Data Protection Notice
Union Medical Centre Limited and its subsidiary, affiliated or related companies, including Union Hospital (collectively, "we", "us" or "our") inform you in the following about the processing of your personal data in the context of the implemented Office modules from Microsoft 365, particularly, Microsoft Exchange Online in conjunction with Microsoft Outlook for e-mail communication.
Collection, Processing And Usage Of Personal Data
The following categories of data are processed:
- Identification Information: name, address, date of birth, age, gender, sex, phone number, email address, marital status, IP address, identification card number, cookie ID, medical record number, etc.
- Contact Data: address, phone number, email address, etc.
- Demographic Data: race/ethnicity, nationality.
- Financial and Administrative Data: billing information, insurance details, administrative and claims data, etc.
- Health Data: symptoms, medical conditions, diagnoses, medications, treatments, healthcare service details, genetic and biometric data, etc.
- Personnel data: photograph, work experience, education history, skills, languages, references, driving licence details, marital status, health disclosure, disability information, etc.
- Log Data
Cloud Data Centre Locations Beyond Hong Kong Special Administrative Region And Implications
Microsoft Exchange Online is part of the Microsoft 365 cloud application. The exchange of e-mails takes place via Microsoft Exchange Online and does not require a user or guest account from the communication partner. Microsoft Exchange Online in combination with Microsoft Outlook covers the mail communication.
Data processed with Microsoft 365 may be stored on servers located in data centres across Australia, the Hong Kong Special Administrative Region, Japan, Malaysia, New Zealand, Singapore, and South Korea. Please be aware that in some of these locations, data may be subject to access requests from law enforcement or national security agencies. To safeguard this data, we have entered into appropriate agreements with Microsoft to ensure that robust technical and organisational measures are in place for Microsoft 365. These measures align with current best practices in IT security, including strict controls over access permissions and the implementation of end-to-end encryption for network transmission, databases, and servers.
Microsoft reserves the right to process Customer Data for its own legitimate business purposes. We cannot influence these data processing operations by Microsoft.
For more information about privacy in connection with Microsoft Office products, please visit Microsoft's websites.
Microsoft Trust Center: https://www.microsoft.com/en/trust-center
Data Processing Agreement: https://www.microsoft.com/licensing/docs
Privacy policy: https://www.microsoft.com/en-us/privacy/privacystatement
We have no influence on the collection, processing and use of personal data when clicking on the links (such as the IP address or the URL of the page on which the link is located) and cannot accept any responsibility for this.
Children
The offer to use Microsoft 365 is not intended for children under the age of 16.
Information Disclosure
The transfer of data is made to Microsoft as a processor and to the sub-processors lawfully engaged by Microsoft. If any sub-processors are located outside Hong Kong, Microsoft will ensure that the recipient provides an adequate level of data protection or that appropriate consent has been obtained for the transfer.
Duration Of Storage
Principally, we store your data for as long as this is necessary to enable communication and collaboration via the Microsoft 365 modules used by us for this purpose and the associated services, or for as long as we have a legitimate interest in continuing to store it. Login data and IP addresses are deleted by Microsoft after 180 days at the latest. You can find more information on the Microsoft websites (https://learn.microsoft.com/en-us/compliance/assurance/assurance-data-retention-deletion-and-destruction-overview)
Security
Our employees and the companies providing services on our behalf, are obliged to confidentiality and to compliance with the applicable data protection laws.
We take all necessary technical and organisational measures to ensure an appropriate level of security and to protect your data that are administrated by us especially from the risks of unintended or unlawful destruction, manipulation, loss, change or unauthorised disclosure or unauthorised access. Our security measures are, pursuant to technological progress, constantly being improved.
Data Access And Correction
If you wish to access or correct your personal data, you may do so under the Personal Data (Privacy) Ordinance. Please contact our Nursing Staff during office hours / Data Protection Officer by mail to Union Hospital, 18 Fu Kin Street, Tai Wai, Shatin, New Territories, Hong Kong Special Administrative Region (Marked Confidential) or via email at privacy@union.org.
Changes to the Privacy Policy Statement
We reserve the right to change our security and data protection measures. In such cases, we will amend our data protection notice accordingly. Please, therefore, notice the current version of our data protection notice, as this is subject to changes.
Enquiries
Any enquiries regarding personal data privacy policy and practice, please contact our Data Protection Officer by mail to Union Hospital, 18 Fu Kin Street, Tai Wai, Shatin, New Territories, Hong Kong Special Administrative Region or via email at privacy@union.org (Marked Confidential).
We keep our Privacy Policy Statement of Using Microsoft 365 under regular review. This statement was last updated on 15 Aug 2025.
