Privacy Policy

Introduction

This Privacy Policy explains how we handle your personal data when you use our website, register an account, book consultations, or communicate with our clinic.

By using our platform, you consent to the practices described here. Where consent is required for sensitive personal data (including health information), we obtain it through our registration and telehealth consent forms.

Data we collect

We may collect the following categories of information:

• Identity & contact: name, email, phone number, date of birth, and address for delivery.
• Account: login credentials, registration date, and dashboard activity.
• Health & clinical: questionnaire responses, weight/BMI logs, consultation notes, prescriptions, and messages with the clinic.
• Payment: bank transfer reference, uploaded receipt images, and invoice records.
• Technical: IP address, browser type, and usage logs for security and audit purposes.

How we use your data

• Provide telehealth consultations and clinical follow-up.
• Verify payments and confirm booking slots.
• Issue prescriptions, invoices, and clinical documents.
• Arrange medication courier delivery within Malaysia.
• Send appointment reminders and clinic notifications.
• Maintain medical records and comply with professional obligations.

Legal basis & PDPA

We process personal data in accordance with the Personal Data Protection Act 2010 (PDPA). Processing is based on your consent, contractual necessity (to deliver the service you booked), and legitimate clinical/legal obligations.

Sensitive health data receives additional protection. Access is limited to authorised clinical and administrative staff on a need-to-know basis.

Data storage & security

Patient data is stored on secure cloud infrastructure with encryption in transit and access controls. Production health records are hosted with providers that support healthcare-grade security.

We retain clinical records as required by medical practice standards and applicable law. You may request deletion of marketing communications, but clinical records may need to be retained for legal and professional reasons.

When we share data

We do not sell your personal data. We may share information with:

• Our registered doctor and authorised clinic staff involved in your care.
• Courier partners — name, phone, and delivery address only, for medication dispatch.
• Payment verification — receipt details processed internally; we do not store full bank account numbers.
• Technology providers (hosting, email) under strict data-processing terms.
• Regulators or authorities when required by law.

Your rights

To exercise your rights, email healthengine.my@gmail.com with your registered name and email. We respond during clinic hours (Sat–Sun, 10am–9pm MYT).

• Access — request a copy of personal data we hold about you.
• Correction — ask us to update inaccurate information.
• Withdraw consent — where processing is consent-based, subject to clinical and legal retention requirements.
• Complaint — contact us first; you may also refer to the Personal Data Protection Department (JPDP) in Malaysia.

Cookies & analytics

We use essential cookies for authentication and session management. We do not use invasive third-party advertising trackers on the patient dashboard.

Contact

Data protection enquiries: healthengine.my@gmail.com

Klinik Meditech, No. 47-1, Jalan Damai Niaga 1, The Corner @ Alam Damai, 56000 Kuala Lumpur.