Privacy Policy.

Ming Chun Tang TCM Clinic ("the Clinic", "we", "us", or "our") provides Traditional Chinese Medicine ("TCM") services, including acupuncture treatment and the dispensing of herbal medication, to patients in Singapore. We are committed to protecting your personal data in accordance with the Personal Data Protection Act 2012 (the "PDPA"), the Healthcare Services Act 2020, and other applicable guidelines issued by the Ministry of Health ("MOH") and the Personal Data Protection Commission ("PDPC").

This Privacy Policy explains what personal data we collect, why we collect it, how we use, disclose, and protect it, and what rights you have regarding your data. It applies to all patients, prospective patients, and visitors to our clinic and our website.

1. Personal Data We Collect

Depending on your interaction with us, we may collect the following categories of personal data:

  • Contact and identification data: full name, NRIC/FIN (or passport number for foreign patients), date of birth, gender, phone number, and email address.

  • Health and treatment data: medical history, presenting symptoms, TCM diagnosis (e.g. pattern differentiation), treatment records (acupuncture points and techniques used), herbal prescriptions dispensed, allergies, and progress notes.

  • Payment data: billing information and payment records (e.g. payment method used, transaction amounts, and receipts). We do not store full credit/debit card numbers; these are processed directly by our payment service providers.

  • Appointment data: booking history, attendance records, and appointment reminders sent via SMS, email, or messaging apps.

  • Other data you voluntarily provide: feedback, complaints, or enquiries submitted to us.

Health and treatment data is treated by the Clinic as sensitive personal data and is subject to stricter internal access controls than ordinary contact information.

2. How We Collect Your Personal Data

We typically collect personal data when you:

  • Register as a patient or complete an intake/registration form at our clinic;

  • Book an appointment in person, by phone, or through our website/booking system;

  • Undergo consultation, acupuncture treatment, or are dispensed herbal medication;

  • Make payment for our services;

  • Contact us with an enquiry, feedback, or complaint; or

  • Visit our website (e.g. through cookies, if applicable).

3. Purposes for Which We Use Your Personal Data

We collect, use, and disclose your personal data for the following purposes:

  • Providing TCM consultation, acupuncture treatment, and dispensing herbal medication appropriate to your condition;

  • Maintaining accurate patient and treatment records for continuity of care;

  • Scheduling, confirming, and reminding you of appointments;

  • Processing payments, billing, and issuing receipts;

  • Responding to your enquiries, feedback, or complaints;

  • Complying with our legal and regulatory obligations, including those under the Healthcare Services Act and MOH guidelines, and retaining records for the legally required period;

  • With your separate consent, sending you appointment reminders, health tips, or promotional information about our services; and

  • Improving our clinic operations and service quality (using anonymised or aggregated data where possible).

Where we intend to use your personal data for a new purpose not listed above, we will seek your consent beforehand, unless an exception under the PDPA applies (for example, where use is necessary for your medical treatment in an emergency).

4. Consent

By registering as a patient and providing your personal data to us, you consent to our collection, use, and disclosure of your personal data for the purposes set out in this Policy. Where required, we will obtain your explicit consent separately — for example, before using your data for marketing purposes, or before referring you to another healthcare provider for purposes not directly related to your treatment at our Clinic.

You may withdraw your consent for any purpose (other than data required for your ongoing treatment, billing, or our legal obligations) at any time by contacting our Data Protection Officer using the details in Section 10. We will inform you of the likely consequences of withdrawal, which may include our being unable to continue providing certain services to you. Withdrawal of consent does not affect the lawfulness of any processing carried out before your withdrawal.

5. Disclosure of Personal Data

We do not sell your personal data. We may disclose your personal data to the following parties, only as necessary for the purposes set out in Section 3:

  • Other healthcare providers (e.g. specialists, hospitals, or laboratories), where referral or shared care is necessary for your treatment and you have consented to such referral;

  • Our staff and practitioners directly involved in your care, on a need-to-know basis;

  • Third-party service providers who support our operations, such as clinic management software providers, payment processors, and SMS/email reminder services, who are contractually bound to protect your data;

  • Government authorities and regulators (such as MOH or the PDPC), where required by law or in response to a lawful request; and

  • Your authorised representative, next-of-kin, or family member, only where you have given written consent or explicit authorisation, or where disclosure is permitted under the PDPA's exceptions (e.g. to respond to an emergency that threatens your life, health, or safety).

We do not disclose your medical information to family members, employers, or any other third party without your explicit consent, except where permitted or required by law.

6. NRIC and National Identification Numbers

We collect your full NRIC/FIN number where required for registration, MediSave/CHAS claims processing (if applicable), Healthy.sg, or other legal or regulatory purposes. Where full NRIC is not required for day-to-day identification, we use only the last four characters together with your name. We do not display your full NRIC on screens or documents visible to other patients or staff who do not need it for their role.

7. Data Protection and Security

We implement reasonable security arrangements to protect your personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks. These measures include:

  • Restricting access to patient records to staff and practitioners directly involved in your care;

  • Storing physical records in locked cabinets and electronic records in access-controlled systems;

  • Using secure, password-protected systems for clinic management and billing;

  • Training staff on their data protection obligations under the PDPA; and

  • Reviewing and updating our security practices periodically.

No method of transmission or storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

8. Retention of Personal Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. In line with MOH guidelines and professional standards for medical records, we generally retain patient treatment records for at least six (6) years from the date of last treatment, or longer where required by law or where the records relate to a minor or an ongoing matter. Once personal data is no longer needed and no legal retention requirement applies, we will securely dispose of or anonymise it.

9. Access and Correction

You have the right to:

  • Request access to the personal data we hold about you, including your treatment records;

  • Request correction of any personal data that is inaccurate or incomplete; and

  • Be informed of how your personal data has been or may have been used or disclosed within the past year.

We will respond to access and correction requests within a reasonable time. We may decline certain requests where permitted under the PDPA (for example, where disclosure could be harmful to your safety or wellbeing, or would reveal personal data about another individual). A reasonable fee may apply for processing access requests, of which we will inform you in advance.

10. Data Protection Officer and Contact Information

If you have any questions, feedback, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer:

  • Clinic Name: Ming Chun Tang TCM Clinic

  • Data Protection Officer: Ho Ming Gen

  • Email: minggen@mingchuntang.sg

  • Phone: +65 6282 6306

  • Address: 28 Serangoon North Ave 1 #01-63 S554341

If you have concerns that are not resolved to your satisfaction, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The updated version will be made available at our clinic and/or on our website, with the "Last updated" date revised accordingly. We encourage you to review this Policy periodically.