SkinHealth.Clinic

隐私权

隐私权政策

最后更新：2026 年 11 月 5 日

本中文译本仅供参考；如中英文版本有任何不一致，以英文版本为准。

关于我们

SkinHealth.Clinic 是皮肤科主治医师 Dr Ting Seng Tang（GMC 7020502）的自费皮肤科诊所。依英国资料保护法规（UK GDPR 及《2018 年资料保护法》），Dr Ting Seng Tang 为透过本网站及 SkinHealth.Clinic 病患应用程式所搜集资料的资料控管者。如有隐私权相关问题，请寄电子邮件至 info@skinhealth.clinic。

本网站

本网站不使用广告或追踪 Cookie，也不需要您登入。我们使用重视隐私、不使用 Cookie 的流量统计（Cloudflare Web Analytics），只计算页面浏览次数，不会识别您的身分。本网站由 Cloudflare 代管，Cloudflare 会处理 IP 位址等基本技术资料，以安全地提供网页。

当您联络我们或预约时

  • 电子邮件：如果您寄电子邮件给我们，我们会使用您的讯息及联络资料回复您，并于需要时安排您的诊疗。
  • 视讯看诊透过 TidyCal 预约；实体门诊直接向 Spire Nottingham 或 Nottingham Road Clinic 预约。上述机构会依各自的隐私权政策处理您提供的资料。

痣与皮疹照片评估及病患应用程式

当您使用 SkinHealth.Clinic 病患应用程式时，我们会搜集为您提供诊疗所需的资料：姓名及联络资料、出生日期、病史及临床问题的回答、皮肤照片，以及看诊纪录和任何处方或信函。付款由 Stripe 处理，我们不会储存您的信用卡资料。

我们处理这些健康资料是为了提供医疗服务（UK GDPR 第 6(1)(b) 条契约履行，及第 9(2)(h) 条医疗照护）。病患资料安全地储存在英国（Google Cloud 伦敦区域），在传输及储存时皆经过加密，仅供参与您诊疗的医疗人员及工作人员存取。

我们只会在诊疗需要或法律要求时分享资料，例如：经您同意后告知您的家庭医师（GP）、为您调剂处方的药局，或在您使用保险时告知您的保险公司。

资料保存期限

医疗纪录依英国健康纪录保存的专业指引保存。成人纪录一般于最后一次就诊后保存 8 年；儿童纪录保存至其 25 岁生日（如结束治疗时为 17 岁，则保存至 26 岁生日），或于临床需要时保存更久。

您的权利

您有权查阅我们所持有的您的资料、要求我们更正，并在某些情况下要求我们删除或限制使用，或反对我们使用这些资料。如需提出请求，请寄电子邮件至 info@skinhealth.clinic。我们会在一个月内回复。

如果您对我们处理您资料的方式不满意，请先与我们联络。您也可以向英国资讯专员办公室（ICO）申诉：ico.org.uk，或致电 0303 123 1113。

Patient portal（病患入口网站）

以下「Patient portal」说明仅提供英文原文，不做机器翻译；如有疑问请以英文为准，或寄信至 kyle@skinhealth.clinic。The following patient-portal notice is provided in English only (no machine translation of this clinical/legal text).

This section explains how we use your information in our online patient portal. It is about the portal only and sits alongside the rest of this privacy policy.

Controller: SkinHealth Clinic, a trading name of Mustard Seed Global Ltd, run by Dr Ting Seng Tang, Consultant Dermatologist. Address: 195 Nottingham Road, Mansfield, Nottinghamshire NG18 4AA. Telephone: 0115 871 2055. ICO registration number: ZA790747. Data protection officer: Dr Ting Seng Tang, kyle@skinhealth.clinic, telephone 0115 871 2055.

What the portal is

The portal is a private website where you can: read letters and other documents we have released to you; send us photos, test results or a message; and see receipts for payments you have made to us.

The portal is only for patients of our private clinics (Spire Nottingham and Nottingham Road Clinic). Letters from NHS clinics, including Queen’s Medical Centre (QMC), are never put on the portal.

What information we use

  • Your name, date of birth and email address (to check it is you and to send you emails).
  • The letters and documents we release to you (these are about your health).
  • Photos, test results and messages you send us through the portal.
  • Payment receipts.
  • A record of when you sign in, what you open, and what we send to you. We keep this to keep the portal safe and to show who did what.
  • We do not put your name or any health details in the emails we send about the portal.

Why we are allowed to use it

  • Providing the portal as part of your private care: this is needed for the agreement between you and the clinic (UK GDPR Article 6(1)(b)).
  • Health information: we use it to provide and manage your health care (Article 9(2)(h) and Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018). It is handled by, or under the responsibility of, a doctor who is bound by a duty of confidentiality.
  • Emails from the portal: we only send these if you agree. See “Emails: only if you opt in” below.

What you can see and when

A letter to you is released to the portal about 24 hours after the doctor publishes it. The doctor can hold a letter back or take it down.

You will not be able to see a letter on the portal 3 months after it was released. It stays safely in your clinical record at the clinic. If you need it again, please ask us.

Emails: only if you opt in

We will only email you about the portal if you have told us you want that, and we have recorded it. Until then we send nothing.

If you opt in, we may send: a sign-in link (it works for 14 days); and a message saying there is a new document, or a reply to your message, waiting for you.

These emails never contain your health information or your name, and the “new document” email does not contain a sign-in link. They link to the portal page, where you can ask for a new sign-in link.

To opt in: ask the clinic. We record who recorded your agreement and when. Your agreement is for the email address you gave us. If your email address changes, we stop sending portal emails until you have agreed again for the new address.

To stop emails: tell the clinic by email or phone at any time. You can also opt out of the portal altogether. We will record this and stop straight away. Stopping does not affect your care.

Who else handles your information

We use these companies to run the portal. They act on our instructions.

Google (Firebase and Google Cloud): hosts the portal, stores the data and runs the programs. Your data is stored in Europe: the database, the portal website and the programs run in London (europe-west2).

Email service (the Firebase Trigger Email extension and its email provider): sends the emails. The part that sends the emails runs in the United States (us-central1), so your email address and the content of the email are processed there. The email content does not include your name or any health details; it contains a link to the portal page, and the sign-in email contains your personal sign-in link. We use approved safeguards for this transfer.

We do not sell your information. We do not use it for advertising.

How long we keep portal information

  • Letters on the portal: a letter is hidden from the portal 3 months after it was released. It is only hidden: the letter itself stays in your clinical record at the clinic and is not deleted.
  • Messages on the portal: a conversation is hidden from you 3 months after its last message. Our system then deletes it, once the clinic has switched that deletion on, unless the doctor saved it to your record because it is part of your care (a conversation saved to your record is hidden from you but not deleted).
  • Portal emails: copies of the portal emails in our email queue are set to expire and be removed 3 months after they are queued.
  • Your clinical record: letters, photos and documents you send us are part of your medical record. We keep these in line with the NHS Records Management Code of Practice: for adults, 8 years after your last treatment; for children, until their 25th birthday (or their 26th birthday if they were 17 at the end of treatment). This is separate from the portal.
  • Sign-in links and sessions: expire automatically (links after 14 days; a signed-in session after 30 minutes of inactivity, and at most 4 hours).

Keeping the portal secure

To sign in you need the emailed link and your date of birth. A date of birth is not secret, so please keep your link private and do not forward it. After several wrong dates of birth the link is paused. If you think someone else has your link, tell us and we will cancel it.

Your rights for the portal

You can ask us to: show you the information we hold about you; correct anything that is wrong; in some cases, delete or limit how we use it (medical records often have to be kept); stop using it for the portal, and stop portal emails (opt out); or move it to someone else in some cases.

To use your rights, email kyle@skinhealth.clinic. We will normally reply within one month.

Please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO): www.ico.org.uk, telephone 0303 123 1113.

政策更新

我们可能会不定期更新本政策。页面上方的日期为最后更新时间。