Our approach
The Hong Kong Society for Radiotherapy and Oncology (“the Society”, “we”) handles personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) (opens in a new tab) (“the Ordinance”).
This statement describes the personal data this website collects and the purposes for which the Society uses it. It is written to cover the items in the Privacy Commissioner’s Guidance on Preparing Personal Information Collection Statement and Privacy Policy Statement (opens in a new tab) (July 2013).
What “personal data” means
The Ordinance defines personal data as data that relates directly or indirectly to a living individual, from which it is practicable to ascertain the identity of that individual, and that is in a form in which access to or processing of the data is practicable.
Personal data this website holds
Membership application. If you apply, the form asks for:
- salutation
- first name and last name
- email address
- institution or organisation
- profession
- specialty
- an optional message
The form does not ask for a Hong Kong identity card number, a telephone number, a date of birth, or a home address.
Member account. If an application is approved, the Society keeps those details and also a membership number, the account status, and the account password in hashed form. A photo is held only if staff upload one. You can see your own profile when you are signed in. The public member directory is not published.
Sign-in and password reset. Signing in uses your email address and password. If you ask for a password reset, the Society emails a reset link to that address. The link expires in one hour.
Other forms. A form published on a page collects the fields shown on that form. Submissions are stored by the Society. They are emailed onwards only when that form is set up to send an email.
Council profiles. The Society publishes the name, role, biography, and photograph of council members on this website.
Events and courses. Some event pages accept registrations on this website; others link to an external registration page. Course registration buttons may also open an external page. Data submitted to an external site is collected under that site’s notice.
Event registrations and attendance. For members and guests, the Society records the attendee’s name, email, answers to the event’s registration questions, approval decision, confirmation delivery, and check-in time. Staff may record a reason when admitting a walk-in. Approved attendees receive an event QR identifier, which staff use to find their registration at the desk. A member may also show the QR in their profile. Public event applications are reviewed before approval.
Why we use it
The Society uses this personal data to:
- consider a membership application
- administer membership and provide resources that are limited to members
- send account emails, including an approval email that contains a temporary password, and a password-reset email
- reply to a message sent with an application or with another form
- operate and secure this website
- review event applications, send event confirmations, and record attendance
- send the Society’s newsletters and information about its events, courses, and activities, in the way described under “Newsletters and event information”
What you must provide
On the membership application, salutation, name, email address, institution, profession, and specialty are required. If you do not provide them, the Society cannot process the application. The message is voluntary.
To sign in, your email address and password are required. If you do not provide them, you cannot sign in. To ask for a password reset, your email address is required. If you do not provide it, the Society cannot send a reset link.
On any other form, a field marked as required must be completed for that form to be submitted. If it is not, the Society cannot receive the submission.
For an event application, name, email, and any question marked required are needed to review the application and contact the attendee. Other event questions are voluntary.
Who may receive it
The Society may provide personal data to these classes of persons:
- Resend, which delivers the Society’s email when email sending is configured, including approval emails, password-reset emails, selected event confirmations, and form notifications that a form is set up to send
- Vercel, which hosts this website, stores uploaded files when file storage is enabled, and receives the visitor statistics described under “Cookies and visitor statistics”
- the provider of the database in which the Society stores these records
- staff who need the record for a purpose listed above
- a law-enforcement or regulatory authority, where Hong Kong law requires the Society to disclose the data
The Society does not sell personal data. It does not publish membership applications. It does not provide personal data to other parties for those parties to use in their own direct marketing.
Newsletters and event information
The Society intends to use your name and email address to send you the Society’s newsletters and information about the Society’s events, courses, and activities.
The Privacy Commissioner’s guidance states that personal data must not be used for direct marketing unless the person has given consent or indicated that they do not object. That guidance refers to sections 35C and 35J of the Ordinance.
To agree, or to object, email info@hkstro.org. Say whether you agree or object, and include the email address the Society holds for you. Submitting a form on this website is not, by itself, that consent or indication.
How long we keep it
The Society does not keep personal data longer than is necessary for the purpose for which the data is or is to be used.
How we protect it
- Membership applications and member records in the administration area are available to signed-in staff.
- Account passwords are stored in hashed form.
- After five unsuccessful sign-in attempts, further attempts are blocked for 10 minutes.
- Files limited to members are provided through the Society’s download page to an approved member who is signed in, rather than as a public file link.
- This website is served over an encrypted HTTPS connection.
Cookies and visitor statistics
When you sign in, the website stores a cookie named payload-token in your browser. It is the session for your member account and it expires after two hours. If your browser blocks that cookie, you cannot stay signed in.
This website also loads Vercel Web Analytics and Vercel Speed Insights. What those services record is set out in Vercel’s own notices, which are the source for the following description.
Vercel Web Analytics (opens in a new tab) does not use third-party cookies. Vercel states that a visitor is identified by a hash created from the incoming request, and that this session identifier is discarded after 24 hours. Vercel states that each recorded point may include the time, the page address, the route, the referring page, filtered query parameters, geolocation (which can include country, region, and city), the operating system, the browser, the device type, and the analytics script version. Vercel states that these points are anonymous statistics and are not stored in a form that identifies a person or is associated with an IP address.
Vercel Speed Insights (opens in a new tab) records performance measurements. Vercel states that each point may include the route, the page address, network speed, browser, device type, operating system, country, the performance measurement, and the time the measurement was received. Vercel states that this is not tied to an individual visitor or an IP address.
The Society uses these statistics to understand how the website is used and how it performs. This website does not use Google Analytics or an advertising pixel.
Access and correction
You may ask the Society for access to personal data it holds about you, and you may ask the Society to correct that data.
You may use the Data Access Request Form published by the Privacy Commissioner (form OPS003), which is available from the Privacy Commissioner’s website (opens in a new tab). If the Society charges a fee for complying with a data access request, that fee must not be excessive.
Send a request by email to info@hkstro.org.
Questions about this statement
Questions about this statement can be sent to info@hkstro.org.
Statement date: 28 September 2026. The Ordinance is the law. This statement follows the Privacy Commissioner’s Guidance on Preparing Personal Information Collection Statement and Privacy Policy Statement (July 2013).