1. SAMH & SACS aims to comply with the requirements of the Personal Data Protection Act 2012 and apply its obligations to our processes to safeguard your personal data. This notice (“Data Protection Notice”) aims to inform you how SAMH & SACS manages the personal data under its possession or control.
2. Personal data refers to data, whether true or not, about an individual who can be identified from that data; or from that data and other information to which the organisation has or is likely to have access.
3. The personal data SAMH & SACS collects, uses and discloses include but are not limited to:
• name, NRIC, passport or other identification number, photos, biodata;
• telephone number(s), mailing address, email address,
• family members’ information, employment history, education background, bank account information, credit card information, medical records
4. SAMH AND SACS only collects, uses or discloses personal data appropriate for the intended business you engage SAMH AND SACS for. Generally, SAMH AND SACS collects, uses and discloses personal data:
• when you apply and/or use any of the services provided by us or our authorised service providers;
• when you apply to and/or volunteer, intern or work for us;
• when you apply to and/or donate to us;
• when you apply to be our society member;
• when you register for and/or attend any of our events;
• when you access our facility and/or website;
• when you perform a financial transaction with us;
• when you submit a feedback and/or a request for contact;
• other purposes which are reasonably related to the aforesaid
5. SAMH AND SACS will notify and obtain consent for collection, use or disclosure of personal data. If you provide the personal data belonging to others, you warrant that you have informed the individuals of the purposes for which we are collecting their personal data and that they have consented to your disclosure of their personal data to us for those purposes.
6. For the purpose of disclosure, SAMH AND SACS will seek relevant consent for the purpose in delivering relevant care / service(s). SAMH AND SACS being part of the public healthcare and social service system, will operate under a “deemed consent” framework for collection, use and disclosure of data for the delivery of our care services. Parties to which the personal data may be disclosed to include relevant public agencies, agencies acting on behalf of public agencies, relevant healthcare and social-care providers, welfare funds, approved private medical insurers, etc.
7. If there is a purpose for use and disclose beyond what has been consented for or the purpose you engage us for, SAMH AND SACS will notify and obtain new consent from you.
8. You may (i) withdraw any consent, (ii) request for access, or (iii) request for correction of your personal data given or deemed to have been given.
We will respond to your requests within the following timeframes:
• Requests to withdraw consent for the collection, use or disclosure of personal data will be processed within ten (10) working days of receipt of the request, subject to any legal, regulatory or operational requirements.
• Requests for access to or correction of personal data will be responded to within thirty (30) days of receipt of the request.
Where we are unable to respond within the stipulated timeline, we will inform you in writing within that period of the estimated date by which we will be able to provide a response. If we are unable to provide access or make a correction, we will generally inform you of the reasons for our decision, except where we are not required to do so under the PDPA.
There are some circumstances where we are not required to provide you with information, and others where we are not allowed by the PDPA to do so. In those circumstances we may be able to provide you with limited information. You may obtain more information about these circumstances from our Data Protection Officer.
9. SAMH AND SACS will cease to retain personal data if the legal or business purpose(s) for which data was collected is no longer valid.
10. SAMH AND SACS maintains appropriate security measures to protect your personal data from unauthorised access, collection, use, disclosure, deletion, disposable, loss and other risks.Third-Party Sites: Our website may contain links to other websites operated by third parties independent of SAMH AND SACS. We are not responsible for the data protection practices of such websites. We encourage you to learn about the data protection practices of such third party websites.
11. SAMH AND SACS takes reasonable steps to ensure that personal data collected, used and disclosed is accurate, complete and up-to-date, taking into account the purposes for which the personal data is used and the interests of the individual. Personal data provided to us may be verified against supporting documents and through generally accepted practices and guidelines, including requests to sight original documentation where necessary.
To help us maintain accurate records, you should ensure that the personal data you provide to us is complete, accurate and current. If there are any changes to your personal data, please inform us as soon as possible by contacting our Data Protection Officer
12. Please direct any queries or complaints you have about the way in which we collect, use or disclose personal data about you to our Data Protection Officer. Generally, we are unable to deal with anonymous complaints because we are unable to investigate them. If you raise a complaint anonymously, we will nevertheless note the matter raised and, if possible, investigate and resolve it appropriately.
Whenever you make a complaint, our Data Protection Officer will seek sufficient information from you to enable us to investigate it. Please be prepared to provide, for example:
• the type of action, or lack of action, by us that has given rise to your concern;
• whether it was an isolated incident or is ongoing and, in the case of an isolated incident, when it occurred;
• a copy of any relevant correspondence or evidence you hold; and
• details about what you consider should have happened or should not have happened.
Upon receiving a complaint, our Data Protection Officer will investigate it and within thirty (30) days advise you of the outcome and the reasons for that outcome; or advise you that more time is needed and when it is expected to be resolved. If you are not satisfied with the outcome, you may take your complaint to the Personal Data Protection Commission.