Privacy and Data Processing Instructions

Only collect the information required for consultation

The form receives your name, contact information, and the intended hospital, insurance brand, product name and brief requirements that you voluntarily fill in for processing the consultation. Please do not fill in your ID number, complete insurance policy or detailed medical records in the form; the website does not have a portal for uploading patient medical records.

Online inquiries are not yet enabled. Consultation data is not collected or automatically sent to Gmail or hospitals.

Manual verification and follow-up information communication

The staff will communicate and consult according to the contact purpose you agreed to. If medical records are needed later, we will first explain to you the necessary information, purpose, specific recipient and delivery method, and determine the basis for corresponding processing. Contact consent does not mean that you have consented to all processing or cross-border transfers of your health information.

The Gmail / Google Workspace interface has been reserved, and the recipient address or authorization has not been configured; online patient email processing is not currently connected.

Website security and remaining configuration

正式网站采用 HTTPS 加密传输。正式上线前需完成 HTTPS、邮箱双重验证、工作人员访问权限及敏感附件传递保护，并核查供应商的数据处理条款。普通邮件不应默认视为端到端加密。

Storage, deletion and patient rights

Before the official launch, the retention period, deletion process and privacy contact email for various types of data will be determined, and the application methods for applicable rights such as access, correction, deletion and withdrawal of consent will be announced. Currently, test messages can be deleted locally by the project administrator on demand. Please only use test messages.

Cross-border data and applicable regulations

When providing data to European patients and Chinese hospitals, you need to check the applicable scope of GDPR, health data processing conditions and cross-border transmission mechanisms based on actual business, as well as other applicable data protection requirements. The location of the server or mailbox cannot alone determine a compliance conclusion.