Opens in a new tab
3 Mount Elizabeth, #13-10 Medical Centre, Singapore 228510

Privacy Policy

We are committed to protecting your personal information and handling it with care, in line with Singapore’s data protection laws.

Your Privacy Matters

ONEVISION EYE PTE. LTD. (UEN: 202327429M), trading as OneVision Eye Specialist & LASIK Centre
3 Mount Elizabeth #13-10 Mount Elizabeth Medical Centre Singapore 228510

Effective 18th October 2026. This version replaces the version last modified 16 March 2026.

IN PLAIN WORDS

  • We collect what we need to care for you, manage your appointments, and meet our legal duties.
  • We do not sell your personal data.
  • Appointment messages are not marketing.
  • You can ask to see your data, correct it, or withdraw your consent. Contact our Data Protection Officer at dpo@onevision.com.sg.

1. WHO THIS POLICY COVERS

 

This policy explains how ONEVISION EYE PTE. LTD. (“we”, “us”, “our”) collects, uses, discloses and protects personal data under the Personal Data Protection Act 2012 (“PDPA”). It applies when you visit our website, contact us by phone, WhatsApp, email or forms, register as a patient, or visit the clinic.

This policy is a notice. Visiting our website does not mean you agree to us handling your health information. Where the PDPA requires your consent, we ask for it separately, for example on a registration form, an enquiry form tick box or a WhatsApp opt-in.

Our doctors also owe you professional duties of confidentiality under the Singapore Medical Council Ethical Code and Ethical Guidelines. Those duties apply in addition to this policy.

 

2. PERSONAL DATA WE COLLECT

 

Depending on how you deal with us:

  • Identification: name, date of birth, gender, and NRIC, FIN or passport number. We collect NRIC or FIN only where the law requires it or where we need it to identify you accurately.
  • Contact: address, email, telephone and mobile numbers, preferred contact method (including WhatsApp).
  • Appointments and enquiries: preferred doctor, appointment date and time, reason for visit, and your messages to us by form, email, phone or WhatsApp.
  • Medical and clinical: medical history, symptoms, diagnoses, test results, clinical images and scans, treatment details, medication, allergies.
  • Payment and insurance: billing address, payment details processed by us or our payment providers, insurer or payor details, and information needed for MediSave or MediShield Life claims.
  • Website and technical: IP address, browser type, device identifiers, pages viewed, and cookies (see section 9).
  • Images from CCTV in the clinic, kept for security and safety.

 

3. HOW WE COLLECT IT

 

  • From you: online forms, phone calls, WhatsApp, SMS, email, registration, consultations, treatment, consent forms, events, talks, surveys.
  • From our website through cookies and similar technologies.
  • From others, where you have authorised it or the law permits: the doctor who referred you, hospitals, labs, other healthcare providers, insurers, and family members you have asked to act for you.

If you give us another person’s data, such as a child’s or a parent’s, please make sure you are authorised to do so and have told that person about this policy. We may ask you to confirm this.

 

4. WHY WE USE AND DISCLOSE PERSONAL DATA

 

(a) Your care and our operations. When you give us your data to book, register or be treated, you are taken to consent to its use for those purposes. This covers: providing consultations, tests, procedures and follow-up care; creating and keeping medical records; handling billing, payments, claims and insurance; coordinating your care with other healthcare professionals; answering enquiries, feedback and complaints; managing our business, finance, IT, risk and record-keeping; and meeting legal and regulatory requirements.

(b) Service messages about your own care. Appointment confirmations and reminders, pre-visit preparation, post-procedure instructions, and recall notices for your own review are service messages. They are not advertisements. Health information we send because you asked for it is also a service message, as long as it does not promote our services.

(c) Quality and improvement. Clinical audits, outcome monitoring, patient surveys and service improvement.

(d) Marketing. Only with your prior written consent. See section 5.

(e) Without consent, where the PDPA allows. For example: an emergency that threatens life, health or safety; where the law requires or authorises it; and, after we have weighed the effect on you, for legitimate interests such as security and preventing fraud.

You may withdraw consent at any time (section 12). Withdrawing consent may limit what we can do for you.

 

5. MARKETING AND DO NOT CALL

 

  • We send advertising about our services, events or health updates by WhatsApp, SMS, email or phone only if you have given us prior written consent. We ask for it separately from your treatment consent, and it is never a condition of receiving care.
  • We record the date, the wording and the channel of your consent.
  • Every marketing message identifies us and tells you how to stop. You can reply STOP or contact our Data Protection Officer. We act on your request within 10 business days.
  • Before sending marketing by SMS, WhatsApp or phone to a Singapore number, we check the national Do Not Call Registry unless you have given us clear consent.
  • We do not use your health information, appointment records or messages to build online advertising audiences.

 

6. WHO WE DISCLOSE TO

 

  • Doctors, nurses, optometrists and other professionals involved in your care, and the doctor who referred you.
  • Hospitals, surgery centres, labs, imaging centres and other medical facilities.
  • Insurers, third-party administrators and other payors, with your written consent or authorisation, for claims.
  • CPF Board and the Ministry of Health for MediSave and MediShield Life claims.
  • The National Electronic Health Record, when we are required or permitted to contribute to it.
  • Service providers that handle data for us as data intermediaries (for example IT, cloud hosting, messaging and appointment tools, payment processors, accountants), under written contracts that require them to protect your data.
  • Professional advisers such as auditors and lawyers.
  • Government authorities, regulators and law enforcement, when the law requires it.

We do not sell your personal data. We do not disclose it to employers, schools or family members unless you consent or the law requires or allows it.

 

7. TRANSFERS OUTSIDE SINGAPORE

 

Some of our providers, such as cloud, messaging and analytics services, may store or process data outside Singapore. We transfer personal data overseas only where the recipient is bound by legally enforceable obligations, such as a contract, to give it a standard of protection comparable to the PDPA.

 

8. WHATSAPP AND MESSAGING

 

  • We use WhatsApp to answer enquiries, arrange appointments, send reminders and service messages, and, with your written consent, marketing.
  • Messages may be stored by us and linked to your enquiry or patient record. Only authorised staff can see them.
  • WhatsApp is run by Meta. Messages pass through its systems, and its own terms and privacy policy apply to your use of it.

 

9. COOKIES AND WEBSITE ANALYTICS

 

  • Essential cookies make the website work, for example remembering form entries.
  • Analytics cookies, such as Google Analytics, help us understand how the site is used. They collect device and browser information and an approximate location from your IP address. We use the results in aggregate.
  • Advertising and measurement tags from Google and Meta tell us whether our advertising reached people who then visited our site. We set these up so that health information you enter in forms, and details of your appointment, are not sent to them.
  • You can control cookies through your browser settings. Turning cookies off may affect how the site works.

 

10. SECURITY AND DATA BREACHES

 

We maintain reasonable administrative, physical and technical safeguards against unauthorised access, use, disclosure, copying, modification and loss. Access to patient records is limited to staff who need it. No system is completely secure.

If a data breach is likely to cause you significant harm, or affects 500 or more people, we will notify the Personal Data Protection Commission and, where required, the people affected, within the time the PDPA sets.

 

11. HOW LONG WE KEEP YOUR DATA

 

  • Medical records: for the period set by the Ministry of Health for patient health records, which is 6 years from your last visit (longer for children).
  • Enquiries from people who do not become patients: 12 months from your last contact, then deleted.
  • Billing and accounting records: for the period required by tax and company law which is 5 years.
  • Marketing consent records: while consent is in force and for 2 years after withdrawal, to prove we honoured it.

When we no longer need data for a legal or business purpose, we delete it or anonymise it.

 

12. YOUR RIGHTS

 

  • Access: you can ask for a copy of your personal data and for information on how we have used or disclosed it in the past year. We respond within 30 days. If we need longer, we tell you in writing within those 30 days when we will respond. We may charge a reasonable fee for access, and we give you a written estimate first. We may decline in the cases the PDPA allows and will tell you why.
  • Correction: you can ask us to correct your data. There is no charge. We correct it as soon as practicable and send the correction to organisations we disclosed it to in the past year. For clinical records we may add a dated correction note rather than overwrite the original entry, so the record stays complete.
  • Withdrawing consent: you can withdraw consent for any use or disclosure, including marketing, by contacting us. We tell you the likely consequences and give effect to your request within 10 business days. Withdrawal does not affect anything done before it, and we may keep data we are legally required to keep.
  • Information: you can ask about our data protection policies and practices.

To make a request, contact our Data Protection Officer (section 15) with your full name, contact details and a description of your request. We may need to verify your identity first.

13. CHILDREN AND YOUNG PEOPLE

 

  • For a child under 13, a parent or legal guardian gives consent and exercises rights on the child’s behalf.
  • From age 13, a young person can give consent for the use of their data if they understand this policy. We may ask a parent or guardian to be involved where we think it is needed.
  • Consent to medical treatment for young patients follows our clinical consent process and the law, and is separate from this policy.
  • If you are under 18 and want help understanding this policy, ask our staff. We will explain it in plain language.

 

14. CHANGES TO THIS POLICY

 

We may update this policy. The current version, with its effective date, is always on our website. If a change means we want to use your data for a new purpose that needs your consent, we will ask you again. Continuing to use our website or services is not consent to a new purpose.

 

15. CONTACT US

 

Data Protection Officer
ONEVISION EYE PTE. LTD.
3 Mount Elizabeth #13-10 Mount Elizabeth Medical Centre Singapore 228510
Telephone: +65 8603 8980
Email: dpo@onevision.com.sg

Last updated: 18th October 2026