Privacy Policy
Last updated: 23 March 2026

BCHK Medical Group Limited trading as Alluna Medical (“Alluna Medical”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data and health information. This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit our website, contact us, book appointments, attend the clinic, receive treatment, communicate with us through social media or messaging platforms, or otherwise use our services.

This Privacy Policy should be read together with our Personal Information Collection Statement, consent forms, cookie notice and any other terms provided to you at the time your personal data is collected. Where there is any inconsistency, the more specific notice given at the point of collection will apply to that collection.​

1. Who we are
Data user: BCHK Medical Group Limited trading as Alluna Medical.​
Clinic address: Suite 2015A, 20/F, Hang Lung Centre, 2-20 Paterson Street, Causeway Bay, Hong Kong.​
Contact email: info@allunamedical.com.​

2. Scope of this Policy
This Policy applies to personal data collected through our website, online forms, booking systems, telephone calls, emails, WhatsApp, social media pages under our control, in-clinic registration, consultations, treatments, procedures, clinical photography and other patient interactions.

3. Personal data we collect
Depending on your interaction with us, we may collect:

• identification and demographic data, such as your name, date of birth, sex, HKID/passport or similar identifier;​

• contact and account data, such as phone number, email address, postal address, emergency contact and communication preferences;​

• appointment and service data, such as booking details, attendance records, payments, invoices and customer service records;​

• medical and health data, such as medical history, medications, allergies, previous procedures, consultation notes, diagnoses, examination findings, prescriptions, treatment plans, laboratory results, imaging reports and clinical photographs;

• technical and website usage data, such as IP address, browser type, device information, cookie data and website analytics;​

• communications content and metadata, including emails, forms, messages, call logs and complaint records.​

4. Sources of personal data
We may collect personal data directly from you, from someone acting on your behalf, from your treating doctors or referrers, from laboratories or imaging centres, from insurers or payment providers, and from publicly available or lawfully accessible sources where relevant to your care or our operations.

5. Purposes of use
We use personal data for purposes directly related to our healthcare and clinic operations, including registration, identity verification, appointment management, medical assessment, diagnosis, treatment, continuity of care, treatment planning, referrals, laboratory and imaging coordination, billing, insurance administration, service communications, complaint handling, quality assurance, risk management, staff training, IT administration, cybersecurity, audit, and compliance with legal and professional obligations.

We may also use de-identified or aggregated information for service improvement, internal reporting and operational analytics where lawful and appropriate.​

6. Lawful and fair handling
We aim to collect personal data only where it is necessary, adequate and not excessive for the relevant purpose, and to handle it in a lawful, fair and transparent manner. If we wish to use personal data for a new purpose that is not the original purpose or a directly related purpose, we will seek the consent required under the PDPO unless an exemption applies.​

7. Disclosure and transfer
We may disclose personal data on a need-to-know basis to healthcare professionals and service providers involved in your care or in operating the clinic, including laboratories, imaging centres, pharmacies, hospitals, insurers, payment processors, IT and cloud vendors, messaging providers, document management providers, legal or professional advisers, auditors and regulators. Such disclosure will be limited to what is reasonably necessary and subject to confidentiality or contractual safeguards where applicable.

We may also disclose personal data where required, authorised or permitted by law, court order, professional obligation, public health requirement, law enforcement request, or where necessary to protect your vital interests or those of another person.​

8. Clinical photographs
Where clinical photographs or videos are taken for identification, assessment, treatment planning, monitoring, documentation or continuity of care, they form part of your confidential medical record. Any use of photographs or videos for publication, teaching, testimonials, website content, social media or other marketing purposes will be subject to separate consent where required.

9. Security
We take practicable administrative, technical and physical steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. These measures may include role-based access controls, secure passwords, device protection, encrypted or access-controlled systems, restricted staff access, secure backups, staff confidentiality obligations and vendor controls.

10. Retention
We retain personal data only for as long as reasonably necessary for the fulfilment of the purposes for which it was collected, and thereafter as required or permitted by law, regulatory expectations, professional guidance, insurance, audit, dispute resolution or legitimate business needs. When personal data is no longer required, we will take practicable steps to erase or anonymise it unless retention is required or justified by law.​

11. Data access and correction
You have the right under the PDPO to request access to and correction of your personal data held by us. Requests should be made in writing to our Data Privacy Officer at info@allunamedical.com or by post to our clinic address marked “Access to Personal Data”. We may charge a reasonable fee for a data access request as permitted by law, and we may require proof of identity before processing the request.

12. Direct marketing
We may wish to send you information about services, events, educational content, promotions or updates relating to medical and aesthetic services. We will only do so in compliance with Part 6A of the PDPO, which means we will first provide the required information and obtain your express and voluntary consent or indication of no objection in the prescribed manner. You may opt out at any time, free of charge, by using the unsubscribe method in the message or contacting us in writing. Service and care-related communications are not direct marketing.​

13. Cookies and analytics
Our website may use cookies and similar technologies to enable site functions, remember preferences, understand website usage and improve performance. Some cookies are necessary for the operation of the website, while others support analytics or functionality. You may adjust your browser settings to reject or manage cookies, but some website features may not function properly if you do so.​

If you use third-party platforms such as Instagram, Facebook, Google, WhatsApp or embedded tools linked from or integrated with our website, your use of those platforms is also subject to their own privacy terms and cookie practices.​

14. Third-party links
Our website may contain links to third-party websites or platforms. We are not responsible for the privacy, security or content practices of those third parties, and you should review their policies separately.​

15. Children and persons lacking capacity
Where services are provided to minors or persons lacking legal capacity, personal data may be provided by a parent, guardian or authorised representative, and consents or requests may be handled through that person in accordance with applicable law and professional obligations.​

16. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in law, technology, our practices or our services. The latest version will be posted on our website with the updated effective date.

17. Contact us
Data Privacy Officer / Personal Data Officer
BCHK Medical Group Limited trading as Alluna Medical
Suite 2015A, 20/F, Hang Lung Centre, 2-20 Paterson Street, Causeway Bay, Hong Kong
Email: info@allunamedical.com