PDPA Policy

The purpose of this document (“Data Protection Policy”) is to inform you of how Asian Healthcare Specialists Limited and its related subsidiaries (collectively, the “AHS”) manages Personal Data (as defined below) which is subject to the Singapore Personal Data Protection Act (No. 26 of 2012) (“the Act”). Please take a moment to read this Data Privacy Policy so that you know and understand the purpose for which we collect, use and disclose your personal data. By interacting with us, submitting information to us, or consenting for any products and services offered by us, you agree and consent to AHS, as well as its representatives and/or agents collecting, using, disclosing and sharing amongst themselves your Personal Data, and disclosing such Personal Data to the authorised service providers and relevant third parties in the manner set forth in this Data Privacy Policy. AHS may from time to time update this Data Privacy Policy to ensure that this Data Privacy Policy is consistent with our future developments, industry trends and/or any changes in the legal or regulatory requirements. Please check back regularly for updated information on the handling of your personal data. This Data Privacy Policy was first published on 20th March 2018. PERSONAL DATA

1. In this Data Privacy Policy, “Personal Data” refers to any data, whether true or not, about an individual who can be identified (a) from that data; or (b) from that data and other information to which we have or are likely to have access, including data in our records as may be updated from time to time.
2. Examples of such Personal Data you may provide to us include (depending on the nature of your interaction with us your name, NRIC, passport or other identification number, telephone number(s), mailing address, email address or any other information relating to any individuals which you have provided us in any forms you may have submitted to us, or via other forms of interaction with you.

COLLECTION OF PERSONAL DATA

1. We generally do not collect your personal data unless (a) it is provided to us voluntarily by you directly or via a third party who has been duly authorised by you to disclose your personal data to us (your “authorised representative”) after (i) you (or your authorised representative) have been notified of the purposes for which the data is collected, and (ii) you (or your authorised representative) have provided written consent to the collection and usage of your personal data for those purposes, or (b) collection and use of personal data without consent is permitted or required by the PDPA or other laws. We shall seek your consent before collecting any additional personal data and before using your personal data for a purpose which has not been notified to you (except where permitted or authorised by law).
2. Generally, we collect Personal Data in the following ways:
   1. When you submit any form, including but not limited to the patient data registration form or other forms relating to any of our services;
   2. When you interact with our staff, for example, via telephone calls, letters, fax, face-to-face meetings, social media platforms, and emails;
   3. When you interact with us via our website or use services on our websites;
   4. When you request that we contact you or request that you can be included in an email or other mailing list;
   5. When you submit an employment application or when you provide documents or information including your resume and/or CVs in connection with any appointment as an employee of AHS;
   6. When your images are captured by us via CCTV cameras while you are in our premises, or via photographs or videos taken by us or our representatives when you attend our events;
   7. When you submit your Personal Data to us for any other reasons.
3. If you provide us with any Personal Data relating to a third party (e.g. information of your spouse, children, parents, and/or employees), by submitting such information to us, you represent to us that you have obtained the consent of the third party to provide us with their Personal Data for the respective purposes.
4. You should ensure that all Personal Data submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in our inability to provide you with the products and services you have requested, or delays in providing you with products and services that you have requested, or processing your applications.

PURPOSE FOR THE COLLECTION, USE AND DISCLOSURE OF YOUR PERSONAL DATA – PATIENTS

1. We may collect and use your personal data for any or all of the following purposes:
   1. Performing obligations in the course of or in connection with our provision of the goods and/or services requested by you;
   2. Verifying your identity;
   3. Responding to, handling and processing queries, requests, applications, complaints and feedback from you;
   4. Managing your relationship with us;
   5. Processing payment or credit transaction;
   6. Complying with any applicable laws, regulations, codes of practice, guidelines or rules, or to assist in law enforcement and investigations by any governmental and/or regulatory authority;
   7. Any other purposes for which you have provided the information;
   8. Transmitting to any unaffiliated third parties including our third party service providers and agents, and relevant governmental and/or regulatory authorities, whether in Singapore or abroad, for the aforementioned purposes and;
   9. Any other incidental business purposes related to or in connection with the above.
2. We may disclose your personal data:
   1. Where such disclosure is required for performing obligations in the course of or in connection with our provision of the goods or services requested by you or;
   2. To third party service providers, agents and other organisations we have engaged to perform any of the functions listed in Clause 1 above for us.
3. The purposes listed in the above clauses may continue to apply even in situations where your relationship with AHS has been terminated or altered in any way, for a reasonable period thereafter (including, where applicable, a period to enable us to enforce our rights under any contract with you).

PURPOSE FOR THE COLLECTION, USE AND DISCLOSURE OF YOUR PERSONAL DATA – EMPLOYMENT

1. If you are a job applicant, your personal data will be collected and used by us for the following purposes and we may disclose your personal data to third parties where necessary for the following purposes:
   1. Performing obligations under or in connection with your contract of employment with us, including payment of remuneration and tax;
   2. All administrative and human resources related matters within our organization, including administering payroll, granting access to our premises and our computer systems, processing leave applications, administering your insurance and other benefits, processing your claims and expenses, investigating any acts or defaults (or suspected acts or defaults) and developing human resource policies;
   3. Managing and terminating our employment relationship with you, including monitoring your internet access and your use of our intranet email to investigate potential contraventions of our internal or external compliance regulations, and resolving any employment related grievances;
   4. Assessing and evaluating your suitability for employment / appointment or continued employment / appointment in any position within our organization;
   5. Ensuring business continuity for our organization in the event that your employment with us is or will be terminated;
   6. Performing obligations under or in connection with the provision of our goods or services to our clients;
   7. Facilitating any proposed or confirmed merger, acquisition or business asset transaction involving any part of our organization, or corporate restructuring process; and;
   8. Facilitating our compliance with any laws, customs and regulations which may be applicable to us.
2. If you are an employee, personal data which we may collect in the context of your employment with us includes, without limitation, your:
   1. Name or alias, gender, NRIC/FIN or passport number, date of birth, nationality and country and city of birth;
   2. Mailing address, telephone numbers, email address and other contact details;
   3. Employment and training history;
   4. Salary information and bank account details;
   5. Details of your next-of-kin, spouse and other family members;
   6. Work-related health issues and disabilities;
   7. Records on leave of absence from work;
   8. Photographs and other audio-visual information;
   9. Performance assessments and disciplinary records; and
   10. Any additional information provided to us by you as a job applicant (that is, prior to being engaged as an employee).\We may process your personal data, including any additional information you may subsequently provide to us, for the purposes of the contract of service or contract for service or such other contract as may have been entered into between you and us or for the purpose of your employment.
3. In addition to the above, the personal data and the other information collected from you, including any information that you subsequently provide may be used and processed by us for the following reasons:
   1. processing employment applications including pre-employment checks;
   2. determining and reviewing salaries, incentives, bonuses and other benefits;
   3. consideration for promotion, career development, training, secondment or transfer, performance monitoring, health and safety administration and security and access control;
   4. monitoring compliance with our internal rules and policies and adherence to our Business Conduct Guidelines;
   5. complying with the compliance and disclosure requirements of any and all governmental and/or quasi-governmental departments and/or agencies, regulatory and/or statutory bodies (e.g. Ministry of Health, Singapore Medical Council, Singapore Nursing Board, Inland Revenue Association of Singapore and Central Provident Fund Board);
   6. to enforce our rights under employment law or any other applicable laws to defend our rights under the law including but not limited to any disciplinary action or actions relating to the termination of employment; and purposes relating thereto.
4. Employees and potential employees ought to be aware that failure to supply such data will result in us being unable to process employment applications, or affect our ability to perform our obligations under any potential or existing employment contract and/or your ability to enjoy the benefits of your employment with us.
5. If an application for employment is successful, data about employees (including sensitive personal data) may also be collected from employees during the period of their employment with us and from other sources such as third party background checks, any registered credit reporting agency, any regulatory authorities and any authority, central depository or depository agent in relation to the securities industry.
6. Data held by us relating to employees and potential employees will be kept confidential but we may provide such information to the following parties, for the purposes as set out in paragraph 4 above (which parties may also subsequently process, transfer and disclose such data for the purposes set out in paragraph 4):-
   1. any agent, contractor, service provider, any professional adviser or third party who provides administrative, telecommunications, human resources management or administrative services (including but not limited to performance of pre-employment or background checks, payroll administration, safety and provision or administration of benefits entitled to by employees) or any other service to the Infineon Group;
   2. any other person under a duty of confidentiality to us which has undertaken to keep such information confidential;
   3. persons seeking employee references in respect of employees;
   4. any person to whom we are under an obligation to make disclosure under the requirements of any law binding on the Infineon Group or under and the purposes of any guidelines or regulations issued by regulatory or other authorities with which the Infineon Group are expected to comply;
   5. any court and/or officer of the court;
   6. any healthcare professional or hospital;
   7. our auditors;
   8. our lawyers and compliance professionals;
   9. our banks; and
   10. our service providers and vendors.

RETENTION OF PERSONAL DATA

1. AHS will retain such Personal Data as may be required for business or legal purposes, and such purposes do vary according to the circumstances.
2. Whilst AHS will securely dispose of or anonymous Personal Data which it can reasonably determine is no longer needed and does not generally hold on to Personal Data “just in case”. It is in the interest of any medical specialist treating the patient to be able to refer to a complete set of medical records to avoid risks to health and safety of the patient.
3. As such that, with respect to the medical records of patients, unless specific contrary instructions from the patient; AHS will retain such medical records of the patient for as long as; even where a follow-up consultation may not occur after a substantial period of time.

ACCESS TO AND CORRECTION OF PERSONAL DATA

1. If you wish to make (a) an access request for access to a copy of the personal data which we hold about you or information about the ways in which we disclose your personal data or (b) a correction request to correct or update any of your personal data which we hold about you, you may submit your request in writing or via email to our Data Protection Officer at the contact details provided below.
2. Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.
3. We will respond to your request as soon as reasonably possible. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. If we are unable to provide you with any personal data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the PDPA).

WITHDRAWING YOUR CONSENT

1. The consent that you provide for the collection, use and disclosure of your personal data will remain valid until such time it is being withdrawn by you in writing. You may withdraw consent and request us to stop using and/or disclosing your personal data for any or all of the purposes listed above by submitting your request in writing or via email to our Data Protection Officer at the contact details provided below.
   

   Name of Data Protection Officer: Email Address: Address:

   Dr Tan Chyn Hong tanchynhong@toc.com.sg 38 Irrawaddy Road Mount Elizabeth Novena Specialist Centre #09-42 Singapore 329563

2. Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us. In general, we shall seek to process your request within ten (10) business days of receiving it.
3. While we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, we may not be in position to continue providing our goods or services to you and we shall, in such circumstances, notify you before completing the processing of your request. Should you decide to cancel your withdrawal of consent, please inform us in writing in the manner described in clause 4 above.
4. Please note that withdrawing consent does not affect our right to continue to collect, use and disclose where such collection, use and disclose without consent is permitted or required under applicable laws.