个人资料保密条例

ANNEX A

RENALTEAM PERSONAL DATA PROTECTION POLICY (PATIENT) EFFECTIVE FROM 2 JULY 2014

This is the patient personal data protection policy of RenalTeam Pte Ltd. In this policy, the terms “we”, “us” and “our” refer to RenalTeam Pte Ltd and the term “RT” refers collectively to us.

We are committed to data protection and we will follow this policy and comply with all data protection and confidentiality obligations imposed on us by law, including the Personal Data Protection Act 2012 (No. 26 of 2012) and Private Hospitals and Medical Clinics Act (Cap. 248).

1.0 PERSONAL DATA COLLECTION

Personal data is data that can be used to identify a natural person.

Examples of personal data include your name, nationality, date of birth, sex, contact details (address, email address, telephone numbers), NRIC, FIN or passport number, your image on CCTV and in photographs, your medical history, patient history, allergy information and any other medical and health records.

If you provide the personal data of anyone else (such as your family members), it means that you have obtained his/her consent to our collection, use and disclosure of his/her personal data for the purposes set out in this policy or that you validly give us such consent on their behalf.

2.0 PURPOSES FOR COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA

We collect, use and disclose personal data for the following purposes:

2.1 Healthcare and other services

• providing outpatient dialysis treatment and services;
• management and coordination of your continuity of care including follow-ups after your discharge from hospitals in the course of your receiving kidney dialysis treatments from us; and/or
• providing all other services on request or as needed, including customer service, patient liaison services, travel arrangements eg calling for a taxi to bring you home

2.2 Administration

• processing appointments, bookings, admissions, transfers and discharge;
• processing and collecting payment for treatment and services;
• creation, storage, hosting, backup (whether for disaster recovery or other purposes) of
• medical records and financial and other business records;
• verifying identity and conducting screenings, due diligence checks and credit checks;
• responding to queries or feedback;
• addressing or investigating complaints, claims or disputes;
• compliance with internal policies, procedures and directives;
• enforcing obligations owed to us; and/or
• complying with our legal obligations and requirements.

2.3 Business operations

• guarding and securing our premises;
• monitoring and assessing the provision of services and medication;
• financial reporting, regulatory reporting, management reporting, risk management (including monitoring credit exposures), audit and record keeping purposes;
• enhancing and improving our services, including reviewing standards of care

2.4 Health Information Sharing

• Sharing your medical records with other health care providers for medical treatment and healthcare purposes, where required or permitted by law, including by way of the National Electronic Health Record (NEHR) system, which enables health information to be shared throughout the Singapore healthcare ecosystem.

2.5 Research

• Conducting research into new procedures and practices for the improvement of providing kidney dialysis services and treatment, subject always to applicable laws and codes of conduct, including those relating to the protection of research subjects’ safety and confidentiality.

2.6 Photography and CCTV (closed-circuit television)

• We may take photographs and make videos and/or sound recordings in and around our premises from time to time, including our meeting and function rooms. You may be captured in such photographs and recordings.
• We may use such photographs and/or recordings in our publications, websites and other communication channels, as well as in third party media, or display them in and around our premises and/or the premises of RT.
• CCTV may be in operation in and around our premises as necessary in the interests of

2.7 Any other purposes relating to or arising out of the above

3.0 DISCLOSURE OF DATA TO THIRD PARTIES

We may disclose your personal data to third parties, whether located in Singapore or elsewhere, in order to achieve the purposes stated in this policy. Such third parties include:

• the doctors and other healthcare professionals who treat or have treated you, and their respective staff;
• the Central Provident Fund Board of Singapore (“CPF Board”) and/or your health insurance provider, for payment processing purposes;
• RT and our respective partners for the provision of products and services at your request or the conduct of marketing and promotions with your consent;
• our service providers, contractors and agents;
• healthcare providers, agencies or facilities for the purposes of information sharing and exchange via the NEHR system or other health information exchange systems, where such disclosure is required or permitted by law;
• regulatory authorities, any statutory bodies or public agencies for the purposes of complying with their respective requirements, policies and directives or where such disclosure is required or permitted by law, including the Ministry of Health, Health Sciences Authority, the coroner and the police and other law enforcement agencies
• funeral homes and crematoria, where such disclosure is required or permitted by law;
• organisations that handle organ donation, procurement and transplants, where such disclosure is required or permitted by law;
• national registers and databases for various medical conditions, diseases and transplants, where such disclosure is required or permitted by law;
• accreditation or representative bodies for health care providers, agencies, facilities or healthcare professionals, where such disclosure is required or permitted by law; and/or
• anyone involved in your care or payment for your care (including a family member, friend or your caregiver or caregiving organisation) and anyone you have authorised us to contact or communicate with.

3.1 We may also collect, use and disclose personal data where required or permitted by law for any purpose.

4.0 RETENTION OF PERSONAL DATA

We will retain personal data for a reasonable period in accordance with our legal and business purposes. RT will therefore retain and maintain its personal data records in compliance with Ministry of Health licensing terms and conditions for Renal Dialysis under Regulation 18 (1) and Second Schedule and the Regulation 37 and Third Schedule of the Private Hospitals and Medical Clinics Regulations (Cap 248, Regulation 1), CPF Board and other regulatory bodies as part of its operating licensing terms and conditions.

5.0 ACCESS TO AND CORRECTION OF PERSONAL DATA

If you wish to correct or have access to your personal data, please contact us under Clause 6 “Our Contact”.

6.0 OUR CONTACT

If you have questions or concerns regarding your personal data or any aspect of this policy, please contact us at pdpa@renalteam.org. Or, you may approach our Nurse Managers at the Dialysis Centre you are dialysing at.

RT will make information on data protection policies and procedures available upon written request.

Feedback may be provided anytime to the Data Protection Officer at RT’s HQ’s address. RT will consider all feedback and take appropriate action upon such feedback.

7.0 AMENDMENTS AND UPDATES

We may amend this policy from time to time and will make available the updated policy on our Website at www.renalteam.org. Each time we collect, use or disclose personal data, the latest version will apply.