Privacy Policy
Effective Date: January 2025
Introduction City Osteopathy (“we,” “us,” “our”) values your privacy and is committed to protecting your personal data. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information in compliance with the applicable laws and regulations of the United Kingdom (UK), Australia, the European Union (EU), the United States (USA) under HIPAA, and Hong Kong.
1. Data We Collect
We collect the following categories of personal data:
1.1. Personal Information
-
Name
-
Date of Birth
-
Contact Information (e.g., address, phone number, email)
1.2. Health Information
-
Medical history
-
Treatment plans
-
Appointment details
-
Payment and insurance information
1.3. Technical Information
-
IP address
-
Cookies and similar technologies (see Section 10 for details)
-
Usage data from our website or online platforms
2. Legal Basis for Processing Personal Data
2.1. UK and EU GDPR Compliance
We process your data based on the following legal bases:
-
Consent: When you provide explicit consent (e.g., signing forms).
-
Contractual Obligation: To deliver healthcare services.
-
Legal Obligation: To comply with applicable laws and regulations.
-
Legitimate Interests: For internal management and service improvement.
2.2. HIPAA Compliance (USA)
We comply with HIPAA regulations for Protected Health Information (PHI), ensuring confidentiality, integrity, and availability. PHI is only used for treatment, payment, and healthcare operations.
2.3. Hong Kong Compliance
We adhere to the Personal Data (Privacy) Ordinance (PDPO), ensuring the lawful, fair, and transparent use of your personal data.
3. How We Use Your Data
We use your data for the following purposes:
-
Providing healthcare services.
-
Scheduling and managing appointments.
-
Processing payments and insurance claims.
-
Improving our services.
-
Complying with legal and regulatory requirements.
-
Communicating with you regarding health updates and service changes.
4. Sharing and Disclosure of Information
4.1. Third-Party Service Providers
We may share your data with trusted partners (e.g., insurance providers, IT support) who adhere to strict confidentiality agreements.
4.2. Legal Obligations
We may disclose your information if required to comply with legal obligations, such as:
-
Subpoenas or court orders.
-
Regulatory investigations.
4.3. International Transfers
If your data is transferred outside your country of residence, we ensure equivalent levels of protection by applying:
-
Standard Contractual Clauses (for EU data).
-
Adequacy decisions (where applicable).
5. Your Rights
5.1. Under GDPR (UK and EU)
You have the right to:
-
Access your data.
-
Correct inaccurate or incomplete data.
-
Request data deletion (where legally permissible).
-
Restrict processing.
-
Data portability.
-
Object to data processing.
-
Withdraw consent at any time.
5.2. Under HIPAA (USA)
-
Right to access your medical records.
-
Request amendments to your health information.
-
Receive an accounting of disclosures.
-
File a complaint without retaliation.
5.3. Under PDPO (Hong Kong)
-
Request access and correction of your personal data.
-
Opt-out of direct marketing communications.
To exercise your rights, please contact us at [Insert Contact Details].
6. Data Security
We implement industry-standard measures to safeguard your data, including:
-
Encryption of sensitive data.
-
Secure data storage.
-
Access controls and authentication.
-
Regular security audits and compliance checks.
7. Data Retention
We retain your personal data for as long as necessary to:
-
Fulfill the purposes outlined in this Privacy Policy.
-
Comply with legal and regulatory obligations.
8. Cookies and Online Tracking
Our website uses cookies to enhance user experience. You can manage your cookie preferences through your browser settings. For more details, see our Cookie Policy [insert link].
9. Updates to This Privacy Policy
We may update this Privacy Policy to reflect changes in regulations or our practices. The latest version will always be available on our website, and significant changes will be communicated to you directly.
10. Contact Information
For questions or concerns regarding this Privacy Policy, contact us:
For HIPAA-related inquiries, you may also contact the U.S. Department of Health and Human Services at https://www.hhs.gov.
Acknowledgment By engaging with our services, you acknowledge that you have read and understood this Privacy Policy and consent to its terms where required.
