Privacy Notice and Personal Information Collection Statement
1. Purpose, Scope and Our Role
Health Mastery Limited (綽峰醫學有限公司) (“Health Mastery”, “we”, “us” or “our”) respects your privacy. This International Privacy Notice and Personal Information Collection Statement (“Privacy Notice”) explains how we collect, hold, use, disclose, retain, protect and otherwise process personal data when you access or use the Health Mastery website, applications, learning management functions, course and event registration services, professional learning portals, public health-information portals, communications and related services (collectively, the “Services”).
This Privacy Notice serves as both our Privacy Policy Statement and, where applicable, the Personal Information Collection Statement provided on or before we collect personal data directly from you. It should be read together with our Terms of Use, Cookie Notice, and any course-, event-, employer-, association-, accreditor- or service-specific privacy notice. Where a more specific notice applies, it supplements this Privacy Notice.
For general Platform operations, account administration, payment administration and communications, Health Mastery generally determines the purposes and means of processing personal data. For organisation-specific learning, event, employer, membership, accreditation or reporting workflows, the relevant organisation may determine the purposes of processing while Health Mastery acts only as its service provider or processor. The applicable course page or workflow will identify the relevant privacy contact.
Health Mastery may provide Services to users, course providers and professional organisations in multiple jurisdictions. We apply appropriate safeguards to protect personal data and endeavour to comply with applicable privacy laws. Privacy obligations and individual rights may vary depending on the user’s location, organisation, course, event and applicable legal requirements.
2. Personal Data We May Collect
Depending on the Services you use and the information you choose or are required to provide, we may collect the following categories of personal data.
| Category | Examples and Reason for Collection |
|---|---|
| Account and Contact Data | Name, email address, telephone number, postal address, username, password and authentication data. Used to create and administer user accounts, communicate with you and provide customer support. |
| Professional and Eligibility Data | Profession, specialty, employer or organisation, professional registration or licence number, professional body, registration status, membership details and credential-verification information. Used to administer professional-only or credit-bearing activities and eligibility verification. |
| Learning, Course, Event and Assessment Data | Enrolment records, attendance, viewing history, participation logs, learning progress, assessment and quiz results, completion status, declarations, certificates, CPD credits, surveys, feedback and event check-in/check-out records. |
| Transaction and Billing Data | Purchases, invoices, payment status, subscriptions, refund requests and tax information where applicable. Payment card information is normally processed by contracted payment providers rather than stored by Health Mastery unless otherwise notified. |
| Communications and Support Data | Emails, enquiries, support tickets, complaints, chat messages, attachments and support records used to respond to enquiries, improve service quality and investigate issues. |
| User-generated Content | Forum posts, comments, feedback, learning submissions and profile information used to support collaboration, discussion and educational activities. |
| Technical, Usage and Security Data | IP address, browser, operating system, device information, cookies, session logs, app version, error reports, approximate IP location and fraud prevention signals used to operate, secure, troubleshoot and improve the Services. |
| Preferences and Marketing Data | Communication preferences, course interests, consent records, unsubscribe history and event interests used to respect your communication preferences and send relevant information where permitted. |
| Data from Authorised Third Parties | Information supplied by course providers, employers, professional associations, accreditors, programme administrators or public professional registers where required to administer authorised learning, credential or reporting workflows. |
3. Healthcare Data and Professional-Learning Safeguards
The Health Mastery Platform is designed primarily for professional education, accreditation and learning management. It is not intended to collect, process or store patient-identifiable information or protected health information through its standard services.
3.1 No Routine Collection of Patient Data
The ordinary Services are designed for professional development, learning, accreditation and record administration. They are not intended to collect or store patient records, patient-identifiable information, confidential clinical information, diagnoses, medical images, clinical case histories containing identifiers or any other protected health information.
3.2 Your Responsibilities
You must not submit patient-identifiable information or confidential clinical information through the ordinary Platform features. Where learning activities involve clinical examples, you are responsible for removing all direct and indirect identifiers and ensuring compliance with applicable professional standards, employer policies, ethical obligations, confidentiality requirements and privacy laws.
3.3 Exceptional Health-Information Workflows
If Health Mastery is ever requested to process patient-identifiable information, protected health information, special-category health data or other sensitive clinical information, such processing will only occur through a separately approved workflow. That workflow must clearly define the legal basis for processing, organisational roles, contractual safeguards, security controls, retention requirements and any required notices or consents.
Standard account registration, course enrolment, event registration and learning workflows must not be used for processing this type of sensitive information.
3.4 No Clinical or Licensing Decision-Making
Learning records, assessment results and professional development records maintained by Health Mastery are not patient records and are not used to provide clinical care, diagnose patients, determine treatments or make solely automated decisions that produce legal or similarly significant effects on individuals.
Decisions relating to professional registration, accreditation, course eligibility, continuing education credits and licence renewal remain the responsibility of the relevant authorised professional body, accrediting organisation or decision-maker.
4. Purposes and, Where Applicable, Legal Bases for Processing
We may use personal data only for purposes that are reasonably related to the reason it was collected, permitted by applicable law or otherwise notified to you. We will not use personal data for a directly unrelated purpose unless we have taken the steps required by applicable law, including providing notice or obtaining consent where required.
| Purpose | Examples and Legal Basis (where EEA / UK law applies) |
|---|---|
| Deliver and Administer the Services |
Creating and securing user accounts, delivering courses,
webinars and events, maintaining learning records, issuing
certificates and providing customer support.
Legal Basis: Generally necessary to perform a contract with you or to take steps at your request before entering into a contract. |
| Professional Learning, Accreditation and Reporting |
Administering attendance, completion, certificates, CPD
credits, eligibility verification and facilitating reporting
where described in the relevant course or event.
Legal Basis: Contract performance, legal obligations, legitimate interests or another lawful basis applicable to the specific workflow. |
| Payments, Records and Compliance |
Processing enrolments, subscriptions, payments, refunds,
tax records, accounting requirements, dispute resolution
and protecting legal rights.
Legal Basis: Contract performance, legal obligations and legitimate interests. |
| Security, Quality and Platform Improvement |
Fraud prevention, academic integrity checks, security
monitoring, troubleshooting, analytics, incident
investigation, service improvement and aggregated or
de-identified reporting.
Legal Basis: Legitimate interests in operating a secure, reliable and effective professional learning platform. |
| Service Communications |
Sending account notifications, course updates, event
reminders, payment confirmations, certificates, security
notices, policy updates and support communications.
Legal Basis: Necessary to provide the Services, comply with legal obligations or pursue legitimate interests. |
| Direct Marketing |
Sending information about Health Mastery courses, events,
subscriptions, professional development opportunities and
related offerings where permitted by applicable law.
Legal Basis: Consent where consent is required by applicable law. |
If Health Mastery processes special-category personal data, including health information under laws such as the GDPR or UK GDPR, we will identify both an appropriate lawful basis and an additional legal condition for processing. Appropriate technical and organisational safeguards will be applied. We do not ordinarily request or require this type of information through our standard learning workflows.
5. Required and Optional Information
Certain personal data are required to create an account, authenticate your identity, process payments, enrol you in courses or events, verify eligibility, issue certificates, administer credit-bearing activities or provide requested Services.
Where practicable, required fields will be clearly identified. If you choose not to provide mandatory information, Health Mastery may be unable to provide the relevant account, course, event, certificate, payment, reporting or support service.
Other information, including optional profile details, survey responses, learning preferences and marketing choices, is provided voluntarily. Choosing not to provide optional information will generally not affect your access to core Services unless the information is genuinely necessary to enable a specific optional feature.
6. Professional Learning, Accreditation and Data Disclosures
Where a course listing or course-specific notice states that a course includes a professional credit, certificate, accreditation, attendance or reporting process, Health Mastery may disclose the minimum personal data reasonably necessary to the relevant recipient for administering that process.
Where practicable, the relevant course page or contextual notice will identify the recipient (or class of recipient), the purpose of the disclosure, the categories of personal data involved, applicable reporting conditions and any action required from you.
| Recipient Class | Purpose of Disclosure |
|---|---|
| Health Mastery Personnel and Authorised Platform Administrators | To operate, administer, support, secure and continuously improve the Services. |
| Course Providers, Instructors, Event Organisers and Programme Administrators | To administer registrations, attendance, learning activities, assessments, certificates and supporting records. |
| Accreditors, Professional Associations, Councils, Employer Sponsors, Professional Bodies, Registration or Licensing Authorities | To administer stated accreditation, certification, CPD credit, eligibility verification or reporting processes, where disclosed to you or otherwise permitted by law. |
| Technology and Operational Service Providers | Hosting, cloud services, learning management systems, video conferencing, communications, document management, identity verification, analytics, cybersecurity and other professional services provided on behalf of Health Mastery. |
| Payment, Fraud Prevention and Financial Providers | To process payments, manage refunds and chargebacks, prevent fraud and fulfil accounting or taxation obligations. |
| Professional Advisers, Insurers, Auditors and Transaction Parties | To obtain professional advice, satisfy insurance or audit requirements, or facilitate an actual or proposed corporate transaction under appropriate confidentiality obligations. |
| Government, Regulatory, Law Enforcement and Judicial Authorities | Where required or permitted by applicable law, to respond to lawful requests, protect rights, maintain security or establish, exercise or defend legal claims. |
| Other Recipients | Where you have directed us to share your personal data, provided consent where required, or another lawful basis permits the disclosure. |
Commercial supporters or sponsors of educational activities will normally receive only aggregated or de-identified participation or outcome information unless a separate privacy notice clearly explains another lawful disclosure and all applicable legal requirements have been satisfied.
Health Mastery does not provide personal data to third parties for their independent direct marketing purposes without the required notice and consent.
7. International Data Transfers
Health Mastery may store, access or process personal data in Hong Kong and in other jurisdictions where Health Mastery, authorised course providers or service providers operate. Processing locations may change as our systems, suppliers and business operations evolve.
Where personal data is transferred across borders, Health Mastery takes reasonably practicable and appropriate measures to safeguard personal information. Depending on the circumstances, these measures may include contractual, organisational and technical safeguards, supplier due diligence, data minimisation practices and approved international transfer mechanisms.
Where the GDPR or UK GDPR applies, Health Mastery will rely on a recognised lawful transfer mechanism, such as an adequacy decision, Standard Contractual Clauses (SCCs) or another legally recognised safeguard. Where necessary, supplementary safeguards will also be assessed and implemented.
You may contact us using the details provided in Section 16 for further information regarding the safeguards applicable to a particular international transfer, subject to legal and confidentiality limitations.
8. Data Retention and Deletion
Health Mastery retains personal data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Notice. This includes providing the Services, maintaining learning and transaction records, administering certificates and reporting processes, resolving disputes, enforcing agreements, protecting the Platform and complying with applicable legal, regulatory, accounting, accreditation, contractual and audit obligations.
Retention periods vary according to the type of information, the relevant course or programme, recipient requirements and applicable legal obligations.
Learning records, certificates, attendance records and continuing professional development (CPD) information may be retained longer than an active user account in order to preserve a verifiable professional record or satisfy accreditation, reporting, audit or legal requirements.
When personal data is no longer required, Health Mastery will take reasonable steps to securely delete, destroy or anonymise the information unless continued retention is required or permitted by applicable law.
9. Data Security and Incident Management
Health Mastery implements reasonable administrative, technical and physical safeguards designed to protect personal data against unauthorised or accidental access, processing, erasure, loss, use, modification or disclosure.
Depending on the nature of the processing, these safeguards may include role-based access controls, authentication, encryption where appropriate, system logging, staff training, supplier management, security monitoring, backups and incident response procedures.
While Health Mastery applies appropriate security measures, no transmission, storage or information system can be guaranteed to be completely secure. You are responsible for protecting your account credentials and promptly notifying us of any suspected unauthorised access or misuse of your account.
If a personal data incident occurs, Health Mastery will investigate the incident and take the notification and response measures required under applicable privacy laws.
10. Cookies, Analytics and Similar Technologies
Health Mastery may use cookies, software development kits (SDKs), pixels, local storage, log files and similar technologies to operate the Services, remember user preferences, authenticate users, protect security, analyse usage, measure performance, improve content and, where permitted, support communications or advertising activities.
Where required by applicable law, we will provide a Cookie Notice and an appropriate cookie preference mechanism. You may also control or disable cookies through your browser or device settings; however, disabling certain technologies may affect the availability or functionality of some Services.
You can modify your browser or device settings to manage cookies or similar technologies at any time. Please note that disabling certain cookies may reduce functionality or prevent some features of the Platform from operating correctly.
11. Direct Marketing and Your Choices
Subject to applicable law and your consent where required, Health Mastery may use your name, contact details, professional role, specialty, organisation, learning preferences, course interests, event attendance and engagement preferences to provide information about Health Mastery courses, events, subscriptions, Platform features, professional development opportunities, surveys and other related services.
We will not use your personal data for direct marketing, or provide your personal data to another organisation for that organisation’s own direct marketing purposes, without providing the required notice and obtaining consent where required by law.
You may withdraw your consent or opt out of marketing communications at any time by:
- Clicking the Unsubscribe link in marketing emails;
- Updating your communication preferences within your account; or
- Contacting us using the privacy contact details provided in Section 16.
Please note that even if you opt out of marketing communications, we may continue to send service-related communications that are necessary for operating your account or delivering requested Services.
12. Your Privacy Rights and Choices
Subject to applicable law, you may have the right to request access to the personal data we hold about you, request correction of inaccurate information, withdraw consent, object to certain processing activities, request deletion or restriction of processing, request data portability or lodge a complaint with a competent privacy regulator.
Not all rights apply in every jurisdiction or circumstance. Certain information may need to be retained where required for legal, professional, accreditation, audit, security or record-integrity purposes.
For individuals to whom the GDPR or UK GDPR applies, available rights may include the rights to be informed, access, rectification, erasure, restriction of processing, data portability, objection and safeguards relating to certain automated decision-making processes. You may also have the right to lodge a complaint with the relevant data protection authority.
To exercise any applicable privacy rights, please contact the Privacy Contact listed in Section 16. We may request additional information to verify your identity before processing your request.
Health Mastery will respond within the timeframes required by applicable law and will explain the basis for any limitation, fee or refusal where permitted.
13. Children and Minors
The professional learning Services provided by Health Mastery are intended primarily for adult healthcare professionals.
If Health Mastery permits a minor to use a public-facing Service, we will provide an age-appropriate privacy notice and implement any consent, authorisation or verification procedures required under applicable law.
Please do not provide personal data relating to a minor unless you are authorised to do so under applicable law or have obtained the necessary consent from the minor’s parent or legal guardian.
14. Third-Party Websites and Services
The Services may include links to, or integrations with, third-party websites, payment providers, video conferencing platforms, event management systems and other external services.
These third parties may collect and process personal data independently under their own privacy policies and terms of use.
Health Mastery is not responsible for the privacy practices, security measures or content of third-party websites or services. We encourage you to review their respective privacy notices before providing personal information or using their services.
15. Changes to This Privacy Notice
Health Mastery may update this Privacy Notice from time to time to reflect changes in our Services, privacy practices, legal requirements, security measures or service providers.
The most recent version of this Privacy Notice, together with its effective date, will be published on the Platform.
Where changes are considered material, Health Mastery will provide additional notice where reasonably appropriate or required by applicable law before the updated Privacy Notice takes effect.
16. Contact, Questions and Complaints
If you have any questions, concerns, complaints or requests relating to this Privacy Notice or our handling of your personal data, please contact us using the details below.
| Contact Item | Details |
|---|---|
| Legal Entity | Health Mastery Limited (綽峰醫學有限公司) |
| Customer Support | cs@thehealthmastery.com |
This Privacy Notice may be updated from time to time. Please refer to the latest version published on the Health Mastery Platform.
