SkinHealth.Clinic

隱私權

隱私權政策

最後更新：2026 年 11 月 5 日

本中文譯本僅供參考；如中英文版本有任何不一致，以英文版本為準。

關於我們

SkinHealth.Clinic 是皮膚科主治醫師 Dr Ting Seng Tang（GMC 7020502）的自費皮膚科診所。依英國資料保護法規（UK GDPR 及《2018 年資料保護法》），Dr Ting Seng Tang 為透過本網站及 SkinHealth.Clinic 病患應用程式所蒐集資料的資料控管者。如有隱私權相關問題，請寄電子郵件至 info@skinhealth.clinic。

本網站

本網站不使用廣告或追蹤 Cookie，也不需要您登入。我們使用重視隱私、不使用 Cookie 的流量統計（Cloudflare Web Analytics），只計算頁面瀏覽次數，不會識別您的身分。本網站由 Cloudflare 代管，Cloudflare 會處理 IP 位址等基本技術資料，以安全地提供網頁。

當您聯絡我們或預約時

  • 電子郵件：如果您寄電子郵件給我們，我們會使用您的訊息及聯絡資料回覆您，並於需要時安排您的診療。
  • 視訊看診透過 TidyCal 預約；實體門診直接向 Spire Nottingham 或 Nottingham Road Clinic 預約。上述機構會依各自的隱私權政策處理您提供的資料。

痣與皮疹照片評估及病患應用程式

當您使用 SkinHealth.Clinic 病患應用程式時，我們會蒐集為您提供診療所需的資料：姓名及聯絡資料、出生日期、病史及臨床問題的回答、皮膚照片，以及看診紀錄和任何處方或信函。付款由 Stripe 處理，我們不會儲存您的信用卡資料。

我們處理這些健康資料是為了提供醫療服務（UK GDPR 第 6(1)(b) 條契約履行，及第 9(2)(h) 條醫療照護）。病患資料安全地儲存在英國（Google Cloud 倫敦區域），在傳輸及儲存時皆經過加密，僅供參與您診療的醫療人員及工作人員存取。

我們只會在診療需要或法律要求時分享資料，例如：經您同意後告知您的家庭醫師（GP）、為您調劑處方的藥局，或在您使用保險時告知您的保險公司。

資料保存期限

醫療紀錄依英國健康紀錄保存的專業指引保存。成人紀錄一般於最後一次就診後保存 8 年；兒童紀錄保存至其 25 歲生日（如結束治療時為 17 歲，則保存至 26 歲生日），或於臨床需要時保存更久。

您的權利

您有權查閱我們所持有的您的資料、要求我們更正，並在某些情況下要求我們刪除或限制使用，或反對我們使用這些資料。如需提出請求，請寄電子郵件至 info@skinhealth.clinic。我們會在一個月內回覆。

如果您對我們處理您資料的方式不滿意，請先與我們聯絡。您也可以向英國資訊專員辦公室（ICO）申訴：ico.org.uk，或致電 0303 123 1113。

Patient portal（病患入口網站）

以下「Patient portal」說明僅提供英文原文，不做機器翻譯；如有疑問請以英文為準，或寄信至 kyle@skinhealth.clinic。The following patient-portal notice is provided in English only (no machine translation of this clinical/legal text).

This section explains how we use your information in our online patient portal. It is about the portal only and sits alongside the rest of this privacy policy.

Controller: SkinHealth Clinic, a trading name of Mustard Seed Global Ltd, run by Dr Ting Seng Tang, Consultant Dermatologist. Address: 195 Nottingham Road, Mansfield, Nottinghamshire NG18 4AA. Telephone: 0115 871 2055. ICO registration number: ZA790747. Data protection officer: Dr Ting Seng Tang, kyle@skinhealth.clinic, telephone 0115 871 2055.

What the portal is

The portal is a private website where you can: read letters and other documents we have released to you; send us photos, test results or a message; and see receipts for payments you have made to us.

The portal is only for patients of our private clinics (Spire Nottingham and Nottingham Road Clinic). Letters from NHS clinics, including Queen’s Medical Centre (QMC), are never put on the portal.

What information we use

  • Your name, date of birth and email address (to check it is you and to send you emails).
  • The letters and documents we release to you (these are about your health).
  • Photos, test results and messages you send us through the portal.
  • Payment receipts.
  • A record of when you sign in, what you open, and what we send to you. We keep this to keep the portal safe and to show who did what.
  • We do not put your name or any health details in the emails we send about the portal.

Why we are allowed to use it

  • Providing the portal as part of your private care: this is needed for the agreement between you and the clinic (UK GDPR Article 6(1)(b)).
  • Health information: we use it to provide and manage your health care (Article 9(2)(h) and Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018). It is handled by, or under the responsibility of, a doctor who is bound by a duty of confidentiality.
  • Emails from the portal: we only send these if you agree. See “Emails: only if you opt in” below.

What you can see and when

A letter to you is released to the portal about 24 hours after the doctor publishes it. The doctor can hold a letter back or take it down.

You will not be able to see a letter on the portal 3 months after it was released. It stays safely in your clinical record at the clinic. If you need it again, please ask us.

Emails: only if you opt in

We will only email you about the portal if you have told us you want that, and we have recorded it. Until then we send nothing.

If you opt in, we may send: a sign-in link (it works for 14 days); and a message saying there is a new document, or a reply to your message, waiting for you.

These emails never contain your health information or your name, and the “new document” email does not contain a sign-in link. They link to the portal page, where you can ask for a new sign-in link.

To opt in: ask the clinic. We record who recorded your agreement and when. Your agreement is for the email address you gave us. If your email address changes, we stop sending portal emails until you have agreed again for the new address.

To stop emails: tell the clinic by email or phone at any time. You can also opt out of the portal altogether. We will record this and stop straight away. Stopping does not affect your care.

Who else handles your information

We use these companies to run the portal. They act on our instructions.

Google (Firebase and Google Cloud): hosts the portal, stores the data and runs the programs. Your data is stored in Europe: the database, the portal website and the programs run in London (europe-west2).

Email service (the Firebase Trigger Email extension and its email provider): sends the emails. The part that sends the emails runs in the United States (us-central1), so your email address and the content of the email are processed there. The email content does not include your name or any health details; it contains a link to the portal page, and the sign-in email contains your personal sign-in link. We use approved safeguards for this transfer.

We do not sell your information. We do not use it for advertising.

How long we keep portal information

  • Letters on the portal: a letter is hidden from the portal 3 months after it was released. It is only hidden: the letter itself stays in your clinical record at the clinic and is not deleted.
  • Messages on the portal: a conversation is hidden from you 3 months after its last message. Our system then deletes it, once the clinic has switched that deletion on, unless the doctor saved it to your record because it is part of your care (a conversation saved to your record is hidden from you but not deleted).
  • Portal emails: copies of the portal emails in our email queue are set to expire and be removed 3 months after they are queued.
  • Your clinical record: letters, photos and documents you send us are part of your medical record. We keep these in line with the NHS Records Management Code of Practice: for adults, 8 years after your last treatment; for children, until their 25th birthday (or their 26th birthday if they were 17 at the end of treatment). This is separate from the portal.
  • Sign-in links and sessions: expire automatically (links after 14 days; a signed-in session after 30 minutes of inactivity, and at most 4 hours).

Keeping the portal secure

To sign in you need the emailed link and your date of birth. A date of birth is not secret, so please keep your link private and do not forward it. After several wrong dates of birth the link is paused. If you think someone else has your link, tell us and we will cancel it.

Your rights for the portal

You can ask us to: show you the information we hold about you; correct anything that is wrong; in some cases, delete or limit how we use it (medical records often have to be kept); stop using it for the portal, and stop portal emails (opt out); or move it to someone else in some cases.

To use your rights, email kyle@skinhealth.clinic. We will normally reply within one month.

Please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO): www.ico.org.uk, telephone 0303 123 1113.

政策更新

我們可能會不定期更新本政策。頁面上方的日期為最後更新時間。