Privacy Policy

Statement of Policy

The Health Bureau is committed to fully complying with the data protection principles and all relevant provisions under the Personal Data (Privacy) Ordinance ("the Ordinance"). When we collect personal data from you, we will provide you with a Personal Information Collection Statement on or before the collection in an appropriate format and manner (e.g. in the same paper form or web page that collects the personal data).


Statement of Practice

Kinds of Personal Data Held
Three broad categories of personal data are held in the Health Bureau.They are personal data contained in :

Enquiry and complaint records, which include records containing information supplied by parties concerned and collected in connection with the handling of enquiries and complaints and related activities;

Personnel records, which include job applications and personnel data of Health Bureau staff such as personal and family particulars, employment terms, payroll, employment benefits, leave, training and medical records, enrolment of provident fund schemes, performance appraisals and disciplinary records, etc; and

Other administrative and operational records, which include personal data collected in connection with surveys, public engagement and consultation activities, appointment to advisory boards and committees, nominations for awards and visit programmes, appeal board cases, quotation and tender exercises, applications for grants, work contacts, payment records, etc.

Main Purposes of Keeping Personal Data
Personal data held in :

Enquiry and complaint records are kept for the purposes of processing individual cases, communicating with the enquirers or complainants and taking necessary follow-up actions as appropriate;

Personnel records of job applicants and staff are kept for recruitment and human resource management purposes; and

Other administrative and operational records are kept for various purposes which vary according to the nature of the records, such as seeking views on policy matters, selection of suitable candidates for appointment to advisory boards and committees and award of honours, processing of appeal cases and grant applications, procurement of goods and services, liaison with work contacts, effecting payments, etc.

Information Collected When You Visit Our Website
The Health Bureau undertakes to ensure that all personal data submitted through the Health Bureau website are handled in accordance with the relevant provisions of the Ordinance. We will record your visits to the Health Bureau website without collecting or storing any personal identifiable information of you. General statistics so collected are for the compilation of statistical reports and the diagnosis of problems with or concerning the computer systems for the sole purpose of website enhancement.

In particular, cookies are used by the Health Bureau to collect statistics about the number of visits to our website and the users’ preference of websites and online services offered by the Health Bureau. A cookie is a piece of data stored in your computer’s hard drive when you visit our website. It is primarily an anonymous unique identifier for a computer without collecting any of your personal information. You may choose to accept or reject cookies. If you reject the cookies, you will not be able to use some of the functions of our website, such as saving your preferences in browsing the website and accessing some online services on the website.

For different purposes and at different times, you may be invited to provide personal data to the Health Bureau through our website on a voluntary basis. Personal information required may include name, telephone number, mailing address or e-mail address, etc. We will specify the collection purpose and intended usage of your data when we invite you to provide such information and will advise you how you may request access to or correction of the personal data provided.

The Health Bureau website uses SSL protocol to encrypt data during network transmission to protect your personal data. All personal data you provide to the Health Bureau, if any, via our website are secured, and access to them is restricted to authorised personnel only.

Outsourcing Arrangements
The search service on the Health Bureau website is provided by an independent contractor engaged by the Government. The independent contractor undertakes that it does not collect personal identifiable information while serving search results through the Health Bureau website. The independent contractor will share the anonymous data it collects through the search service with the Government for compiling traffic analysis on government websites. The Government will not match the data obtained from any such search activity with any personal data possibly held by the Government.

Protection Measures
The Health Bureau takes appropriate steps to protect the personal data we hold against loss, unauthorised access, use, modification or disclosure.

The Health Bureau maintains and executes retention policies of records containing personal data to ensure personal data is not kept longer than is necessary for the fulfilment of the purpose for which the data is or is to be used. Different retention periods apply to the various kinds of personal data collected and held by the Health Bureau.

Disclosure of Personal Data
For comments, suggestions, enquiries and complaints received by this Bureau, the personal data contained therein will be used only for purposes directly related to the processing of individual cases. In so doing, such personal data may be transferred to other Government departments, bureaux or concerned parties involved in the handling of the cases including the party under complaint and/or other related parties.

Data Access and Correction
Data access request should be made by sending the completed Data Access Request Form (OPS003) to our Data Protection Officer by fax at 25413352, by email to, or by post to the following address:

Health Bureau
18/F, East Wing,
Central Government Offices,
2 Tim Mei Avenue,
Tamar, Hong Kong

When handling a data access or correction request, the Health Bureau will check the identity of the requester to ensure that he/she is the person legally entitled to make the data access or correction request. A fee is chargeable by the Health Bureau for complying with a data access request. A Data Protection Log Book is maintained as required under section 27 of the Ordinance.

Any enquiries regarding our personal data privacy policy and practices may be addressed to our Data Protection Officer via the above fax number, email address or correspondence address.

1 Jul 2022