PRIVACY AND PERSONAL DATA PROTECTION POLICY
This Privacy and Personal Data Protection Policy (“Policy”) describes the personal data processing activities of COLUMBIA ASIA BINH DUONG CO., LTD, tax code is 3700952056, located at No. 1A6/328, Hoa Lan 2 Quarter, Thuan Giao Ward, Ho Chi Minh City, Vietnam (hereinafter referred to as the “Hospital”, “Company”, “we”, “us” or “our”) and/or the Company's affiliates, and member units (to the extent where applicable).
This Policy is established and issued in compliance with the Personal Data Protection Law No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP elaborating on certain articles and implementation measures of Law on Personal Data Protection (collectively, the “Law”), This Policy is issued and applied to all our immediate and/or prospective clients/patient, user, employees, medical specialists, consultants, goods and/or service providers and stakeholders pursuant to the Law (collectively referred to as “You”).
This Policy sets out how we collect, use, store, disclose and otherwise process Your Personal Data. Where we act as a Personal Data Controller-cum-Processor and require You to provide Personal Data, we are committed to processing such Personal Data strictly in accordance with this Policy and the applicable Law, while ensuring its confidentiality and security.
1. Consent
1.1 This Policy serves to inform you that your personal data is being collected and processed by us or our Data Processors, and authorized Third Parties as specified in this Policy. Your consent to the processing of your personal data under this Policy will be obtained through specific forms (online or paper-based) when You register for services, book appointments, or interact with the Hospital's platforms.
1.2 By confirming your consent through such forms, executing an agreement with us, or registering for the Hospital's products or services, You acknowledge that You have read, understood, and consented to our collection and processing of Your Personal Data in accordance with this Policy and the applicable Law.
2. Description of Personal Data
We may processing a variety of information and/or data about yourself (“PD”) including but not limited to:
2.1 Basic PD includes
(a) Full name at birth and other names (if any);
(b) Date, month, and year of birth; date of death or missing status (if applicable);
(c) Gender;
(d) Place of birth, place of birth registration, permanent residence, temporary residence, current address, place of origin, and contact address;
(e) Nationality;
(f) Personal images;
(g) Telephone number, personal identification number, passport number, driving license number.
(h) Marital status;
(i) Information on family relationships (parents, children, spouse);
(j) Personal digital account information; and
(k) Other information associated with or capable of identifying a specific individual that does not fall under sensitive personal data.
2.2 Sensitive PD includes
(a) Data revealing racial or ethnic origin;
(b) Religious beliefs, or faith;
(c) Information relating to private life, personal secrets, or family secrets;
(d) Health status information, medical history; Data revealing a person's sex life or sexual orientation
(e) Biometric and genetic data (included medical hisroty of family);
(f) Images of ID card. passport, social insurance card, login names and passwords for e-identification accounts or other images from your e-identifications account (i.e. VneID, e-TaxMobile, VssID);
(g) Login names, access passwords of bank accounts; bank card information, data on transaction history of bank accounts; financial and credit information and information on financial, securities, and insurance activities and transaction history of customers at credit institutions, foreign bank branches, intermediary payment service providers, securities, insurance, and other authorized organizations.
(h) Other personal data required by law to be kept confidential or subject to enhanced security protection measures.
3. Purpose of processing PD
Your PD is being or is to be used for personal data processing activities, including collection analysis, aggregation, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer, storage, usage, sharing, and other processing operations affecting personal data (hereinafter collectively referred to as PD processing activities) for the following purposes:
3.1 Medical examination and treatment purposes
(a) Performing pre-contractual activities including appointment scheduling, preliminary consultations, patient triage, and the allocation of attending physicians, as well as entering into and performing contracts with You;
(b) Ensuring the provision of medical examination, treatment and maintaining the continuity of medical care and treatment to You;
(c) Contacting you in case of any change ofexamination or treatment appointment dates, follow-up reminders, or regarding related services;
(d) Managing your medical records, health records and medical reports;
(e) Sharing Your PD among the Hospital's departments and clinical units, or with other medical examination and treatment establishments, for the purposes of multidisciplinary consultations, referrals, diagnostic procedures, or ensuring the continuity of medical examination and treatment.
3.2 Payment purpose
(a) Processing payments, collecting and refunding fees, and carrying out financial transactions arising from the provision of services to customers and patients;
(b) Assessing Your creditworthiness and ability to pay, and processing payments and medical insurance guarantees relating to the services provided to You;
(c) Sharing Your PD with health insurers, third-party administrators, or other relevant financial institutions for the purposes of payment processing, insurance claims administration, and resolving billing-related matters relating to You;
3.3 Customer service and service quality improvement purposes
(c) Receiving, processing and responding to Your request, queries, complaints or arising legal issues arising from the provision of our products and/or services;
(d) Conducting internal research, analysis, audits, statistical assessments, and other activities for service quality evaluation and improvement;
(e) Providing, maintaining, and improving our products and/or services to or enhancing technologies, website interfaces, social media networks, and applications to ensure convenience for You;
(f) Carrying out marketing, promotional and customer relationship management activities by providing You, through telephone calls, text messages, email or applications operated by the Company, with information relating to the Hospital's, its affiliated entities' or business partners' products and/or services, including promotional programmes, special offers, community events, electronic newsletters, seasonal or birthday greetings, gifts, vouchers, and other customer care programmes. For the avoidance of doubt, we will only carry out advertising and marketing purposes upon obtaining Your explicit consent. Your refusal to consent to and authorize us to process PD for advertising and marketing purposes at this point shall not affect the provision of Hospital services/products to You.
3.4 Administrative and Regulatory Compliance
3.5 Operational purposes
(b) For medical education and training (with anonymized data where possible);
(c) For insurance activities,insurance management, third party administration and any other third parties;
(d) Protecting the Hospital’s legitimate rights and and interests, executing legal procedures, or seeking professional and legal counsel when necessary;
(e) Managing internal records documentation, and data of the Hospital;
(f) Conducting internal activities such as evaluating the effectiveness of marketing, market surveys/research, trend analysis, statistic compilation, reporting, audit, compliance, risk management, and data analytics to improve our services;
(g) Executing debt recovery measures or handling overdue debts in accordance with applicable laws;
(h) Managing and executing civil, commercial or other transactions between You and the Hospital;
(i) Granting access rights to, managing, operating, and monitoring your use of, any online platforms, mobile applications, sites or information technology systems owned, operated or managed by us;
(j) Carrying out the Hospital's communication and promotional activities, including publishing images and other content on the Hospital's websites and social media platforms to introduce the Hospital's services, facilities, medical specialists and personnel.
(k) Organizing events, seminars, workshops and other engagement activities to introduce the Hospital's services and provide health-related information to You.
3.6 Security and safety purposes: Installing cameras (CCTV) in public areas within the Hospital, including waiting halls, cashiers, clinics, parks, and other premises, to manage security, ensure safety, and extract image data as necessary for handling complaints or legal disputes.
3.7 Any other purposes arising in the course of our operations, provided that the Hospital has given You prior notice and obtained Your explicit consent before carrying out such processing.
(collectively, the “PD processing purposes”).
4. Source of collecting PD
Your PD is being or is to be collected from the following sources:
(a) directly from you or your representative when you or your representative fill in form to register to use our services including any online forms on Hospital’s mobile application or official website, and registration forms at our facilities, or contact us via emails, letters or telephone calls, or when taking part in customer surveys and promotions and during marketing activities;
(b) When you inquire about, register for, or use our products/services or events, including without limitation to accessing our online platforms, mobile applications, or websites (including through cookie platforms and/or tracking technologies);
(c) From any information or document provided by you to us for any of the PD processing purposes as prescribed in Article 3 of this Policy, such as your identity card, passport, labor contract/salary slip, questionnaires or survey forms;
(d) From any third parties connected with You such as your employer, potential employer, agents, insurance companies, and/or other healthcare facilities, providers;
(e) From such other sources to whom you have given your consent to disclose information relating to you and for which we have a lawful basis for collection;
(f) From events, programs, or activities organized or attended by us where we have obtained your consent to use your personal image and information for advertising and marketing purposes;
(g) From CCTV surveillance systems installed at our premises, we ensure that the camera locations comply with applicable law and appropriate notices have been displayed.
(h) From referral letters, transfer documents for medical examination and treatment, or other professional medical records provided by doctors;
(i) From medical records, health profiles, medical reports and other PD collected from You on any subsequent occasion;
(j) From automated interactions or PD collection technologies, such as cookies, pixels, social media tracking, web browsing history, or data collected through other means;
(k) From all other information that You may provide us from time to time.
5. Access to, correction of and limiting the processing of Personal Data
5.1 Subject to the provisions of the Law, You have the full right as a data subject including the right to request access to, review, rectification, updating, restriction, erasure of, or the withdrawal of consent for the processing of your PD. Additionally, You are entitled to submit inquiries, requests, or complaints in respect of the processing of your PD, including the choosing the means for limiting or ceasing the processing of your PD for purposes of direct marketing. You may contact us as per the details set out in this Policy (at here).
5.2 To the extent permitted by Law and contractual conditions of the relevant commitments or agreements, You may request the erasure, deletion, rectification, restriction, withdrawal, or modification, withdraw or amend entirely or in part of your consent given previously for processing your PD. We will process your requests within a timeframe in accordance with the provisions of applicable Law and pursuant to the Hospital’s internal procedures.
5.3 Depending on the specific circumstances and to the extent permitted by Law, we may refuse certain requests from You relating to Your PD, including requests for erasure, withdrawal of consent, access to, or rectification of Your PD. In such cases, we will notify You in writing of the refusal and the reasons thereof, including, without limitation, circumstances where the applicable Law requires or permits us to continue processing or retaining Your PD, as follows:
(a) Your PD forms part of medical records that are required to be retained for the statutory retention period under the Law on Medical Examination and Treatment;
(b) Your PD is processed by or provided to competent state authorities for the performance of their statutory functions;
(c) Your PD is processed to respond to emergencies threatening the life, health or safety of You or another individual; or
(d) Other cases prescribed by the applicable law.
5.4 In any event, if our compliance with Your requests under this Section results in our inability to fulfill the PD processing purposes previously agreed upon, You acknowledge and agree that You have been notified of and are fully aware of the risks, adverse consequences, or the inability to continue enjoying certain benefits and services designated for the Hospital's customers, as detailed in Article 7 of this Policy. The Hospital shall be fully exempted from liability for any damages, losses, or forfeiture of certain benefits arising directly from complying with your requests.
5.5 In case the requestor is not the PD subject, we may also require to provide authorization letter, consent form of the PD subject or other documentation proving that the requestor is the legal representative of the PD subject, in order for us to review and process the request.
6. Necessary PD
6.1 To receive full services and benefits, You are kindly requested to provide accurate aand complete details marked with an asterisk (*) or specified as compulsory in our forms, dossiers, or documentation (collectively, “Necessary PD”).
6.2 Where You do not provide, or do not provide in full, the PD requested by us for the purposes set out in this Policy, You acknowledge and agree that You have been informed of, understand, and accept the possible consequences set out in Article 7 of this Policy.
7. Consequences of refusal or not provide PD
7.1 If You refuse or fail to provide any Necessary PD or limit our processing of Your PD, erasure, deletion, or rectification of PD, it may result in our inability to fulfill the PD processing purposes, provide You with full benefits and service experiences, and/or fully perform the rights and obligations agreed upon in the contract, this may lead to one or more of the following consequences, for which we shall not be held liable for any of the consequences arising from:
(a) The inability to establish, enter into, or perform any contract, agreement, to facilitate provision of our services or to conduct recruitment and human resources management;
(b) The inability to continue or manage any relationship in place between You and us; unable to provide you with services and/or products requested or continue to perform any contractual obligations to you (if any);
(c) The inability to provide or update you on our latest services and/or products and/or appointment dates;
(d) The inability to complete transactions in relation to our products and/or services;
(e) The inability to comply with any applicable law, regulation, decisions of competent authorities, court order, guidelines upon your request;
(f) may lead to the termination of or the inability to continue performing any arrangements, contracts or transactional relationships between You and us.
7.2 In all cases of contract termination under this Article, You agree and acknowledge that such termination or failure to fully perform the contractual obligations under the circumstances described above is not attributable to the Hospital and does not constitute a breach of contract. The Hospital shall be exempt from liability and shall not be liable for any contractual penalties, damages or other obligations owed to You arising from such termination.
8. Disclosure and sharing of PD
8.1 We may disclose or share your PD to the following to the following organization and individuals acting as our Data Processors or Third Parties, as applicable depending on the relevant processing purpose and the specific circumstances:
(a) Departments, other entities within the group of Company and its subsidiaries, affiliated and member companies located within or outside the territory of Vietnam;
(b) Doctors, medical specialists, and healthcare practitioners involved in providing medical services to You;
(c) Insurance companies and/or managed care organizations upon your written request, or when the Hospital needs to process Personal Data in cases where the processing of personal data does not require the consent of the data subject;
(d) Banks, financial institutions, credit card or debit card issuers for processing payment;
(e) Your employer or any party legally authorised by your employer to perform relevants tasks;
(f) Your next of kin or emergency contacts provided by You;
(g) Research institutions and organisations;
(h) Social welfare and charitable organisations;
(i) Other external medical specialists, consultants, and healthcare professionals engaged in consultation provide expert advice or independent professional opinions, facilitate referral, or other healthcare-related purposes;
(j) Other public or private healthcare facilities in case a patient is transferred;
(k) Parents, legal guardians, lawful representatives, or persons authorised under applicable law to represent a minor (an individual under 18 years old) or a Special Person (an individual who lacks legal capacity, has difficulties in cognition or behavioural self-control, or whose legal capacity is restricted under applicable law).
(l) Service providers, suppliers, agents, contractors and vendors who process PD on our behalf, including but not limited to medical specialists, outsourced data centres and outside labs providing diagnostic services;
(m) Laboratories and diagnostic service providers who may be outside the management of the Hospital;
(n) Data centers storing data for the hospitals;
(o) External legal counsel or lawyers;
(p) Independent external auditors and accountants;
(q) State agencies, regulatory authorities, professional organizations, or other competent authorities as prescribed by law for professional purposes or for administering employee benefits and welfare, or for the purpose of connecting, sharing, and interoperating medical data with the Electronic Health Book integrated into the National Identification Application (VNeID) as required by competent state authorities, including but not limited to the Ministry of Health, the Ministry of Home Affairs, the Ministry of Public Security, the Ministry of Justice, the Ministry of Finance, the Vietnam General Confederation of Labor, and/or other relevant agencies;
(r) Quality assessment and accreditation bodies;
(s) Any other third party requested or authorized by You to fulfill the notified purposes of PD processing.
(t) Information technology service providers, and partners responsible for developing, upgrading, and maintaining mobile applications, websites, hospital management software, or other technical infrastructure systems that support the Hospital’s internal management, storage, and operational activities;
(u) Marketing, communication, and market research agencies or service providers, or partners assisting the Hospital in implementing customer care programs, promoting services, and personalizing Your experience during Your use of services at the Hospital;
(v) Entities and organizations providing employee welfare and benefits services, such as financial and payroll management providers, insurance providers, or event management and travel agencies.
8.2 Our PD Processors and service providers are permitted to process PD only in accordance with our instructions, for the purposes authorized by You, and in compliance with applicable laws on personal data protection. These parties are responsible for implementing appropriate technical and organizational measures to protect Your PD against unauthorized access, use, disclosure, alteration, loss, or destruction.
9. Protection of Personal Data
9.1 Your PD is stored and processed in accordance with appropriate security measures. We commit to implementing the necessary administrative, technical, and organizational measures to prevent unauthorized processing, loss, destruction, or damage to PD. Access to PD shall only be granted to authorized individuals, departments, or entities who have a legitimate need to know regarding specific types of Personal Data to perform their assigned duties or as prescribed in this Policy.
9.2 In the event of a Personal Data breach, including where Your PD is lost, disclosed, altered, destroyed, or accessed without authorization as a result of a cyberattack or any other incident, the Hospital will notify the competent state authorities and, where required by the applicable Law, notify You within seventy-two (72) hours from the time the breach is discovered.
9.3 While We implement appropriate security measures to protect Your PD, You acknowledge that cyberspace is not an absolutely secure environment. The Hospital shall not be liable for any Personal Data breaches, loss, leakage, or unauthorized access arising from Your acts or omissions, including but not limited to: (i) Your negligence or falling victim to fraud or scams; (ii) voluntarily disclosing Your passwords, one-time passwords (OTP), or electronic identification accounts; or (iii) Your personal devices being infected with malware, viruses, or other malicious software. You are responsible for safeguarding Your electronic devices, accounts, and login credentials.
10. Retention of Personal Data
10.1 Your PD will be retained for the period necessary to fulfil the purposes set out in this Policy and to satisfy legal, regulatory, or contractual obligations. Upon the expiration of the retention period or when the purposes for processing PD no longer exist, we will take reasonable measures to ensure that PD is destroyed, permanently deleted and/or de-identified / anonymised (where appropriate) in accordance with relevant specialized laws and our internal policies.
10.2 Upon receipt of a valid request from You for the erasure of Your PD, except where otherwise permitted by the applicable Law, we will process and complete the erasure of Your PD within a maximum period of twenty (20) days in accordance with the applicable Law.
11. Third party personal data
11.1 In certain cases, we may require the Personal Data of other individuals related to You (including but not limited to: relatives, emergency contacts, dependents, authorized representatives, legal representatives, guardians, spouses, children, and/or parents, etc.) to fulfill the notified purposes of processing Personal Data. You agree to cooperate and assist us when necessary. In the event that You provide third-party Personal Data to us, You commit to and are responsible for ensuring that such individuals have been notified of this Policy and have consented to our collection, use, and processing of their Personal Data in accordance with the provisions of this Policy prior to providing such Personal Data to us, and You shall be legally liable for the lawfulness of the concerned data subjects' consent in this regard. The Hospital reserves the right to request You to provide evidence of such consent when necessary.
11.2 The Hospital shall have no obligation to verify the legality or validity of any consent or authorization obtained from any individual related to You. You agree that the Hospital shall be indemnified and held harmless against any losses, damages, liabilities, costs, and expenses (if any) arising out of or in connection with Your breach of the representations and undertakings set out in this Article.
12. Transfer of PD outside Vietnam
To the extent permitted by applicable laws, we may transfer your PD outside the territory of Vietnam to fulfill the purposes outlined in this Policy. The transfer of PD abroad (if any) shall be executed in strict compliance with the laws and regulations on personal data protection, including provisions relating to cross-border transfer of PD and, where required by law, based on your consent or other valid legal bases as prescribed.
13. Accuracy of your PD
We will take reasonable measures to ensure that the Personal Data retained is accurate and complete, exactly as provided by ou to us. You are responsible for ensuring that the information provided to us is accurate, complete, non-misleading, and free from intentional concealment, and that it is promptly updated and notified upon any changese.
14. Personal Data of minors and others
14.1 For: (i) the PD of minors (individuals under 18 years of age); or (ii) persons lacking civil capacity, persons with cognitive or behavioral difficulties, or persons with limited civil capacity as prescribed by law (collectively, “Special Subjects"), the processing of PD shall be conducted based on the consent of the parents or legal guardians of the minors; or the legal representatives, individuals designated by competent authorities, or individuals authorized by law to represent the Special Subjects, as the case may be.
14.2 Where applicable, You acknowledge and warrant that You have full authority to represent the aforementioned minors or Special Subjects, including exercising the rights and fulfilling the obligations regarding Personal Data processing activities stipulated in this Policy on behalf of the Special Subjects. In the event that You concurrently provide Your own Personal Data to us, such Personal Data shall also be processed in accordance with this Policy and relevant applicable laws.
15. Conflict of language
In the event of any discrepancy or conflict between the English and Vietnamese versions of this Policy, the Vietnamese version shall prevail.
16. Changes to this Policy
16.1 We may amend, supplement, or update this Policy from time to time to reflect changes in our operations, services, legal obligations, or requirements from competent authorities. Any updates will be notified through our website, online platforms, or other appropriate communication channels.
16.2 You are encouraged to review this Policy regularly to stay updated on the latest changes. Where required by law, we will obtain Your feedback or prior consent before implementation if the changes materially affect the processing of Your personal data. Your continued use of our products, services, or platforms after the Policy is updated shall be deemed as You being notified of and acknowledging such changes; however, this shall not be construed as consent in cases where separate express consent is required by law.
*********** END OF POLICY *********