top of page

Privacy Policy

1. Scope

This Policy applies to all personal data we process about patients, prospective patients, website visitors, and anyone who contacts or interacts with us — whether in person at the clinic, through our website, or via messaging, phone, email or social media.

​

2. Personal data we collect

Depending on how you interact with us, we may collect:

  • Identity data — full name, date of birth, gender, NRIC/passport number, nationality.

  • Contact data — phone number, email address, mailing address, emergency contact.

  • Health and medical data (sensitive personal data) — medical history, current medications, allergies, skin conditions and concerns, consultation notes, treatment records, clinical assessments and clinical photographs.

  • Appointment and transaction data — appointment history, treatments received, consultation and treatment fees, and payment records.

  • Communications data — messages, enquiries and correspondence you send us (including via WhatsApp, email, contact forms and social media).

  • Website and technical data — IP address, browser type, device information, pages visited and interaction data collected through cookies and similar technologies.

Under the PDPA, health data and other sensitive personal data are subject to stricter protection, and we process them only with your explicit consent or where otherwise permitted by law.

​

3. How we collect your personal data

We collect personal data:

  • Directly from you — via our website contact form, WhatsApp, phone, email, in-clinic registration forms, and during consultations and treatments.

  • Automatically — through cookies and analytics when you use our website.

  • From third parties, where relevant — such as referring doctors, laboratories, or with your authorisation.

​

4. Why we process your personal data (purposes)

We process your personal data to:

  • Register you as a patient and manage your appointments;

  • Provide medical consultations, assessments and treatments, and maintain your medical records;

  • Follow up on your care, aftercare and treatment outcomes;

  • Process payments, issue receipts and maintain financial records;

  • Respond to your enquiries and communicate with you about your care;

  • Comply with legal, regulatory and professional obligations (including those under the Private Healthcare Facilities and Services Act 1998, the Malaysian Medical Council, and the Ministry of Health);

  • Where you have consented, send you appointment reminders, clinic updates and marketing communications;

  • Maintain the security and proper functioning of our website and clinic operations.

​

5. Legal basis and consent

We rely on your consent and, where applicable, other lawful bases under the PDPA (such as compliance with a legal obligation or the performance of a transaction you have requested). Because your medical and health data is sensitive personal data, we obtain your explicit consent before processing it, unless an exception under the PDPA applies. You may withdraw your consent at any time (see Section 9), though this may affect our ability to provide certain services or continue your care.

​

6. Clinical photography

Where clinically relevant, we may take photographs of the treatment area for the purposes of medical documentation, assessment and treatment planning. Such images form part of your medical record and are treated as sensitive personal data. We will only use your images for any purpose beyond your medical record — such as education or promotion — with your separate, specific written consent, which you may decline or withdraw at any time.

​

7. Disclosure of your personal data

We do not sell your personal data. We may disclose it, on a need-to-know basis and subject to appropriate safeguards, to:

  • Healthcare professionals involved in your care, referral clinics, laboratories and pharmacies;

  • Our service providers acting on our behalf (for example, IT, website hosting, appointment, payment and data-storage providers), who are contractually required to protect your data;

  • Regulators, government authorities, professional bodies and law enforcement, where required or permitted by law;

  • Insurers or third-party payors, where you have authorised such disclosure;

  • Professional advisers (such as legal and accounting advisers) where necessary.

​

8. Storage, security and cross-border transfer

We retain your personal data on secure systems and apply appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse or alteration.

Some of our service providers (including our website host and cloud-storage providers) may store or process data on servers located outside Malaysia. Where we transfer personal data outside Malaysia, we do so in accordance with the PDPA and its cross-border transfer requirements, and take reasonable steps to ensure a comparable level of protection.

​

9. Your rights

Subject to the PDPA and applicable exceptions, you have the right to:

  • Access the personal data we hold about you;

  • Correct inaccurate, incomplete or outdated data;

  • Withdraw consent to our processing of your data;

  • Limit the processing of your data;

  • Data portability — request that certain data be transmitted to another data controller, where technically feasible;

  • Object to direct marketing at any time;

  • Lodge a complaint with the Personal Data Protection Commissioner.​

​

To exercise any of these rights, please contact our Data Protection Officer (Section 13). We may need to verify your identity before acting on a request. Certain data — such as medical records we are legally required to retain — may need to be kept even after a withdrawal of consent.

​

10. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes above and to comply with our legal, regulatory and professional obligations. Medical records are retained in line with Malaysian medical record-keeping requirements up to 7 years. When data is no longer required, we securely delete or anonymise it.

​
11. Marketing communications

Where you have consented, we may contact you with appointment reminders, clinic news and offers via WhatsApp, email or SMS. You can opt out at any time by replying “STOP,” using the unsubscribe link, or contacting us directly. Opting out of marketing will not affect communications relating to your care.

​

12. Cookies and website analytics

Our website uses cookies and similar technologies to enable core functionality, remember your preferences, and understand how the site is used so we can improve it. You can manage or disable cookies through your browser settings, though some features may not function properly as a result. Where required, we will request your consent for non-essential cookies via a cookie banner.

​

13. Data Protection Officer and contact

If you have questions about this Policy, wish to exercise your rights, or want to make a complaint, please contact our Data Protection Officer:

 

Data Protection Officer Name: Dr Chong Ian Email: [DPO email] Phone: [DPO phone] Address: [clinic address]

​

14. Data breaches

In the event of a personal data breach, we will assess the incident and, where required under the PDPA, notify the Personal Data Protection Commissioner and, where the breach is likely to cause significant harm, the affected individuals, in accordance with the applicable timelines and guidelines.

​

15. Children and minors

Where a patient is under 18, we require the consent of a parent or legal guardian before collecting or processing their personal data, and the parent/guardian must accompany the minor for consultation and treatment where required.

​

16. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be posted on this page with an updated “Last updated” date. Material changes will be brought to your attention where appropriate.

​

17. Governing law

This Policy is governed by the laws of Malaysia, and any matters relating to it are subject to the PDPA and the jurisdiction of the Malaysian courts.

​

18. Your consent

By providing your personal data to us, using our website, or engaging our services, you acknowledge that you have read and understood this Privacy Policy and, where required, consent to the collection, use and disclosure of your personal data (including sensitive personal data) as described herein.

bottom of page