Privacy Policy

1. Data Controller

The data controller for personal information collected through this website and our services is:

Hong Kong Huayou Health Consulting Limited
香港華佑健康諮詢有限公司
Trading as China Care Health Tours
Kwai Shing Industrial Building Phase 1
36–40 Tai Lin Pai Road, Kwai Chung
New Territories, Hong Kong
Email: info@chinacarehealthtours.com

This Privacy Policy explains how we collect, use, store, and share your personal data when you use our website or engage our services. It applies to all personal data we process, including health and medical information.

2. What We Collect

We collect personal data in the following categories:

We do not collect data you have not provided or that is not generated through your use of our website or services. We do not purchase data from third-party data brokers.

3. How We Use Your Data

We use your personal data for the following purposes:

• Service delivery: To assess your case, match you to appropriate hospitals, coordinate your medical travel, and communicate with hospitals and physicians on your behalf.
• Communications: To respond to your enquiries, provide updates on your case, and send service-related information.
• Legal and financial administration: To issue invoices, process payments, and comply with our legal obligations under Hong Kong law.
• Website improvement: To understand how visitors use our site and improve its content and usability. This uses anonymised or aggregated data only.
• Safety: To detect and prevent fraud or misuse of our services.

We do not use your health data for advertising, profiling, or any purpose unrelated to your direct case coordination.

4. Grounds for Processing

The Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) does not use a "legal basis" framework in the same way as the GDPR. Under the PDPO, we are required to collect data only for a lawful purpose directly related to our functions, to use data only for the purposes for which it was collected, and to obtain consent where required. We process your data on the following grounds:

• Consent (all personal data): We collect and use your personal data with your knowledge and, where required, your explicit consent. You will be informed of the purposes for which data is collected at the time of collection. For health and medical data specifically, we obtain your explicit consent before any processing or sharing.
• Service performance: Where you have engaged us to provide coordination services, processing your data is necessary to fulfil that service. This is not a separate legal basis under the PDPO but reflects the purpose for which consent is given.
• Legal compliance: Certain processing is necessary to comply with obligations under Hong Kong law, including tax, accounting, and anti-money laundering requirements.

If you are located in the European Economic Area or United Kingdom, the GDPR or UK GDPR applies to our processing of your data. In that context, our legal bases are: performance of a contract (service delivery); explicit consent (health data and analytics cookies); and legal obligation (financial record-keeping). We do not rely on legitimate interests as a basis for processing special category data.

5. Who We Share Your Data With

We share your personal data only where necessary and only with the following categories of recipients:

• Partner hospitals and physicians in China: Medical records and relevant personal information are shared with the specific hospital or physician team you are being referred to, solely for the purpose of your case assessment and treatment. This sharing requires your prior consent.
• Medical translators: Documents may be shared with professional translators engaged by us. All translators are bound by formal data processing agreements that prohibit use of your data for any purpose other than translation, require confidentiality, and impose equivalent data protection obligations to those set out in this Policy.
• Transfer services: Name and contact details may be shared with airport transfer providers where we arrange these on your behalf. We recommend accommodation options but do not book or contract with hotels directly on your behalf.
• Payment processors: Financial data is processed by our payment service providers. We do not store payment card details.
• Legal and regulatory authorities: Where required by law, court order, or regulatory requirement.

We do not sell, rent, or otherwise disclose your personal data to any other third party for their own commercial purposes.

6. International Data Transfers

Because our services involve facilitating treatment in China, your personal and medical data will necessarily be transferred to recipients in mainland China. By engaging our services and providing your data, you consent to this transfer for the purpose of your case coordination.

We take steps to ensure that data shared with hospitals and translators in China is subject to contractual confidentiality obligations and is used solely for the purpose of your case. However, please be aware that data protection laws in mainland China differ from those in Hong Kong, the European Union, the United Kingdom, or other jurisdictions, and may not provide an equivalent level of protection.

For clients located in the European Economic Area or United Kingdom: Transfers of your personal data to mainland China constitute a transfer to a third country without an adequacy decision under the GDPR or UK GDPR. We address this by relying on your explicit consent to the transfer (Article 49(1)(a) GDPR), given the necessity of the transfer to perform the medical coordination services you have requested. Where operationally feasible, we will also seek to put in place Standard Contractual Clauses (EU SCCs or UK IDTA as applicable) with our Chinese partners. If you wish to understand the specific safeguards in place for your transfer, please contact us before providing any personal data.

7. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with our legal obligations:

• Active client data: Retained for the duration of our engagement and for seven years after the conclusion of services.
• Medical records: Retained for seven years after the conclusion of services, or longer if required by applicable regulations.
• Enquiry and communications data: For prospective clients who do not proceed to engagement, retained for 12 months from last contact, then deleted.
• Financial records: Retained for seven years in accordance with Hong Kong tax and accounting requirements.
• Website analytics: Retained in anonymised form. Identifiable usage data is not retained beyond 26 months.

You may request earlier deletion of your data: see Section 8 below.

8. Your Rights

Rights under the Hong Kong PDPO (all clients)

The PDPO confers the following statutory rights on data subjects:

• Right of access (Data Access Request): To request a copy of the personal data we hold about you. We will respond within 40 days as required by the Ordinance.
• Right of correction (Data Correction Request): To request correction of inaccurate or incomplete personal data. We will respond within 40 days.

To submit a Data Access or Data Correction Request, contact us at info@chinacarehealthtours.com. We may need to verify your identity before processing your request.

Voluntary commitments (all clients)

• Withdrawal of consent: You may withdraw consent to our processing of your personal data at any time by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may affect our ability to continue providing services.
• Deletion: You may request deletion of your personal data. We will comply where we are not required to retain records by law.

Additional rights for EEA and UK clients (GDPR / UK GDPR)

If you are located in the European Economic Area or United Kingdom, you have additional statutory rights including: the right to erasure; the right to restrict processing; the right to data portability; and the right to object to processing. We will honour these rights on request.

EEA clients may also lodge a complaint with their local supervisory authority. UK clients may contact the Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encrypted transmission of data in transit (TLS/HTTPS)
• Password-protected storage for client files and medical records
• Restricted access: only personnel directly involved in your case can access your data
• Secure deletion of data at the end of the retention period

No data transmission over the internet or electronic storage system is completely secure. While we take all reasonable precautions, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

10. Cookies and Website Analytics

Our website uses cookies and similar technologies. We operate two categories of cookies:

• Essential cookies: Strictly necessary for the website to function (e.g. security tokens, session management). These are placed without consent as they are required for the service to operate.
• Analytics cookies: Used to understand how visitors use our site (e.g. Google Analytics with IP anonymisation enabled). These are non-essential and are placed only with your consent where required by applicable law.

We do not use advertising, retargeting, or cross-site tracking cookies.

For visitors from the EEA and UK: Under the GDPR, UK GDPR, and the ePrivacy Directive, we are required to obtain your prior consent before placing non-essential cookies. If you are visiting from the EEA or UK, a cookie consent notice will be presented to you on your first visit. You may withdraw consent at any time by clearing your cookies and declining when the notice reappears, or by adjusting your browser settings.

11. Children

Our services are primarily directed at adult patients and their adult family members or carers. We do not knowingly collect personal data directly from children under the age of 18 without the consent of a parent or legal guardian.

If you are contacting us on behalf of a child patient, you confirm that you have parental or legal guardian authority to provide their personal and medical data to us.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. The updated version will be published on this page with a revised "Last updated" date.

For material changes that affect how we process your data, we will notify active clients by email. We encourage you to review this policy periodically.

13. Contact

For any questions, requests, or concerns relating to this Privacy Policy or how we handle your personal data, please contact us:

• Email: info@chinacarehealthtours.com
• WhatsApp: +853 6617 6512
• Registered entity: Hong Kong Huayou Health Consulting Limited (香港華佑健康諮詢有限公司), CR No. 80227624
• Registered address: Kwai Shing Industrial Building Phase 1, 36–40 Tai Lin Pai Road, Kwai Chung, New Territories, Hong Kong
• HK supervisory authority: Office of the Privacy Commissioner for Personal Data, Hong Kong
• UK supervisory authority: Information Commissioner's Office (ICO)