Privacy policy

Updated 6 September 2026

This policy covers Kaung Mon Clinic's website and its staff application, KMC X-ray. Kaung Mon Clinic is responsible for these services. Contact: eindu.okdiagnosticclinic@gmail.com.

Clinic location: Ein Du Sanpya Village. Telephone: 09943078922.

Information used by these services

• Appointments: the name, phone number, chosen service or doctor, preferred appointment date and time, and any note you submit. The website sends booking requests to the clinic's appointment service and opens Telegram to continue the booking. It may copy the prepared booking message to your clipboard.
• Queues: ticket numbers, selected doctor, queue status and, in staff-managed queues, patient names used for clinic displays and announcements. The public homepage displays queue numbers and status, rather than patient names.
• KMC X-ray: patient identification and contact details, age and sex, examination and accession details, staff assignments, billing records, images, reports and audit records used for patient care and clinic administration.

Google Drive access and automatic image QR codes

A clinic administrator may authorize KMC X-ray to connect to the clinic's Google account. The current connection requests the Google Drive permission https://www.googleapis.com/auth/drive. This is broad permission that can allow reading, creating, changing and deleting Drive files; it is not technically restricted to one folder.

The automatic QR feature uses this permission to find corresponding image files in the configured clinic folder, check that they match local images, retrieve viewing links and manage those images' sharing permissions. It reads file and folder identifiers, names, sizes, checksums, sharing-permission information and viewing links. It does not use this feature to search unrelated folders or delete Drive files.

The clinic's configured synchronization uploads image files to Google Drive. The QR feature itself checks files already uploaded; it does not upload a second image library. KMC stores image links, QR codes and related examination information on the clinic's system. Its Google authorization credentials, including the token used to keep the connection working, are stored on the clinic computer/server, not on this public website. KMC does not ask you to give it your Google password.

Who can access shared images

Clinic staff should explain this sharing method and obtain the appropriate patient or representative authorization before using it. The QR feature changes sharing on individual matched images, not the parent clinic folder. A QR code contains the viewing link; it does not conceal or protect that link.

Staff may provide images and documents to patients, their authorized representatives and healthcare professionals involved in their care. If staff use Telegram, Viber or another delivery service, that service processes the material sent through it under its own terms and privacy practices.

Google-connected data is used for the disclosed image-sharing features, not for advertising, sale to data brokers or training general-purpose AI models. Our handling of Google API data follows the Google API Services User Data Policy, including its Limited Use requirements.

Storage, service providers and security

Clinic records, documents, authorization credentials and backups are stored in clinic-controlled locations; synchronized images are also stored in the connected Google Drive account. Cloudflare hosts this website and its configured appointment/queue service. Hosting and delivery providers may receive technical request information, such as IP addresses and browser information, when their services are used.

Clinic staff accounts and device access controls help restrict access to KMC. Google API connections use HTTPS. These protections do not make an “anyone with the link” image private, and no system can guarantee absolute security. Keep clinic devices, passwords, authorization files and backups protected.

Retention, correction and deletion requests

The clinic retains information and backups as needed for patient care, administration and applicable record-keeping obligations. Contact the clinic to ask about a particular record, its retention period, a correction or deletion. We may need to verify your identity and authority before acting; some clinical or accounting records may need to be retained.

You can ask the clinic to remove public sharing from an image. This can prevent future access through its link, but it cannot retrieve copies already downloaded or forwarded.

Disconnecting the Google account

The connected account owner can remove KMC X-ray access in Google Account connections. Clinic administrators should also disable automatic QR sharing in KMC and arrange removal of locally stored connection credentials when the connection is no longer needed.

Disconnecting does not delete clinic records, Google Drive files, existing QR codes or previously granted sharing permissions. To withdraw image access, disable automation first and separately change the image's sharing permission in Drive. Existing downloaded copies and clinic backups require separate handling.

Browser storage

The website uses browser storage for queue fallback state and staff preferences such as the selected doctor and ticket paper width. Staff and display pages also use session storage for entered access PINs. Do not use staff controls on shared public devices; close staff sessions and clear stored data when appropriate. These information pages add no advertising or analytics scripts.

Questions and updates

Contact eindu.okdiagnosticclinic@gmail.com for privacy questions or requests. Do not send full medical records, passwords or authorization credentials in your first email; the clinic can arrange an appropriate way to identify the relevant record. Updates to this policy will appear on this page. New uses of Google data require updated disclosure and authorization where required.