1. Introduction
This Privacy Policy explains how PW APS Corp, trading and operating as P&W APS Corporation Limited, collects, uses, stores and protects information in the course of running a clinic scheduling desk. The desk books sessions, turns rooms, posts follow-up letters, reviews intake forms, walks equipment logs and audits quiet hours for the clinics it serves. This document describes the care applied to personal information gathered through that work and through the website at calmnessmedical.lol.
Privacy in a clinic is not an abstract legal concept. It is the drawn curtain, the closed door, the chart placed face down on the rail and the letter sealed before it leaves the desk. The scheduling office at Rm 2011 The Cloud, Tung Chau St, Tai Kok Tsui, Hong Kong - 999077, Hong Kong (HK) applies the same discipline to information it holds electronically that it applies to information held on paper. This policy sets out that discipline in plain terms so that anyone who deals with the desk can understand what happens to their information.
The policy applies to everyone who contacts the desk, submits a session request, receives a follow-up letter, completes an intake form or simply visits the website. Where a clinic served by the desk has its own privacy notice, that notice governs the clinical record held by the clinic, while this notice governs the scheduling work performed by P&W APS Corporation Limited.
We have written this policy without decorative styling so that it reads as a working document rather than a marketing page. We encourage you to read it in full. If any part is unclear, the contact section at the end provides the routes by which a question can be raised and answered.
2. Scope of This Policy
This policy covers information collected by P&W APS Corporation Limited in its capacity as a provider of computer integrated systems design and professional scheduling services, and by the developer entity PW APS Corp in respect of the website and supporting applications. It covers information collected by email, by telephone, through the contact form on this website, through written correspondence delivered to the office and through any scheduling records maintained by the desk.
The policy does not cover the clinical records held by a clinic as a data controller in its own right, nor does it cover websites operated by third parties that may be linked from this site. Where the desk acts on behalf of a clinic, the clinic remains the owner of the clinical record and the desk handles that record only on the instructions of the clinic. In those circumstances the clinic privacy notice governs the wider use of the record, and this notice governs the portion of the work performed by the scheduling office.
This policy also does not extend to information that is publicly available through lawful means, or to information that has been fully and irreversibly anonymised so that it can no longer be connected to a person. Such anonymous material may be used for planning and reporting without restriction because it no longer identifies anyone.
3. Who We Are
The entity responsible for the processing described in this policy is P&W APS Corporation Limited. The developer name used for the website and its supporting systems is PW APS Corp. Both names refer to the same operation, and correspondence addressed to either will reach the same office.
P&W APS Corporation Limited Rm 2011 The Cloud, Tung Chau St, Tai Kok Tsui, Hong Kong - 999077, Hong Kong (HK)Telephone: +15809979160
Website: https://www.calmnessmedical.lol
Questions about this policy, requests to exercise a privacy right or reports of a possible privacy incident may be sent to the email address above. A telephone call is also welcome where the matter is urgent, though written requests are preferred because they create a reliable record of the request and of the response.
4. Information We Collect
The information we collect falls into several categories, each tied to a specific part of the scheduling work. We try to collect the minimum needed to perform the duty in front of us, and we avoid collecting information that has no bearing on the scheduling task.
Identity and contact information
This includes names, email addresses, telephone numbers and postal addresses. It is collected when a session is booked, when a letter is prepared or when someone writes to the desk with a question. In most cases these details already exist in the referral passed to us by the clinic, and the desk simply records the portion needed to confirm a session or post a letter.
Scheduling information
This includes the session requested, the room assigned, the practitioner named, the expected length of the visit and any notes describing a preferred day or a protected hour. It is the working material of the booking desk and the rotation run, and it is stored on a board that is kept in a locked room when the desk is unattended.
Correspondence
This includes email messages, letters, notes taken during telephone calls and any attachments sent to the desk. Correspondence is kept so that the desk can answer questions that arise later and so that a follow-up letter never contradicts a note written earlier.
Technical information
When the website is visited, a small amount of technical information may be recorded by the hosting provider, such as the browser type, the page requested and the time of the request. This information is used for security and for understanding whether the site is working, and it is not combined with scheduling information.
We do not collect payment card details, national identity numbers or biometric information as part of the scheduling work. If a task ever required such data, it would be handled under a separate written arrangement and would not be gathered through this website.
5. Scheduling and Booking Data
The booking desk is the place where most personal information enters the office. A request arrives, a scheduler reads it, and the details needed to place the session are written on the board. We keep that writing deliberately spare. The board shows a session time, a room, a practitioner and a reference to the referral, and the deeper clinical detail stays with the clinic that supplied it.
When a session is amended, the amendment is written on a clip card beneath the board rather than scrubbed from the main sheet. This preserves a short history of the change so that a patient who was told one time is not quietly moved to another. Once the week closes, the clip card is filed with the weekly sheet and the two are stored together.
Protected slots held for urgent referrals are visible only to the scheduling team. The reason a slot is protected is recorded in a private note, not on the public face of the board, so that a visitor to the office cannot infer anything about a patient from the chart in front of them.
Scheduling information is used to place sessions, to plan room rotations, to prepare follow-up letters and to check that a promised appointment exists before it is confirmed in writing. It is not used for advertising, and it is not sold or rented to anyone.
6. Letters and Correspondence
Follow-up letters are prepared in weekly cycles, and each letter is matched to the session it refers to before it is folded. The information in a letter is limited to what the recipient needs in order to act on it: the session details, the next step and the way to reach the desk. We do not include clinical detail beyond what the clinic has asked us to carry.
Letters are sealed before they leave the desk and are posted at a fixed point in the week. Where a letter cannot be delivered, it is returned to the office, logged and held for a short period while the desk contacts the clinic to confirm the correct address. Returned letters are not left in an open tray and are not used as scratch paper.
Email correspondence is retained in the mailbox of the scheduling office. Messages are grouped by clinic and by week, so that a question about a past session can be answered without searching the whole mailbox at random. Attachments are removed once they have been used for their purpose and the session they relate to has closed.
7. Website and Technical Data
The website at calmnessmedical.lol is a small informational site. It describes the scheduling services of P&W APS Corporation Limited and provides a contact form. It does not host clinical records, it does not offer online booking, and it does not contain a patient portal. The site is deliberately kept simple so that there is very little technical data to protect.
The contact form on the contact page does not send a message to a server owned by the desk. Instead, it prepares an email in the visitor own mail program, which the visitor can read and edit before sending. This means the content of a message is held by the visitor email provider until the message is sent, and after that it is held in the scheduling mailbox under the rules described above.
Server logs kept by the hosting provider may record the internet address from which a page was requested, the browser type and the time of the request. These logs are inspected when there is a security concern or a fault to diagnose. They are not used to build profiles of visitors and are not joined to scheduling information.
9. How We Use Information
Information is used for the following purposes, each of which is tied to the scheduling work:
- To place a session on the board and confirm it to the person or clinic who requested it.
- To plan and record room rotation runs so that each room is reset between patients.
- To prepare, check and post follow-up letters in the weekly cycle.
- To review intake forms inside the fixed windows and to return questions to the referrer.
- To walk equipment logs and record the result of each round.
- To conduct quiet hour audits and assign a corrective line to a named person.
- To answer questions about a past session or a past letter.
- To protect the security of the office, the board and the records it holds.
- To meet a legal or regulatory obligation that applies to the operation.
We do not use scheduling information for any purpose that is incompatible with the purpose for which it was collected. If a new purpose arises, we will assess it before the information is used and will inform the relevant clinic or individual where the law requires it.
10. Lawful Basis for Processing
Where the law requires a lawful basis, we rely on one or more of the following. First, performance of an arrangement with a clinic to provide scheduling services, including the steps needed to set up and run a clinic week. Second, compliance with a legal obligation, such as the retention of records required by an applicable regulation. Third, the legitimate interests of the operation in running a safe and orderly scheduling office, balanced against the rights of the people whose information is held. Fourth, consent, where consent is the appropriate basis, for example when someone asks to receive occasional written information about the desk.
Where a clinic acts as the data controller and the desk acts as a processor, the lawful basis for the clinical record is established by the clinic, and the desk processes the record only on the instructions of the clinic. In that arrangement the desk does not decide the purpose of the wider processing and does not disclose the record except as instructed or as the law requires.
Consent, where relied upon, can be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, and it does not stop the desk from relying on another lawful basis where one applies to a particular task.
11. Sharing with Third Parties
We share information only where there is a clear reason to do so, and we share the minimum needed for that reason. The categories of recipient are limited and are described below.
Service providers
We use a hosting provider to serve the website and a postal or courier service to deliver letters. These providers receive only what is necessary to perform their function. A courier receives the envelope, not the clinical detail behind it. A hosting provider serves pages and does not receive scheduling records, because those records are not stored on the public website.
Clinics we serve
Where a clinic has referred a session to the desk, the clinic receives the confirmation, the rotation notes and the letter status that relate to its own patients. We do not share one clinic information with another clinic, even where both use the same scheduling desk.
Legal and regulatory recipients
We may disclose information where required by law, by a court order or by a competent authority acting under a lawful power. Where disclosure is permitted to be challenged, we will review the request carefully and will disclose only the portion that is genuinely required.
Professional advisers
Our legal and accounting advisers may see records where necessary to advise on a specific matter. They are bound by professional duties of confidence in addition to the safeguards described in this policy.
We do not sell personal information. We do not rent mailing lists. We do not trade scheduling information for advertising space or for access to another service.
12. Clinic Practitioners and Partners
The desk works alongside practitioners, room leads and clinic administrators. These people see the portion of the board that concerns their own sessions. A practitioner sees the session time, the room and the note needed to prepare, but does not see the confidential notes of another clinic or another practitioner.
Where a clinic partner supplies a referral, the desk records the source of the referral so that a question can be traced back to the right person. Referral sources are kept in a private schedule and are not displayed on the public face of the board.
Partners who work with the desk are asked to observe the same privacy discipline. The written arrangement with a partner sets out what may be shared, how long it may be kept and how it must be protected. A partner who cannot meet that standard is not engaged for work that involves personal information.
13. Retention of Records
Records are kept for as long as they are needed for the purpose for which they were collected, plus any period required by law. In practice the desk applies the following retention pattern.
Weekly scheduling sheets and clip cards are kept for the current week and a short trailing period, then archived with the month to which they belong. Archived scheduling records are kept for the period set by the clinic arrangement or by an applicable regulation, after which they are securely destroyed. Where no specific rule applies, the desk keeps archived scheduling records for no longer than is reasonably necessary to answer a question about a past session.
Correspondence is kept while the related clinic week is open and for a short period afterwards. Messages that have no continuing value, such as a one-line confirmation with no accompanying request, are deleted once the week has closed. Messages that record a decision, an amendment or a complaint are kept for the full archive period because they may be needed to explain what happened.
Server logs are kept for a short operational period and are then removed. Technical data is not retained for the purpose of building a long-term visitor profile, so there is no long-term technical archive to delete.
14. Security Measures
The office is secured by a locked door, and the board is covered when the desk is unattended. Paper records are stored in a cabinet that is locked at the close of the day. Electronic records are held in accounts protected by strong passwords and, where available, a second factor at sign-in.
Access to scheduling records is limited to the people who need them to do the work. A scheduler who leaves the operation has access removed on the day of departure, and any paper record that person held is returned to the cabinet. Devices used for the desk are kept up to date, and storage that holds records is encrypted where the platform supports it.
Letters are checked twice before they are sealed: once against the session and once against the name and address. A letter that fails either check goes back to the desk rather than into the post. Returned letters are logged and held securely until the correct address is confirmed.
No system is perfectly secure, and we do not claim otherwise. What we can say is that we review our measures regularly, that we keep the number of people with access as small as the work allows, and that we respond promptly when a weakness is found.
15. International Transfers
The scheduling office is based in Hong Kong, and the records it holds are normally kept within Hong Kong. Some service providers, such as a hosting platform or an email provider, may store data in another jurisdiction. Where that happens, we take steps to ensure that the information remains protected to a standard consistent with this policy.
Those steps may include a written agreement that imposes privacy obligations on the provider, a review of the provider security practices, and a preference for providers that allow the location of stored data to be chosen. We do not transfer scheduling records to a jurisdiction where we cannot obtain a reasonable assurance of protection.
Where a clinic arrangement requires records to remain in a particular location, the desk follows that requirement and does not move the records without written agreement. A question about the location of a record can be raised through the contact address at the end of this policy.
16. Your Rights
Subject to the law that applies to you, you may have the right to ask for a copy of the personal information we hold about you, to ask us to correct information that is wrong, and to ask us to delete information that we no longer have a lawful reason to keep. You may also have the right to ask us to restrict how information is used, to object to a particular use, and to receive a portable copy of information you provided to us.
To make a request, write to scheduling@calmnessmedical.lol or to the postal address in section 3. Please describe the information you are asking about and, where relevant, the clinic week or letter to which it relates. We may need to confirm your identity before we act, because we will not release scheduling information to a person who cannot show that they are entitled to it.
We aim to respond within a reasonable period and, where a statutory deadline applies, within that deadline. If we cannot fulfil a request, we will explain why. If a request concerns a clinical record held by a clinic, we will forward it to the clinic and tell you that we have done so, because the clinic is the controller of that record.
Where a right applies only in certain circumstances, such as the right to deletion, we will explain the limits in our response. A request that would require us to delete a record we are legally obliged to keep will be refused in part, with a clear explanation of the obligation.
17. Privacy for Children
The scheduling desk serves clinics whose patients may include children. Information about a child is handled with the same care as information about an adult, and with the additional care that the circumstances call for. A child is never asked to confirm a session directly, and correspondence about a child goes to the parent, guardian or clinic contact named in the referral.
We do not knowingly collect information about a child through the website. The contact form is intended for adults acting for a clinic or for themselves. If we learn that a child has sent information through the form without the involvement of a parent or guardian, we will remove that information from the mailbox and, where appropriate, tell the clinic that referred the child.
Where the law requires the consent of a parent or guardian for a particular use, we will obtain that consent before the use begins and will record how and when it was given. Consent given for a child can be withdrawn by the parent or guardian at any time.
18. Marketing Communications
The desk does not send marketing email to patients. It does not use scheduling information to build an advertising audience, and it does not pass a patient address to a marketing list. Letters sent in the follow-up cycle are service letters, not promotional material.
Where a clinic contact has asked to receive occasional written information about the scheduling desk, such as a note when the intake windows change, that contact can be ended at any time by reply or by a message to the address in section 3. The desk keeps a short suppression list so that a person who has opted out is not contacted again by mistake.
The website does not carry third party advertising. If that ever changes, this policy will be updated before any advertising is introduced, and no scheduling information will be used to target an advertisement.
19. Automated Decisions and Profiling
Scheduling decisions at this desk are made by a person. A session is placed on the board by a scheduler who reads the request and checks the available slots. A rotation run is planned against the rooms and the day, not by an algorithm. Follow-up letters are matched by hand to the sessions they refer to.
We do not use automated decision making that produces legal effects for an individual, and we do not build profiles of patients for the purpose of predicting behaviour or setting prices. The board may sort sessions by time and room, but sorting is a display convenience and does not decide who is seen.
If a future tool were to automate part of the work, we would describe it in an updated policy and would keep a person in the loop for any decision that affects a patient directly. A patient who believes an automated decision has been made about them may ask for a review, and a person will examine the matter.
20. Data Breach Response
A data breach is any incident that leads to the accidental or unlawful destruction, loss, alteration or disclosure of personal information. We take such incidents seriously and follow a short, clear procedure when one is suspected.
First, the incident is contained. Access is removed, a device is isolated or a misplaced letter is retrieved, so that the exposure stops growing. Second, the nature and extent of the incident are assessed: what information was involved, whose information it was and what harm could reasonably follow. Third, the relevant clinics are informed without undue delay where their records are affected. Fourth, where the law requires it, a report is made to the competent authority and, where the risk to individuals is high, the affected individuals are told what happened and what they can do.
A record of every incident, including a near miss, is kept so that the desk can learn from it. The record describes what happened, what was done and what has changed. Where a letter is sent to the wrong address, it is logged as an incident even where the envelope is returned unopened, because the pattern of such errors matters more than any single one.
21. Changes to This Policy
We review this policy when the work of the desk changes, when a legal requirement changes or when a new service provider is engaged. A material change is described at the top of the policy with a new effective date, and the older version is kept in the office so that a question about a past practice can be answered accurately.
Where a change affects how information is used, we will inform the clinics we serve before the change takes effect, so that they have time to raise a question or adjust their own notice. We will not apply a new use to information already collected without a proper basis, and where consent is the basis, we will seek it again.
This policy is published on the website so that it is available at any time. A copy in paper form can be provided on request to the address in section 3.
22. How to Contact Us
For any question about this policy, any privacy request or any concern about how information has been handled, please use the details below. We read every message and we reply in the order in which messages arrive, except where a matter is urgent.
P&W APS Corporation Limited Rm 2011 The Cloud, Tung Chau St, Tai Kok Tsui, Hong Kong - 999077, Hong Kong (HK)Email: scheduling@calmnessmedical.lol
Telephone: +15809979160
If you are not satisfied with our response, you may raise the matter with the privacy authority that applies to you. We will cooperate with a competent authority that examines a complaint, and we will provide the records it lawfully requests.
This policy was written for P&W APS Corporation Limited and the developer entity PW APS Corp. It applies to the scheduling desk at the address above and to the website at calmnessmedical.lol.
Return to the P&W APS Corporation Limited homepage