Privacy Policy

Effective date: 16 September 2026

This Privacy Policy explains how Precision Expert Holdings Limited collects, uses, stores, processes, discloses and protects personal data in connection with Occlus.

Occlus is a healthcare artificial intelligence company and applied AI lab operated by Precision Expert Holdings Limited, a company incorporated in Hong Kong. We develop healthcare AI infrastructure and AI-enabled software-as-a-service products, including practice-management and patient relationship management software (PMS/CRM), communications and workflow automation, clinical documentation technologies, and AI-assisted dental imaging systems.

References in this Privacy Policy to “Occlus,” “we,” “us,” or “our” mean Precision Expert Holdings Limited in connection with the operation of Occlus.

We are committed to handling personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”) and other applicable requirements.

1. About Occlus and our role

Occlus provides technology to healthcare clinics, including dental clinics, for functions such as:

• patient and clinical record management;
• appointment scheduling;
• patient relationship management;
• patient communications;
• billing and account administration;
• insurance record management;
• clinical documentation;
• dental and periodontal charting;
• document generation;
• workflow and booking automation;
• AI-assisted transcription and documentation;
• AI-assisted dental imaging analysis; and
• development and evaluation of healthcare AI systems.

For patient information held in Occlus, the clinic ordinarily determines why the information is collected and how it is used. The clinic is therefore generally the data user responsible for the patient’s clinical record under the PDPO.

Precision Expert Holdings Limited operates Occlus and processes information on the clinic’s instructions in order to provide the service.

Precision Expert Holdings Limited may separately determine how limited information is used for purposes such as platform security, account administration, legal compliance, service operation, fraud prevention and protection of the Occlus platform.

Nothing in this Privacy Policy reduces or replaces a clinic’s own professional, legal or regulatory responsibilities concerning its patients or their records.

2. Personal data we process

The information processed through Occlus depends on the services used by a clinic.

It may include:

Patient identification and contact information

• name;
• telephone number;
• date of birth;
• email address;
• residential or correspondence address;
• patient or clinic reference number;
• preferred clinic, branch or healthcare professional; and
• details of a parent, guardian or other person authorised by the clinic to act for the patient.

Appointment and communication information

• appointment dates and times;
• clinic location;
• assigned healthcare professional;
• appointment type;
• cancellations, rescheduling and attendance;
• recall or follow-up information;
• supported electronic communications;
• message delivery and status information; and
• records of whether a conversation was handled automatically or transferred to clinic staff.

Clinical information

Depending on the clinic’s use of Occlus, this may include:

• medical or dental alerts;
• allergies and relevant medical history;
• clinical notes;
• diagnoses and clinical observations;
• treatment history;
• proposed and completed treatment;
• treatment plans;
• dental charts;
• periodontal measurements;
• prescriptions or referrals recorded by the clinic;
• dental X-rays;
• clinical photographs;
• documents issued by the clinic; and
• other information forming part of the patient’s clinical record.

Financial and insurance information

Occlus may hold records of:

• treatment charges;
• invoices;
• payments received;
• outstanding balances;
• payment plans;
• insurer name;
• insurance membership or policy information;
• insurance claims recorded by the clinic;
• amounts claimed; and
• claim status or responses recorded by clinic staff.

Unless a separately disclosed payment service is introduced, Occlus does not require or store patients’ complete payment-card credentials.

AI-related information

Where applicable, Occlus may process:

• dictated speech for transcription;
• temporary consultation transcripts;
• draft clinical documentation;
• AI-generated suggestions or findings;
• dental-imaging analysis results;
• clinician acceptance, rejection or correction of AI findings; and
• technical information used to assess system performance.

Clinic-user information

For dentists, clinic employees and other authorised users of Occlus, we may process:

• name;
• professional role;
• clinic affiliation;
• business contact information;
• account and authentication information;
• permissions;
• login and security information;
• actions taken within the system; and
• audit records.

3. Where personal data comes from

Personal data may be provided:

• directly by the patient;
• by the clinic and its authorised personnel;
• through communications between a patient and the clinic;
• through records created during the provision of healthcare;
• from a clinic’s previous practice-management or patient-record system;
• through authorised communications platforms;
• through use of Occlus; or
• automatically as part of the technical operation and security of the service.

When a clinic moves to Occlus, it may instruct us to import existing records such as patient profiles, appointments, treatment information, clinical notes, financial balances or other records already held by the clinic.

Importing those records does not change the clinic’s responsibility for them.

4. How personal data is used

Personal data may be processed where necessary to:

• create and maintain patient records;
• book, confirm, reschedule and cancel appointments;
• send appointment and recall reminders;
• facilitate communications between clinics and patients;
• assist clinic staff with enquiries;
• identify the correct patient before information about previous appointments is disclosed;
• maintain clinical documentation;
• maintain dental and periodontal charts;
• store and display dental X-rays and clinical photographs;
• prepare treatment plans, referrals, certificates and other clinic documents;
• record charges, payments and account balances;
• maintain insurance information and claim records;
• support AI-assisted documentation and transcription;
• provide AI-assisted dental-imaging analysis;
• maintain security and access controls;
• maintain audit trails;
• investigate errors, misuse or security incidents;
• maintain, troubleshoot and improve the reliability of the Occlus platform;
• evaluate and improve Occlus technologies in accordance with this Privacy Policy and applicable law;
• provide clinics with operational statistics and reporting;
• comply with applicable legal and regulatory obligations; and
• protect the rights, safety and security of patients, clinics, users and Precision Expert Holdings Limited.

We seek to collect and process only information reasonably necessary for the relevant purpose.

5. Clinical records

Clinical notes, dental charts, periodontal charts, X-rays, photographs, treatment plans and other clinical records may be stored in Occlus on behalf of the clinic.

Access to clinical records is restricted according to user roles and permissions established for the clinic.

Occlus maintains audit records for access to sensitive clinical information. These records may identify who accessed a record and when the access occurred.

Where a clinical note has been completed and signed, Occlus treats the signed version as part of the clinical record.

A signed clinical entry should not be silently overwritten. Where correction is required, the correction may be recorded as a subsequent amendment or entry so that the history of the clinical record can be maintained.

The healthcare professional remains responsible for the accuracy and clinical content of the patient’s final record.

6. Artificial intelligence and automated processing

Occlus uses artificial-intelligence and automated-processing technologies to provide certain functions.

These technologies may assist with:

• patient communications;
• administrative workflows;
• transcription;
• preparation of draft clinical documentation;
• organisation of information;
• workflow automation; and
• dental-imaging analysis.

AI-generated content is intended to assist, rather than replace, clinic staff and qualified healthcare professionals.

Where AI is used in connection with clinical information, the responsible healthcare professional remains responsible for reviewing the relevant information and making clinical decisions.

Occlus may use specialist cloud infrastructure, artificial-intelligence processing, computing and other technology service providers to perform these functions on our behalf.

Relevant information concerning material service providers may be provided to clinic customers where reasonably required for contractual, security, privacy or regulatory due diligence.

7. AI-assisted clinical documentation

A healthcare professional may use Occlus to assist with preparing clinical documentation.

Dictation

A healthcare professional may dictate information instead of typing it.

Where this function is used, audio is processed for the purpose of converting speech into text.

Occlus does not intentionally retain a persistent copy of the source dictation recording after the transcription operation has been completed.

The resulting text remains a draft until it has been reviewed, corrected where necessary and approved by the responsible healthcare professional.

Once approved and signed, the final clinical note forms part of the patient’s clinical record.

Consultation transcription

A clinic may enable a function that assists a healthcare professional in preparing notes from a consultation.

Where this feature involves listening to or transcribing a consultation, the clinic is required to obtain the patient’s agreement before activating it.

Occlus records the relevant consent status in connection with the transcription process, and the interface indicates when the function is active.

The source consultation audio is used for processing and is not intentionally retained as a permanent patient recording.

A temporary written transcript may be created solely to assist preparation of the clinical note.

The temporary transcript is deleted when the related note is signed and, in any event, within 12 hours after the transcription session ends.

The temporary transcript is not itself treated as the patient’s final clinical record.

8. Periomind Dental Imaging Pilot

Periomind is an AI-assisted dental imaging technology developed by Occlus to assist qualified dental professionals in reviewing dental radiographs.

Periomind is currently provided to participating clinics on a limited pilot and evaluation basis.

Periomind may analyse a dental radiograph and identify possible findings for review by the treating dental professional.

Outputs produced by Periomind are intended to provide decision support.

They are not intended to replace the professional judgement of a qualified dentist and must not be relied upon as the sole basis for diagnosis, treatment planning or other patient-management decisions.

The responsible dental professional must independently review the radiograph, consider the patient’s clinical circumstances and determine the appropriate diagnosis and treatment.

During the pilot, we may assess matters including:

• technical performance;
• accuracy;
• reliability;
• false-positive and false-negative findings;
• clinician agreement and disagreement;
• corrections made by participating clinicians;
• system safety; and
• usability.

Periomind may be modified, restricted, suspended or withdrawn while its performance is evaluated.

9. Dental imaging data and system improvement

Occlus may use appropriately prepared dental imaging information and associated clinician feedback for:

• quality assurance;
• performance monitoring;
• validation;
• testing;
• safety evaluation;
• research and development; and
• improvement of Occlus dental-imaging systems.

We apply technical and organisational controls intended to prevent patient-identifying information from being included in information prepared for secondary model-development purposes.

These controls may include:

• removal of image metadata and embedded file information;
• removal of direct patient identifiers;
• detection and exclusion of images containing visible identifying information;
• separation of development information from the operational patient record;
• access restrictions; and
• clinic-level controls governing whether eligible information may be included.

The model-development function is disabled by default for a clinic unless the applicable feature has been enabled and the required contractual and privacy arrangements have been put in place.

Where information has been properly anonymised so that the relevant individual is no longer reasonably identifiable, it may be used for research, testing, validation and improvement of Occlus’s dental-imaging systems.

Where information remains personal data, its use remains subject to the PDPO. Where a proposed secondary use constitutes a new purpose for which prescribed consent is required, the relevant personal data will not be used for that new purpose unless the applicable requirements have been satisfied.

Occlus does not intentionally include the following in dental-imaging model-development datasets:

• patient names;
• telephone numbers;
• addresses;
• email addresses;
• patient communications;
• voice recordings; or
• free-text clinical notes.

An operational copy of the patient’s X-ray and the clinical findings associated with it may continue to form part of the patient’s clinical record independently of any anonymised development information.

10. Messaging and communications

Where a clinic uses Occlus to communicate with patients through third-party communications platforms, communications may be routed through specialist messaging infrastructure providers acting on our behalf and through the relevant communications platform.

These providers may process information required to transmit and deliver communications, including:

• telephone numbers or other recipient identifiers;
• message content;
• message status;
• delivery information; and
• associated technical information.

Such providers are used to support the transmission and operation of the communications service.

Occlus does not authorise those service providers to use patient information for their own unrelated direct-marketing purposes.

Where a third-party communications platform is used, that platform may also process information under its own applicable terms and privacy arrangements.

11. Insurance information

A clinic may use Occlus to record a patient’s insurance information and maintain records relating to claims.

This may include the insurer’s name, membership information, relevant charges, claim amount, date, status and responses received by the clinic.

Unless a separate insurance integration is specifically introduced and disclosed, Occlus does not itself transmit a claim to the patient’s insurer.

Occlus may record claim information or assist the clinic in producing documentation, while submission to the insurer remains the responsibility of the clinic.

12. Service providers and overseas processing

We engage service providers where reasonably necessary to operate Occlus.

The classes of service providers that may process information on our behalf include:

• cloud hosting and infrastructure providers;
• computing and data-processing providers;
• artificial-intelligence processing providers;
• communications and messaging infrastructure providers;
• cybersecurity and technical-support providers; and
• other professional or technical service providers required to operate and protect the service.

Personal data may therefore be stored or processed outside Hong Kong.

Where we engage a service provider to process personal data on our behalf, we take reasonable steps, including contractual and technical measures where appropriate, to require the provider to protect the information, restrict its use and avoid retaining it for longer than required for the relevant processing purpose.

We may provide additional information concerning material service providers to clinic customers where reasonably required for privacy, compliance, security or contractual due diligence.

13. Other disclosures of personal data

Depending on the circumstances, personal data may be disclosed to:

• the clinic responsible for the patient’s care;
• authorised dentists and clinic personnel;
• persons whom the clinic has properly recorded as authorised to act for the patient;
• service providers acting on our behalf;
• professional advisers where reasonably necessary;
• regulators, courts, government authorities or law-enforcement agencies where disclosure is required or authorised by law; and
• other persons where the patient has authorised the disclosure or where another lawful basis applies.

We do not sell patient personal data.

We do not disclose patient personal data to unrelated third parties for their own direct marketing.

14. Data retention

We do not intend to retain personal data for longer than is reasonably necessary for the purpose for which it is held, taking into account clinical, professional, contractual, legal and regulatory requirements.

The following are Occlus’s general retention periods unless a clinic is required or permitted to apply a different period.

Patient communications

Message content is generally retained for 90 days after the patient’s last message.

Where communication remains necessary in connection with an upcoming appointment, relevant contact information may be retained until that purpose has been completed.

After the applicable period, message content is deleted or identifying information is removed in accordance with our retention procedures.

Internal staff messages

Clinic staff use an internal message board inside Occlus to coordinate their day. Where a message is filed under a patient’s name, it is personal data about that patient and is included in a response to a data access request under section 18 of the Ordinance.

Internal staff messages are generally retained for 90 days after the message is written and are then deleted. They do not form part of the clinical record.

Temporary consultation transcripts

Temporary consultation transcripts are deleted when the associated clinical note is signed and in any event within 12 hours of the relevant transcription session ending.

Source consultation audio is not intentionally retained as a permanent recording.

Temporary import and export files

Temporary files created to import or export clinic information are generally deleted within 7 days after the relevant process has been completed.

Technical delivery records

Limited technical records used to prevent duplicate processing or diagnose message-delivery issues are generally retained for up to 30 days, unless a longer period is reasonably required to investigate a security or technical incident.

Clinical records

Occlus’s default retention configuration for patient clinical records is generally 7 years, subject to the clinic’s instructions and any longer period that may be reasonably required by professional, legal or clinical circumstances.

The clinic remains responsible for determining the retention period applicable to its clinical records.

X-rays and clinical photographs

Dental radiographs and clinical images forming part of the patient’s record are generally retained in accordance with the retention period applicable to the patient’s clinical record.

Patient profiles

Patient-profile information is generally retained while necessary to maintain and identify the relevant patient’s clinical record and is deleted or anonymised when the associated retention purposes have ended.

Financial and accounting records

Records required for accounting, taxation or business record-keeping purposes may be retained for at least 7 years where required by applicable Hong Kong law.

Audit records

Audit records relating to access to or modification of clinical information may be retained for as long as reasonably necessary to protect the integrity of the associated clinical record and to enable the clinic to investigate access to that record.

Data may be retained for longer where reasonably necessary in connection with litigation, complaints, investigations, legal obligations or the establishment, exercise or defence of legal rights.

15. Security

Occlus uses technical and organisational measures designed to protect personal data against unauthorised or accidental access, processing, alteration, erasure, loss, use or disclosure.

Depending on the relevant part of the service, these measures include:

• encryption during transmission;
• encryption of storage infrastructure;
• authentication controls;
• role-based permissions;
• clinic-level separation of information;
• restricted administrative access;
• audit logging;
• monitoring and security controls;
• backup and recovery procedures;
• controls governing service providers; and
• procedures for responding to suspected security incidents.

Patient records belonging to one clinic are logically separated from records belonging to other clinics.

Access to sensitive clinical information is restricted according to the user’s authorised role.

Occlus records access to designated sensitive clinical records so that the clinic can determine which authorised account accessed the information and when.

No internet-connected service can guarantee absolute security. Clinics and users are also responsible for protecting their login credentials, devices and access to their accounts.

16. Data relating to children and other represented patients

Healthcare clinics may provide services to children or to patients who require another person to act on their behalf.

A clinic may therefore record a parent, guardian or other authorised representative in the patient’s record.

The existence of a shared telephone number or device does not by itself establish authority to access another patient’s information.

The clinic is responsible for establishing whether a person is properly authorised to act for another patient and for obtaining any consent required in connection with the patient’s care.

17. Direct marketing

Precision Expert Holdings Limited does not use patient clinical information for its own direct marketing.

We do not sell patient information or provide it to third parties for their own direct-marketing purposes.

Clinics may separately communicate with their own patients. Each clinic is responsible for ensuring that any direct marketing it conducts complies with the applicable requirements of the PDPO.

Patients may ask their clinic to stop optional communications such as certain recall or promotional messages.

Operational communications necessary to administer an existing appointment, respond to a patient’s request or provide a healthcare service may be treated differently from direct marketing.

18. Access and correction rights

Under the PDPO, an individual may have the right to:

• request confirmation of whether a data user holds personal data about them;
• request access to personal data held about them; and
• request correction of inaccurate personal data.

For patient clinical information held through Occlus, requests should ordinarily be directed to the clinic, because the clinic is generally the data user responsible for the patient’s record.

The clinic may ask Occlus to assist it in locating, exporting or correcting information held through the service.

Clinical records may need to preserve their historical integrity. Accordingly, correcting a signed clinical entry may involve adding an amendment rather than removing or rewriting the original record.

19. Requests for deletion

The PDPO does not provide an unrestricted right to require a data user to erase all personal data simply upon request.

However, personal data should not be retained for longer than necessary for the purpose for which it is used, subject to applicable exceptions and retention requirements.

A patient may ask the clinic whether information can be deleted.

Certain information may need to remain in the patient’s record because of:

• professional record-keeping requirements;
• continuity of care;
• accounting or taxation obligations;
• pending complaints or disputes;
• legal obligations; or
• the establishment, exercise or defence of legal rights.

Where information is no longer required and no valid reason exists to retain it, it will be dealt with in accordance with the applicable retention and erasure procedures.

Information that has previously been irreversibly anonymised so that it can no longer reasonably be linked to an identifiable patient cannot ordinarily be retrieved by patient identity for subsequent deletion.

20. Business and clinic-account information

Where a clinic, dentist or other business contact communicates directly with Precision Expert Holdings Limited, we may process information including:

• name;
• business email address;
• telephone number;
• clinic or organisation;
• professional role;
• correspondence;
• contract and billing information; and
• information required to administer the commercial relationship.

This information may be used to:

• provide and administer Occlus;
• establish and manage clinic accounts;
• provide technical or customer support;
• issue invoices;
• communicate about the service;
• maintain security;
• comply with contractual obligations; and
• comply with applicable law.

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to Occlus;
• new or modified features;
• changes in our processing practices;
• changes to service-provider arrangements;
• legal or regulatory developments; or
• improvements to our privacy and security practices.

Where a change is material, we will update the effective date and take reasonable steps to notify affected clinics.

Clinics are responsible for ensuring that patients have access to the current privacy information applicable to their use of Occlus.

22. Contact us

Questions about an individual patient’s clinical record should ordinarily be directed to the patient’s clinic.

Questions concerning Occlus, this Privacy Policy or the privacy practices of Precision Expert Holdings Limited may be directed to:

Precision Expert Holdings Limited
Room 12, 5/F, Fullagar Industrial Building, 234 Aberdeen Main Road, Aberdeen, Hong Kong
Email: brandon@occlus.health

Individuals may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong regarding their rights or concerns under the Personal Data (Privacy) Ordinance.

Occlus is operated by Precision Expert Holdings Limited, incorporated in Hong Kong.