate and process your request. If you proceed with a withdrawal, note that it will affect the medical care and services you receive from us or from other healthcare institutions.
5. We will not be able to provide access to opinion data kept solely for an evaluative purpose, such as an opinion on suitability, eligibility or qualification for employment, promotion or continuance in employment. Once consent is withdrawn, we are obliged to cease, and to cause our data intermediaries and agents to cease, the collection, use and disclosure concerned within a reasonable notice period. As a result, we may not be able to proceed with some of the things you have requested.

Section 8 — Contacting us

If you wish to withdraw any consent you have given us, to obtain access to or make corrections to your personal data, or if you do not accept an amendment to this policy, please contact:

The Data Protection Officer
Neurosurgery and Orthopaedic Clinic, by Basel Medical
6 Napier Road, #02-10
Gleneagles Medical Centre
Singapore 258499
Email: baselneurosurgery@bone.com.sg
Phone: +65 8849 0677

Section 9 — Amendments and updates

We may amend this policy from time to time, and will make the updated policy available on our website at neurosurgery.com.sg/. Each time we collect, use or disclose personal data, the latest version of this policy in force at that time will apply.