Who this is about

This covers joytcmclinic.sg — the clinic's website. It covers the booking form, the contact form, and what happens to what you type into them.

It does not cover anything that happens in the clinic itself. Notes taken during a consultation, your treatment history and anything you tell the physician in person are kept by the clinic separately and are not part of this website.

It also does not cover WhatsApp. If you message the clinic on WhatsApp, that conversation is between you, the clinic and WhatsApp, under WhatsApp's own terms.

When you book an appointment

The booking form asks for these things, and nothing else:

Your name

So the physician knows who is coming.

Your mobile number

So the clinic can reach you if something changes. This is the only way we can contact you if you do not give an email address.

Your email address — optional

Only used to send your appointment confirmation. Leave it blank and you simply will not get one — the booking is made either way, and the clinic will reach you on WhatsApp if anything changes.

Which treatment, and whether it is your first visit

So the right amount of time is set aside and the physician can prepare.

The date and time you pick

This is the appointment itself.

Anything you write in the notes box — optional

This box is free text, so whatever you put in it is stored as you wrote it. If you describe a symptom or a condition there, that is health information and it is kept with the booking. Only write what you are comfortable having on file.

When you send a message

The contact form asks for your name, one way to reach you — either an email address or a phone number, whichever you prefer — and your message. The site also records which language you were reading in, so the physician can reply in the same one.

The message box is free text and the same caution applies as above: it is stored exactly as you wrote it.

If you gave an email address, you will get an automatic acknowledgement. The clinic gets a copy of your message either way.

What we deliberately do not collect

There is no account to create and no password to remember. The site never asks for your NRIC, your date of birth, your home address or any payment details — it takes no payments at all.

Your IP address is not stored. It is used for a few minutes in the server's memory to stop one machine flooding the contact form, and it is never written to the database. There is no column for it.

The site counts page views using Vercel Web Analytics. It sets no cookie, gives you no identifier and cannot follow you to another site — it records which pages were opened, not who opened them. That is why there is no cookie banner to dismiss. There is no Google Analytics, no Tag Manager, no Facebook or Meta pixel, no advertising and no embedded social posts. Nobody is building a profile of you here.

Cookies

This site sets no tracking cookies, which is why you have never seen a cookie banner on it.

It remembers one thing: whether you are reading in English or 中文. That is stored in your own browser, never sent to us, and disappears when you clear your browsing data.

The clinic's own staff page sets one sign-in cookie. It applies to clinic staff only and never to patients browsing the site.

Who else can see it

Running a website means using other companies for storage, email and hosting. Each of these sees only what it needs to do its job, and none of them is allowed to use your information for their own purposes.

Supabase — the database

Your booking and any message you send are stored here. It is locked down so that one visitor can never read another visitor's booking or enquiry.

Resend — email delivery

Sends your confirmation and the copy that goes to the clinic. It handles the contents of those emails, which include your name, the appointment details and anything you wrote in the notes.

Google Calendar — the physician's diary

Your appointment is copied into a private calendar only the physician can see. See the next section for exactly what that copy contains.

Vercel — hosting

Runs the website. Like every web host it keeps short-lived technical logs of requests so faults can be diagnosed.

Google Fonts

The typefaces on this site are loaded from Google on every page. That is a normal web request, and it means Google sees your IP address and browser when the fonts load. It happens on every page whether you fill in a form or not.

Google Maps and YouTube — only if you ask

The map on the contact page and the videos in the gallery do not load until you click them. Until you do, nothing is requested from Google or YouTube and neither can set a cookie. That is deliberate.

What goes into the physician's calendar

When you book, a copy of the appointment is put into a private Google Calendar belonging to the clinic. It is not shared with anyone else and it is not published anywhere.

The title of the entry shows only the time — for example “Appointment — 10:30”. Your name is deliberately kept out of the title, because a phone sitting on a desk shows event titles on its lock screen and that would put your name in front of whoever is standing at the counter.

Inside the entry, where the physician has to open it to look, are your name, your phone number, the treatment, whether it is a first visit, and your notes if you wrote any.

If your appointment is cancelled, the entry is deleted from the calendar.

How long it is kept

We keep as little as we can for as long as we need it, and no longer.

Proposed: booking records are kept for three years after the appointment date, so that a returning patient's history is available and any question about a past visit can be answered. Messages sent through the contact form are kept for twelve months.

Being straight with you: at the time of writing, this deletion is not yet automatic. The clinic can delete records on request today, and we are putting the scheduled deletion in place.

Asking to see it, change it or delete it

You can ask the clinic what it holds about you, ask for it to be corrected if it is wrong, or ask for it to be deleted. Email the clinic and say what you would like.

To cancel or move an appointment you have already made, contact the clinic directly — by WhatsApp is quickest. Appointments are changed by clinic staff, not through this website.

Keeping it safe

The whole site is served over an encrypted connection. The database refuses to let one visitor read another's booking or message — that is enforced by the database itself, not by the website asking nicely.

The staff page that shows the day's appointments is behind a password and is not reachable by search engines.

No system is perfect. If you believe something has gone wrong with your information, please tell the clinic so it can be looked into.

If this changes

If what the website does with your information changes, this page changes with it and the date at the top is updated. It is not a document that gets written once and left.