HuashanMuscle 随访系统隐私政策
HuashanMuscle 随访系统（包括网站 followup.huashanmuscle.com 和从 Microsoft Store 安装的应用，下称「系统」）是神经肌肉疾病临床随访和科研协作的数据管理系统，供复旦大学附属华山医院神经内科肌病组及合作中心的医护和研究人员登记患者、录入随访评估、管理档案和生物样本。系统由上海桦书闽数据科技有限公司（下称「我们」）开发、托管和运维。
系统只对经邀请或审批通过的工作人员开放，不面向公众。本政策说明我们处理哪些信息、为什么处理、交给了谁、保存多久，以及你可以怎样行使自己的权利。
一、两类数据，两种角色
- 工作人员的账号信息：为了让你登录、按权限使用功能、保障账号和数据安全，由我们处理。
- 患者的临床和研究数据：由肌病组和各合作中心在诊疗和随访活动中收集，研究用途依据经伦理委员会批准的方案和患者（或其监护人）签署的知情同意书。我们受委托提供存储、处理和技术支持，不把这些数据用于上述目的以外的用途。
二、我们处理的工作人员信息
- 账号资料：姓名、用户名、电子邮箱、手机号、所属中心、用户组，以及你上传的头像。
- 登录与安全信息：登录时间、IP 地址、浏览器和设备类型，两步验证设备（邮箱验证码、身份验证器、通行密钥）的信息。
- 绑定的第三方账号：绑定微信时保存微信的 openid、unionid 和昵称头像；绑定 ORCID 时保存 ORCID iD；使用 Apple 登录时保存 Apple 提供的账号标识。
- 操作和访问记录：你新增、修改了哪些记录，以及查看了哪些患者的数据（审计日志），用于追溯数据的变动。
- 访问统计：我们自建的统计服务（不使用第三方统计）记录访问页面的网址（含网址参数）和页面标题、来源页面、浏览器和设备类型、根据 IP 推断的大致地区、点击的外部链接和页面报错。患者相关页面的网址和标题里可能含有患者标识（姓名和出生日期）。不录屏。统计数据只对经授权的工作人员开放。
三、系统里的患者数据
按诊疗、随访和研究的需要，可能包括下列健康相关的个人信息：
- 身份与联系信息：姓名、出生日期、性别、身份证号（用于实名核对和防止重复登记）、联系方式、住址、紧急联系人。
- 临床数据：诊断、检验、检查、用药、手术、病理和病历记录，部分来自华山医院信息系统同步的数据。
- 随访评估：量表和问卷结果、肌力和功能评估、知情同意书、基因检测结果，以及上传的病历等文件。
- 多媒体：医务人员上传的体征照片、步态等检查视频和音频。
- 生物样本信息：标本编号、类型、采集时间和存放位置。
- 患者端小程序数据：患者授权后，通过微信小程序填写的问卷和自我管理记录。
这些信息只在实现上述功能时使用。患者想查阅、更正、补充自己的信息，或撤回同意，请联系为其登记的医生或研究人员，或用第九节的方式联系我们。
四、Windows 应用
从 Microsoft Store 安装的应用是网站的桌面入口，显示的内容全部来自上面的网站，应用本身不另外收集数据。应用不读取通讯录，不在后台定位，不做广告跟踪。上传文件时，只有你选择的文件才会发送到服务器。
五、委托处理和第三方服务
系统的数据库、文件存储、登录系统都部署在我们管理的服务器上。为实现下列功能，会用到这些外部服务：
- 阿里云
- 云服务器、数据库、对象存储（每日备份、头像、预览图和冷存档）。涉及系统的全部数据；位于中国大陆。
- 阿里云实名核验（身份证二要素）
- 登记患者时核对姓名和身份证号是否一致。发送姓名和身份证号，非大陆居民身份证不发送；位于中国大陆。
- DeepSeek（深度求索）
- 只在工作人员点击「AI 病史总结」时使用，用生成式 AI 整理该患者的病史。发送诊断、检验、用药、检查和病历文字等临床内容；发送前删除唯一ID（姓名加生日）、电话、住址和医保卡号等身份字段，医生姓名替换为「医师」，但病历正文里写到的身份信息不一定能完全去除。AI 生成的内容可能有错误，需要医生核对，不能代替诊断。位于中国大陆。
- 高德地图
- 显示地图；解析地址和坐标。发送需要解析的地址或坐标；位于中国大陆。
- 微信（腾讯）
- 工作人员绑定微信和扫码登录，以及通过微信公众号发送通知（发给患者的通知经华山医院的公众号发出）。涉及微信标识和通知内容；位于中国大陆。
- 腾讯企业邮箱
- 发送登录验证码等邮件。涉及你的邮箱地址；位于中国大陆。
- 费深小程序
- 患者端微信小程序由第三方运营，患者授权后把问卷和自我管理记录同步到系统；位于中国大陆。
- ORCID、Apple
- 只在你选择绑定或用它们登录时使用，交换账号标识。这两家是境外机构。
- 境外网络资源
- 部分页面从 Cloudflare、jsDelivr、Plotly 的公共网络加载开源组件，部分地图的底图来自 OpenStreetMap 和 ArcGIS。这些请求只会让对方看到你的 IP 地址和浏览器信息，患者数据不会发给它们。
除上述情形和法律法规要求外，我们不会把工作人员或患者的个人信息提供给其他机构，不出售个人信息，也不用于广告。
六、保存地点和期限
- 数据保存在中国大陆境内的服务器上。
- 账号信息：账号存续期间保存。账号关闭后停用，用于追溯记录的录入人，保存期限和对应数据相同。
- 操作和访问审计记录：按法律法规和研究管理要求保存，不少于六个月。
- 患者数据：按研究方案、伦理审查要求和法律法规规定的期限保存，期满后删除或匿名化。
- 备份：数据库和文件每天备份到阿里云的私有存储桶，用于灾难恢复，保存和删除遵循与原数据相同的期限。
七、我们怎样保护数据
- 网站和应用全程使用 HTTPS 加密传输。
- 账号需经邀请或管理员审批后才能使用；支持两步验证（邮箱验证码、身份验证器、通行密钥）。
- 按用户组授予页面和功能权限；删除数据限管理员；查看和修改患者数据的请求记入审计日志。
- 服务器的管理入口不对公网开放。
八、你的权利
- 在「个人信息」页可以查看和修改资料、管理微信绑定、查看登录历史。
- 需要关闭账号时，请联系管理员或用第九节的方式联系我们。关闭后账号立即停用，所有设备退出登录。
- 你录入的记录属于临床和研究数据，账号关闭后仍按第六节的期限保存，记录上的录入人署名保留。
- 你也可以通过第九节的方式要求查阅、复制、更正你的个人信息，或提出删除请求（法律法规和研究监管要求保存的除外），我们会在 15 个工作日内答复。
九、联系我们
上海桦书闽数据科技有限公司
电子邮箱：admin@hsmdata.cn
十、未成年人
系统账号只向成年工作人员开放。系统中未成年患者的个人信息，须取得监护人同意后才能收集。
十一、使用规范和举报
系统里的内容由工作人员录入和上传，其他有权限的工作人员可以看到。使用系统时请遵守：
- 只录入和上传与诊疗、随访和研究有关的内容，不上传违法、侵权、骚扰或与工作无关的内容。
- 不把患者信息提供给无权查看的人，不公开传播系统里的内容。
- AI 病史总结由生成式 AI 生成，可能有错误，使用前要由医生核对。
发现不当内容、AI 生成的错误或有害内容，或者账号被滥用，请发邮件到 admin@hsmdata.cn，写明页面和时间，邮件里不要写患者身份信息。我们会在 15 个工作日内处理；确认违规的内容会被移除或停用，必要时关闭相关账号。
十二、本政策的更新
本政策更新时，我们会修改本页顶部的更新日期；变化较大时会在登录后提示。
HuashanMuscle Follow-up System Privacy Policy
HuashanMuscle Follow-up System (the website followup.huashanmuscle.com and the app installed from the Microsoft Store, together the "System") is a data management system for clinical follow-up and research on neuromuscular diseases. Clinical staff and researchers of the Neuromuscular Group, Department of Neurology, Huashan Hospital, Fudan University, and of partner centers use it to register patients, record follow-up assessments, and manage records and biological samples. The System is developed, hosted and operated by Shanghai Huashumin Data Technology Co., Ltd. ("we").
The System is open only to invited or approved staff, not to the public. This policy explains what we process, why, who receives it, how long it is kept, and how you can exercise your rights.
1. Two kinds of data, two roles
- Staff account information is processed by us so that you can sign in, use features according to your permissions, and keep accounts and data secure.
- Patient clinical and research data is collected by the Neuromuscular Group and partner centers during care and follow-up. Research use is based on protocols approved by an ethics committee and on informed consent signed by the patient or guardian. We provide storage, processing and technical support on their behalf and do not use this data for any other purpose.
2. Staff information we process
- Account details: name, username, email, mobile number, center, user group, and any avatar you upload.
- Sign-in and security information: sign-in time, IP address, browser and device type, and two-factor devices (email codes, authenticator apps, passkeys).
- Linked third-party accounts: WeChat openid, unionid, nickname and avatar if you link WeChat; your ORCID iD if you link ORCID; the account identifier provided by Apple if you use Sign in with Apple.
- Activity records: which records you created or changed and which patient data you viewed (audit log), used to trace changes to the data.
- Usage statistics: our self-hosted analytics service (no third-party analytics) records page URLs including URL parameters, page titles, referrers, browser and device type, approximate region derived from IP address, outbound link clicks and page errors. URLs and titles of patient pages may contain patient identifiers (name and date of birth). We do not record sessions on video. Statistics are available only to authorized staff.
3. Patient data in the System
As needed for care, follow-up and research, the System may hold the following health-related personal information:
- Identity and contact details: name, date of birth, sex, national ID number (for identity checks and to prevent duplicate registration), contact details, address, and emergency contact.
- Clinical data: diagnoses, laboratory results, examinations, medication, surgery, pathology and medical records, some of which are synchronized from Huashan Hospital information systems.
- Follow-up assessments: scale and questionnaire results, muscle strength and function assessments, informed consent forms, genetic test results, and uploaded documents.
- Media: clinical photos, gait and other examination videos and audio uploaded by clinical staff.
- Biological sample information: sample number, type, collection time and storage location.
- Patient mini-program data: questionnaires and self-management records that patients submit through a WeChat mini program, with their authorization.
This information is used only for the purposes above. Patients who want to access, correct or complete their information, or to withdraw consent, should contact the doctor or researcher who registered them, or contact us as described in Section 9.
4. Windows app
The app installed from the Microsoft Store is a desktop entry point to the website. Everything it shows comes from the website, and the app does not collect any additional data. It does not read your contacts, track your location in the background, or track you for advertising. When you upload files, only the files you choose are sent to the server.
5. Processors and third-party services
The System's databases, file storage and sign-in system run on servers we manage. The following external services are used to provide the features described:
- Alibaba Cloud
- Cloud servers, databases and object storage (daily backups, avatars, preview images and cold archives). Covers all data in the System. Located in mainland China.
- Alibaba Cloud identity verification
- Checks that a name matches a national ID number when a patient is registered. Name and ID number are sent; IDs other than mainland resident IDs are not sent. Located in mainland China.
- DeepSeek
- Used only when staff click "AI history summary", which uses generative AI to summarize a patient's history. Clinical content such as diagnoses, lab results, medication, examinations and medical record text is sent. Before sending, identity fields such as the unique ID (name plus date of birth), phone number, address and insurance number are removed and doctors' names are replaced with a generic title, but identifying details written inside record text may not be fully removed. AI output may contain errors, must be checked by a doctor, and does not replace a diagnosis. Located in mainland China.
- Amap (AutoNavi)
- Displays maps and resolves addresses and coordinates. The address or coordinates to resolve are sent. Located in mainland China.
- WeChat (Tencent)
- Staff WeChat linking and QR sign-in, and notifications through WeChat official accounts (patient notifications are sent through Huashan Hospital's official account). Involves WeChat identifiers and notification content. Located in mainland China.
- Tencent Exmail
- Sends sign-in codes and similar email. Involves your email address. Located in mainland China.
- Feishen mini program
- The patient-facing WeChat mini program is run by a third party. With the patient's authorization, questionnaires and self-management records are synchronized to the System. Located in mainland China.
- ORCID, Apple
- Used only if you choose to link them or sign in with them, to exchange an account identifier. Both are organizations outside China.
- Network resources outside China
- Some pages load open-source components from the public networks of Cloudflare, jsDelivr and Plotly, and some maps use base layers from OpenStreetMap and ArcGIS. These requests reveal only your IP address and browser information; no patient data is sent to them.
Except as described above or required by law, we do not provide staff or patient personal information to other organizations, do not sell personal information, and do not use it for advertising.
6. Where data is stored and for how long
- Data is stored on servers in mainland China.
- Account information is kept while the account exists. A closed account is deactivated and kept so that records can be traced to the person who entered them, for the same period as the related data.
- Audit records are kept as required by law and research management rules, for at least six months.
- Patient data is kept for the period required by the research protocol, ethics review and applicable law, then deleted or anonymized.
- Backups of databases and files are made daily to private Alibaba Cloud storage for disaster recovery, and are kept and deleted on the same schedule as the original data.
7. How we protect data
- The website and app use HTTPS for all traffic.
- Accounts require an invitation or administrator approval. Two-factor authentication is supported (email codes, authenticator apps, passkeys).
- Page and feature permissions are granted by user group, deleting data is limited to administrators, and requests to view or change patient data are recorded in an audit log.
- Server administration interfaces are not open to the public internet.
8. Your rights
- On the "Profile" page you can view and edit your details, manage your WeChat link, and see your sign-in history.
- To close your account, contact an administrator or contact us as described in Section 9. Once closed, the account is deactivated immediately and signed out on all devices.
- Records you entered are clinical and research data. They are kept for the period in Section 6 after your account is closed, and your name stays on them as the person who entered them.
- You may also ask us, as described in Section 9, to access, copy or correct your personal information, or request deletion (except where law or research regulation requires retention). We will respond within 15 working days.
9. Contact us
Shanghai Huashumin Data Technology Co., Ltd.
Email: admin@hsmdata.cn
10. Minors
Accounts are available only to adult staff. Personal information of minor patients in the System may be collected only with a guardian's consent.
11. Code of conduct and reporting
Content in the System is entered and uploaded by staff, and other authorized staff can see it. When using the System:
- Enter and upload only content related to care, follow-up and research. Do not upload anything illegal, infringing, harassing or unrelated to your work.
- Do not give patient information to anyone who is not authorized to see it, and do not publish content from the System.
- AI history summaries are produced by generative AI and may contain errors. A doctor must check them before use.
To report inappropriate content, wrong or harmful AI output, or misuse of an account, email admin@hsmdata.cn with the page and time. Do not include patient identifiers in the email. We will respond within 15 working days. Content found to break these rules is removed or disabled, and the account involved may be closed.
12. Changes to this policy
When this policy changes, we update the date at the top of this page. For significant changes we will show a notice after sign-in.