Đang tải…
Bệnh viện Đa khoa Trà Vinh
test 123

Personal Data Protection Policy

Version 1.1 — effective from 23 October 2026. Draft: items in square brackets are proposals or information the hospital must provide before publishing.

Tra Vinh General Hospital (“the Hospital”, “we”) respects and protects the personal data of patients, relatives and website visitors under the Law on Personal Data Protection No. 91/2025/QH15 and Decree 356/2025/ND-CP. This policy explains what data the website collects, why, how long it is kept, who can access it and how you exercise your rights.

1. Data controller and processor

  • Name: Tra Vinh General Hospital (Bệnh viện Đa khoa Trà Vinh; governing body: Vinh Long Department of Health).
  • Address: Số 399, Đường Nguyễn Đáng, P. Nguyệt Hoá, Vĩnh Long
  • Phone: 02943 862553 — Email: banbientaptvh@gmail.com
  • Data protection contact: [PROPOSAL, hospital to review] IT Department — email baomatdulieu@bvtravinh.vn, phone [HOSPITAL TO FILL].

Tra Vinh General Hospital is the controller and processor of personal data. [HOSPITAL TO FILL website operator] is a personal data processor under contract No. [..] dated [..]. [Keep only once the contract is signed.]

2. Data we collect

  • Appointment booking: full name, date of birth, gender, phone, email, address, personal identification number, health-insurance card number and issue date, patient code (if any), specialty, date/session, symptoms and uploaded appointment/referral documents.
  • Tissue/organ donation registration: identity details, personal identification number, blood group, medical history and other health information.
  • Support / contact requests: name, phone, email, request type and message.
  • Quality evaluation: the answers you give in the survey.
  • Newsletter: email address. Consultation popup: phone number.
  • Technical data: IP address, browser type, access and error logs for security; cookies as described in section 9.

Sensitive personal data processed by the Hospital: health information (symptoms, specialty, appointment/referral documents) and donation registration data (blood group, medical history). The personal identification number is basic personal data but is protected like sensitive data.

3. Purposes and legal basis

Data is used only for the purpose stated next to each consent box: booking appointments, verifying health insurance and confirming appointments; receiving and managing donation registrations; handling support requests; surveying and improving quality; sending the newsletter; consultation callbacks; keeping the website secure. The legal basis is your consent (recorded with a timestamp and policy version); donation registrations are also processed under legal obligations. We never sell personal data or use health data for advertising.

If you do not provide the data or do not consent, the Hospital cannot book your appointment online; you can still book by phone on 02943 862553 or in person.

Health information is kept confidential under Article 10 of the Law on Medical Examination and Treatment. Donation registrations are notified to the National Coordinating Center for Human Organ Transplantation under Article 18(2) of Law 75/2006/QH11. People under 18 cannot register as donors.

4. Retention [PROPOSAL, hospital to review]

  • Booking requests and attachments: 12 months after the requested appointment date. Data that becomes part of a medical record is kept under medical-record rules [HOSPITAL TO FILL period].
  • Donation registrations: until you withdraw or as required by the law on tissue and organ donation.
  • Support requests and quality surveys: 24 months.
  • Newsletter email: until you unsubscribe. Popup phone numbers: 6 months.
  • Consent evidence: kept as long as the related data.
  • Technical and error logs: up to 90 days.

When the period ends, data is deleted or destroyed irreversibly, including backups, unless the law requires longer retention.

5. Who can access your data

Only Hospital staff authorised for the relevant function. Technical providers process data only under contract and on the Hospital’s instructions:

  • Website developer/operator and hosting: [HOSPITAL TO FILL provider]; servers and backups located in Vietnam.
  • Email (SMTP) provider for confirmations and notifications: [HOSPITAL TO FILL].
  • Cloudflare Turnstile: anti-bot check on pages with forms.
  • Sentry: technical error monitoring with form content and identifiers filtered out; on the public website it runs only after you accept analytics cookies.
  • Only with your cookie consent: Google (Analytics, Tag Manager, Maps, YouTube), Zalo.

Data is disclosed to competent authorities only when required by law.

6. Transfers outside Vietnam

Google Analytics/Google Tag Manager (if enabled), Cloudflare Turnstile and Sentry may process your IP address and browser details outside Vietnam.

7. Your rights and how to exercise them

You have the right to be informed, to consent, to withdraw consent, to access, correct and obtain your data, to request deletion, to restrict or object to processing, to complain, denounce, sue and claim compensation. Withdrawing consent does not affect processing carried out before.

Send requests using [HOSPITAL TO FILL form link] to baomatdulieu@bvtravinh.vn or in person at Số 399, Đường Nguyễn Đáng, P. Nguyệt Hoá, Vĩnh Long. We acknowledge requests within 72 hours [PROPOSAL, hospital to review] and resolve them within the time limits of Article 5 of Decree 356/2025/ND-CP:

  • Withdrawal of consent, restriction, objection: 15 days.
  • Access, correction, provision of data: 10 days.
  • Deletion: 20 days.
  • Each type may be extended once up to the legal maximum.

8. Children

For people under 16, a parent or guardian fills in the form and consents on their behalf; children aged 7 and over must also consent [PROPOSAL, hospital to review: confirm the age threshold against Article 24 of Law 91/2025/QH15]. This does not apply to donation registration.

9. Cookies

Strictly necessary cookies (language, Cloudflare Turnstile anti-automation token, admin session, your cookie choice, article/popup view counters that keep aggregate totals only with no IP or identifier) are always on. Functional, analytics and marketing cookies load only after you consent in the cookie banner and are off by default. You can change or withdraw your choice at any time with “Cookie settings” in the footer.

10. Security and incidents

Sensitive data is encrypted in transit and at rest; access is role-based and logged; the admin area is IP-restricted. In the event of a breach, the Hospital notifies the personal data protection authority (Ministry of Public Security) within 72 hours and informs you when the incident may cause harm.

11. Versions and changes

Version 1.1, effective from 23 October 2026. Change history: 1.0 — first draft; 1.1 (23 October 2026) — legal review update: separate health-data consent, donation-intent box, shorter list of foreign recipients. When this policy changes we publish a new version on this page; the cookie banner asks for your choice again and forms record the new version. Changes to purposes or data categories require fresh consent.

12. Legal basis

  • Law on Personal Data Protection No. 91/2025/QH15.
  • Decree 356/2025/ND-CP detailing the Law on Personal Data Protection.
  • Law on Medical Examination and Treatment No. 15/2023/QH15 (as amended).
  • Law on Cybersecurity No. 116/2025/QH15.
  • Law on Donation, Removal and Transplantation of Human Tissues and Organs No. 75/2006/QH11.
  • Law on Identification No. 26/2023/QH15.