Statement of Policy
The Office of the Government Chief Information Officer (OGCIO) is concerned to ensure that all personal data submitted through the website of the “LeaveHomeSafe” initiative and related mobile app(s) (referred to as the “System”) is handled in accordance with the relevant provisions of the Personal Data (Privacy) Ordinance (PDPO).
When we collect personal data from individuals, we will provide them with a Personal Information Collection Statement (PICS) on or before the collection in the same paper/electronic form or web page that collects the personal data.
Statement of Practices
Types of Personal Data Collected and Purposes of Collecting Personal Data
We collect personal data from the System on a voluntary basis. We only collect personal data with the user’s consent and this data may include name, telephone number, e-mail address, visit records, identity document number, Hong Kong Health Code System login account information (including identity document type, number and issuing country/region), COVID-19 vaccination records (all references to vaccination records hereafter include vaccination records and, if applicable, COVID-19 Vaccination Medical Exemption Certificate, COVID-19 Recovery Record and COVID-19 Provisional Vaccine Pass) and testing results and relevant information contained in the records or other information that may be provided in relation to the System (collectively referred to as “the Data”). The Data will be used for exposure notifications to app users, facilitating the work of the Government in controlling the spread of COVID-19 and related purposes.
The OGCIO will record visits to the website without collecting any personal identifiable information of users. Such general information is only collected for the compilation of statistical reports and the diagnosis of problems concerning computer systems to help improving the website.
(For the avoidance of doubt, the app will use the phone's camera function to scan the venue's QR code in the “Enter” function. In the "Get On" function, the app will take a photo of the taxi registration mark and may upload it to cloud service for Optical Character Recognition to facilitate the input of the taxi registration mark. The photo is used for temporary processing only. It will not be stored and does not involve the collection of any personal information.)
Users may at their sole discretion choose to keep an electronic copy of their personal COVID-19 vaccination records and testing results together with the QR code in the app. To facilitate the work of the Government in controlling the spread of COVID-19 and implementation of Red / Amber code and related purposes, the app may upload the vaccination records to the government systems. Subject to the above, users can scan the QR codes of the vaccination records and testing results with the mobile phone camera or import the image of the QR code from the mobile phone and store the information in the app. Users will have complete control over the vaccination and testing records and the QR codes kept in the app, and can remove the records from the app.
Only with their express consent, users may at their sole discretion upload their visit records and notification records from the LeaveHomeSafe mobile app to the Hong Kong Health Code System for the application of Hong Kong Health Code and its related purposes as well as facilitating the work of the Government in controlling the spread of COVID-19 and related purposes.
[The visit record, which by itself in isolation is not personal data, will be kept in users’ mobile phones for 31 days and will then be erased automatically.]
Disclosure of Personal Data
Personal data will only be used, disclosed or transferred for the purposes or any directly related purposes for which it is collected or where it is allowed under the PDPO.
The OGCIO will take appropriate steps to protect the personal data we hold against loss, unauthorised access, use, modification or disclosure.
Retention of Personal Data
Personal data will not be kept longer than is necessary for the fulfilment of the purpose for which it is collected. Different retention periods apply to various kinds of personal data collected and held by the OGCIO in accordance with its policies on personal data protection.
Data Access and Correction / Enquiries
Request for access to and correction of the personal data provided in the website or enquiries should be made by any one of the following means: (a) by email to firstname.lastname@example.org; (b) by fax to 2802 4549; or (c) by post to 12/F, Treasury Building, No.3 Tonkin Street West, Cheung Sha Wan, Kowloon.