Healthcare Case Management Services

HCMS Privacy Policy

Effective date: 16 October 2026

Contents

1. About This Policy
2. Personal Data We Collect
3. Is Providing Personal Data Obligatory?
4. How We Use Personal Data
5. Who We Share Personal Data With
6. Direct Marketing
7. Healthcare Professionals and Providers
8. Transfer of Personal Data Outside Hong Kong
9. Security
10. Retention
11. Accessing and Correcting Your Personal Data
12. Changes to This Policy
13. Language
14. Contact Us

1. About This Policy

Healthcare Case Management Services ("HCMS", "we", "us" or "our") is a business of Life Extension Company Limited. This Privacy Policy explains how we collect, use, share and protect information collected through our website at www.hcms-hk.com, our enquiry form, and our case and care management services (together, the "Services"). The person receiving care (the "Patient") may be you or another person for whom you have the authority to arrange Services, such as a parent or other relative. An insurer, institution, employer or family that engages HCMS is called the "Client". This Privacy Policy also explains how we handle the Personal Data of the healthcare professionals and providers we work with (see section 7). We comply with the requirements of the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the "Privacy Ordinance").

2. Personal Data We Collect

We may collect the following kinds of information.

2.1 Information You Provide

We collect information when you provide it to us, for example when you send an enquiry through our website, or contact us by email, WhatsApp, telephone or in person. This may include information that identifies you, such as your name, telephone number, email address, mailing address, Hong Kong Identity Card number or insurance policy number ("Personal Data"). You may also give us information about the Patient, such as the Patient's Personal Data, diagnosis, treatment, care needs, home circumstances and preferences, and the Patient's insurance entitlement or other funds available for care. Some of this information relates to physical or mental health and related healthcare services ("Health Data"). We treat Health Data as particularly sensitive and apply the additional safeguards described in section 9.

You agree not to give us information about another person unless you have that person's authority to do so. Where practicable, please also let that person know that you have given their information to us, and refer them to this Privacy Policy.

2.2 Information from Clients and Referrers

If an insurer, third-party administrator, hospital, physician, employer or other organization refers a Patient to us, it may give us the Patient's Personal Data and Health Data, together with details of the Patient's insurance entitlement or other funding. Clients that refer Patients to us are required to obtain any consent needed for this under the Privacy Ordinance.

2.3 Information from Healthcare Professionals

You or the Patient may give Personal Data to the healthcare professionals and providers who deliver care under the Patient's Care Workplan (the "Healthcare Professionals"). As part of the Services, Healthcare Professionals may share with us information about the care they provide and the Patient's progress, including attendance records and invoices, so that we can monitor service quality and account for costs.

2.4 Information from Our Website

When you visit our website, our hosting provider's servers automatically record certain information in server logs, such as your web request, the website you came from, your Internet Protocol (IP) address, your browser type and language, and the date and time of your visit. We use this information to operate, secure and improve the website. Our website does not use cookies or analytics tools. If we introduce them, we will update this Privacy Policy first. If you contact us through WhatsApp, your use of WhatsApp is also subject to WhatsApp's own privacy policy.

3. Is Providing Personal Data Obligatory?

Providing Personal Data to us is voluntary. However, if you do not provide the Personal Data we ask for (for example, your name, a telephone number and a message on our enquiry form), we may be unable to reply to you, assess the Patient's needs, prepare a Care Workplan, arrange Healthcare Professionals, verify insurance entitlement, or otherwise provide the Services. We will only ask for a Hong Kong Identity Card number where it is necessary, for example to identify the Patient correctly for care, insurance or billing purposes, or where required by law.

4. How We Use Personal Data

We may use your Personal Data for the following purposes:

• To respond to enquiries and referrals, and to assess whether and how we can help;
• To provide the Services, including assessing the Patient's needs with the Patient, the family and the attending physicians, and preparing and reviewing the Care Workplan and budget;
• To identify suitable Healthcare Professionals, obtain quotations, negotiate prices, and introduce Healthcare Professionals to the Patient and family;
• To monitor the delivery and quality of care, and to respond to changes in the Patient's condition;
• To track and account for the cost of care, prepare monthly progress and cost reports and payment worksheets, invoice for our fees, and assist with insurance claims;
• To contact you about the Patient's care, including the Care Workplan, scheduling and follow-up (any promotion of our other services is subject to section 6);
• To evaluate the quality of our Services, train our staff, keep proper records and assess our financial performance; and
• To comply with applicable laws and regulations, and to protect the rights, property or safety of the Patient, HCMS or others.

5. Who We Share Personal Data With

We share Personal Data only as needed for the purposes in section 4. We may share your Personal Data with the following classes of persons:

• Healthcare Professionals who provide, or are asked to quote for, care under the Care Workplan, so that they can quote for, provide and communicate about that care. Providers asked only to quote receive no more information than they need to do so;
• The Patient's attending physicians, and the hospitals and clinics involved in the Patient's care;
• The Client that engaged us, to obtain approval of the Care Workplan and budget, and to report on progress, costs and incidents;
• Insurers and third-party administrators, to verify entitlement, obtain pre-authorization, and submit and follow up claims;
• People or organizations that you authorize; family members, relatives or close friends involved in the Patient's care or in paying for it; and any person legally authorized to act for the Patient, such as a guardian or a person appointed by the court to manage the Patient's affairs;
• Staff of Life Extension Company Limited who need it to provide or administer the Services;
• Companies that provide services to us, such as website hosting, email, communications, information technology, data storage, legal, accounting and administrative services. They are required by agreement to keep Personal Data confidential and not to use it for any purpose inconsistent with this Privacy Policy. Some of them may store or process Personal Data outside Hong Kong (see section 8);
• Government and regulatory bodies, such as the Labour Department, for inspections, audits and investigations relating to our employment agency licence or our compliance with applicable laws;
• Where we believe in good faith that it is necessary to (a) comply with any applicable law, regulation, legal process or governmental requirement; (b) enforce the terms of our Services; (c) detect, prevent or otherwise address fraud, security or technical issues; or (d) protect against harm to the rights, property or safety of the Patient, HCMS, our Clients or the public;
• Researchers, for research or statistical purposes, but only where the Personal Data will not be used for any other purpose and the results will not be made available in a form that identifies you, as permitted under section 62 of the Privacy Ordinance;
• The Coroner, the Hong Kong Police Force or other authorities where required or permitted by law, for example in connection with a death;
• Third parties, where necessary to prevent a serious threat to the health or safety of you, another person or the public, as permitted by law; and
• The Social Welfare Department, the Hong Kong Police Force or other appropriate authorities if we reasonably believe that the Patient is a victim of neglect, abuse or domestic violence, where permitted by law.

If Life Extension Company Limited undergoes a merger, or sells its shares or some or all of its assets, including the HCMS business, we may transfer Personal Data to the successor entity, provided that it continues to handle that data in accordance with the Privacy Policy under which it was collected.

6. Direct Marketing

We intend to use your name and contact details (including your telephone and mobile numbers, WhatsApp, email address and mailing address) and the types of Services you have used to send you information about our case and care management services and the healthcare services we coordinate, as well as related events.

We will not use your Personal Data for direct marketing unless we have received your consent, which includes an indication of no objection. You may give your consent by contacting us using the details in section 14.

We will not provide your Personal Data to any other person for use in direct marketing.

You may withdraw your consent, and ask us to stop using your Personal Data for direct marketing, at any time and free of charge, by contacting us at info@hcms-hk.com or +852 2790 7290.

7. Healthcare Professionals and Providers

If you are a healthcare professional or provider whom we engage, or ask to quote, for a Patient's care, we collect Personal Data such as your name, contact details, professional qualifications and registration details, experience, availability, rates and, where we arrange payment, bank account details.

We use this information to assess your suitability, verify your qualifications and registration, obtain quotations, introduce you to Patients and Clients, monitor service quality and process payments. We may share relevant Personal Data with the Patient, the family, the Client and insurers where needed for these purposes. Providing this information is voluntary, but if you do not provide it we may be unable to engage you.

8. Transfer of Personal Data Outside Hong Kong

Our cloud service providers store data both in Hong Kong and in other jurisdictions worldwide, and some of our service providers, such as email and communications providers (including WhatsApp), may process Personal Data outside Hong Kong. Where we transfer Personal Data outside Hong Kong, we take reasonable steps, including contractual measures, to ensure that it receives a level of protection comparable to that required under the Privacy Ordinance.

9. Security

We keep your Personal Data confidential and do not disclose it to third parties except as described in this Privacy Policy. We take all reasonable measures to protect Personal Data from loss, misuse, or unauthorized access, disclosure, alteration or destruction. Access to Health Data is restricted to staff and Healthcare Professionals who need it to provide or administer the Services. Where we engage service providers to process Personal Data on our behalf, we use contractual or other means to prevent unauthorized or accidental access, processing, erasure, loss or use of that data, and to ensure that it is not kept longer than necessary.

If you believe that Personal Data you have provided to us has been compromised, please contact us immediately at info@hcms-hk.com. If a data breach occurs that poses a real risk of harm to you, we will notify you and the Office of the Privacy Commissioner for Personal Data as soon as practicable, and take steps to contain the breach and reduce its impact.

10. Retention

Your Personal Data is kept only for as long as is necessary to fulfill the purposes for which it was collected, after which it is securely deleted, destroyed or anonymized.

In deciding how long to keep Personal Data, we consider the purposes for which it was collected and any legal, regulatory, licensing, tax or insurance requirements. As a general guide, we keep Patient case and billing records for seven years after the Services end. Enquiries that do not lead to Services are kept only for as long as needed to respond and follow up.

11. Accessing and Correcting Your Personal Data

Under the Privacy Ordinance, you have the right to request access to Personal Data that we hold about you, and to request correction of your Personal Data. If you are the parent or guardian of a minor, or have been appointed by the court to manage the affairs of a person who is mentally incapable of managing their own affairs, you may make these requests on that person's behalf. We will respond to data access and correction requests within 40 days of receiving them. We do not charge a fee for data access or correction requests. To make a request, please write to our Personal Data Officer using the contact details in section 14.

12. Changes to This Policy

We may amend or update this Privacy Policy from time to time, and the most recent version will be available on our website at www.hcms-hk.com. The effective date at the top of this Privacy Policy shows when it was last updated. Where we make significant changes, we will take reasonable steps to bring them to your attention.

13. Language

This Privacy Policy is published in English. If it is also published in Chinese and there is any inconsistency between the versions, the English version shall prevail.

14. Contact Us

Please direct any questions about this Privacy Policy, and any data access, correction or direct marketing opt-out requests, to: