Privacy and Personal Data Protection Policy

We may collect a variety of information relating to you, including sensitive personal data and not limited to your name, date of birth, race, religion, gender, company name, Malaysian Identification Card number or passport number, nationality, biometric data, DNA profiles, email address, address, contact number, credit card details, bank account details, health information, personal data of minors, food preferences, allergies, photographs, occupation, education, marital status, video recordings, CCTV images, medical records and all other Personal Data that we may collect from you from time to time.

Your Personal Data is being or is to be collected and further processed for:

• performing pre-contractual activities and our contractual obligations with you and ensuring the performance by you of your pre-contractual and contractual obligations to us;
• ensuring that you continue to receive medical treatment;
• contacting you in case of any change of appointment dates;
• managing medical records and medical reports;
• facilitating payment process relating to the patients;
• reporting personal data to the relevant bodies and/or third parties under the laws applicable to healthcare industry;
• sharing personal data with entities within Asia OneHealthcare Group;
• conducting research, analysis and improvement;
• marketing and advertisement purposes and surveys;
• facilitating overseas patient’s personal requirements (for example, visa applications);
• administering and responding to request, queries, complaints and legal issues;
• facilitating human resource management activities relating to employees;
• for submission, registration of relevant forms, licences to regulatory authorities and/or third parties under laws applicable to healthcare industries;
• for education and training (with anonymized data where possible);
• assessing your credit worthiness and processing any payments relevant to you;
• insurance purposes, third party administration and any other third parties;
• purposes of enforcing our legal rights and / or obtaining professional or legal advice;
• internal records management;
• conducting internal activities such as evaluating the effectiveness of marketing, market surveys/ research, trend analysis, statistical compilation, reporting, audit, compliance, risk management, data analytics and the use of artificial intelligence (AI) technologies to improve our services and operational support and business management across Asia OneHealthcare Group;
• complying with any legal or regulatory requirements such as audit and/or requests from regulatory bodies;
• instituting debt recovery proceedings against defaulters;
• providing and improving our products and/or services to you and advertising and providing you with information (such as events, offers or promotions) relating to Asia OneHealthcare Group’s and business partners’ products and/or services, including without limitation sending you e-newsletters, promotional marketing materials, facilitating your participation in any contests or events, seasonal/birthday greetings and messages, gifts and/or vouchers;
• managing and giving effect to your commercial transaction with us;
• granting you access to, and monitoring your use of, any online platforms, mobile applications or sites owned, operated or managed by us or on our behalf (“Platforms”) and administering and managing the Platform; and/or
• such other purposes incidental or in furtherance to the above purposes.

(collectively, the “Purposes”).

Your Personal Data may be collected from the following sources:

• directly from you or your representative when you or your representative complete a form to register for our products and/or services including any online forms and registration forms at our facilities, or contact us via emails, letters or telephone calls, or when you participate in customer surveys and promotions and during marketing activities;
• when you inquire about or use our products and/or services or participate in events, including without limitation, when you use our Platforms (via the Platforms and/or cookies);
• from any information or documents submitted or provided by you to us for any of the Purposes (such as your identity card, passport, salary slip and/or bank statement), including without limitation questionnaires or survey forms;
• from any third parties connected with you such as your employer/ potential employer, agents, insurance companies, and/or other healthcare facilities/providers;
• from such other persons or sources authorised by you to disclose information relating to you to us;
• from events;
• from CCTV recordings;
• from audio/ video recordings;
• from doctors’ letters;
• from medical reports and/or records; and
• from any other information and/or personal data that you may provide to us from time to time.

Subject to the provisions of the Act, you have the right to request access to and correction of your Personal Data and to contact us with any inquiries or complaints in respect of your Personal Data (including the possible choices and means for limiting the processing of your Personal Data or, to cease or not begin processing your Personal Data for purposes of direct marketing) by contacting us using the relevant contact details set out in the List of Contacts available here.

Subject to the provisions of the Act, you may, upon payment of a prescribed fee, where applicable, make a data access request in writing to us by completing a Data Access Request Form, which is attached as Appendix A, and returning the same to us. Requests for correction of Personal Data and other requests relating to your rights under the Act may be submitted to us using the relevant contact details set out in the List of Contacts.

Subject to the applicable legal restrictions, contractual conditions and reasonable notice given to us, you may withdraw, in full or in part, or amend your consent previously given for the processing and use of your Personal Data. Such withdrawal or amendment shall not affect any processing of Personal Data which is otherwise permitted or required under the applicable laws and may affect our ability to provide certain products or services to you, depending on the nature and purposes of the processing concerned.

Depending on your request, there may be circumstances in which we may refuse to comply with a data access request or a data correction request and shall, by notice in writing, inform you of our refusal and the reasons for our refusal.

We may also require the requestor of Personal Data (where the requestor is not the owner of Personal Data) to provide consent form of the owner of Personal Data authorizing and indemnifying us to release or correct the Personal Data.

Subject to the provisions of the Act and the conditions therein, you may by giving notice in writing by electronic means, request that we transmit your Personal Data directly to another data controller of your choice, subject to technical feasibility and compatibility of the data format.

It is obligatory that you supply us the details marked with asterisk (*) or specified as compulsory in our forms (collectively, “Compulsory Personal Data”).

If you refuse or fail to provide any Compulsory Personal Data or restrict the processing of your Personal Data by us, it may result in one (1) or more of the following, for which we shall not be held liable, to the extent permitted by law:

• the inability of the parties to formalise any contract and/or agreement, to facilitate the provision of our services or to hire human resources;
• our inability to continue to administer any relationship in place between you and us, provide you with services and/or products or continue to perform any contractual obligations owed to you, if any;
• our inability to update you on our latest services and/or products and/or appointment dates;
• our inability to complete transactions in relation to our products and/or services;
• our inability to comply with any applicable law, regulation, direction, court order, guidelines and/or codes applicable to us; and/or
• the termination of any arrangements, agreements and/or contracts between you and us.

We disclose or may disclose your Personal Data to the following:

• other entities within the Asia OneHealthcare Group;
• our medical specialists/consultants who treat patients in our hospitals;
• insurance companies and/or managed care organizations;
• banks, financial institutions, credit card or debit card issuers for processing of payment;
• credit check companies;
• debt collection agencies to recover outstanding debt owing to us;
• your employer;
• your next of kin or your emergency contact person as may be notified to us from time to time;
• research organizations;
• social welfare organization;
• medical and healthcare professionals;
• external counterparts for situations where a patient is transferred to another government or private healthcare facilities;
• parents or guardians of minors;
• service providers, suppliers, agents, contractors and vendors who process data for us such as medical specialists in our hospitals, outsourced data centres and outside labs providing diagnostic services;
• laboratories and diagnostic service providers who may be outside the control of the private hospital environment;
• data centers which host data for the hospitals;
• external lawyers;
• external auditors and accountants;
• governmental bodies, their agencies and other related organisations such as Ministry of Health, Ministry of Human Resources, Ministry of Home Affairs, Malaysian Anti-Corruption Commission, Inland Revenue Department, Malaysian Department of Insolvency, Royal Malaysian Police, Malaysian Medical Council, Malaysian Dental Council and Malaysian Medical Association;
• regulatory and/or statutory bodies and approved bodies that collect employee benefits which include Social Security Organisation (SOCSO), Zakat, Employees Provident Fund, Lembaga Tabung Haji and Employees Insurance Scheme;
• accreditation bodies; and
• any such third party requested or authorized by you for any of the Purposes.

Our third-party data processors are required to process your Personal Data in line with principles specified by us and/or the applicable law. They are also held responsible for securing your Personal Data at an appropriate level of security in relation to applicable data protection laws and accepted industry standards.

Your Personal Data will be kept and processed in a secured manner by us. We are committed to take appropriate administrative and security safeguards and procedures to prevent unlawful processing of, and the accidental loss, destruction or damage to your Personal Data. Access to your Personal Data is limited to and provided only to authorised personnel for the purpose of performing their duties or otherwise in line with this Policy.

Your Personal Data will be retained only for as long as necessary to fulfil the purposes set out in this Policy and to comply with applicable legal, regulatory and contractual requirements. Thereafter, we will take reasonable steps to ensure that such Personal Data is destroyed, permanently deleted and/or anonymised (where appropriate) in accordance with applicable laws and our internal policies.

We may require your assistance if the Personal Data relating to other persons (for example, your next of kin) is required to process your Personal Data for the Purposes and you hereby agree to use your best endeavors to assist us when required. In the event that Personal Data of any third party is supplied by you to us, you shall ensure that such third party has read this Policy and consented to us collecting his/her Personal Data for any of the Purposes prior to the supply of his/her Personal Data to us, where required under applicable laws.

To the extent permitted under applicable law, we may transfer your Personal Data to a place outside Malaysia pursuant to the Purposes stated in this Policy, including to (a) our group entity in Vietnam; (b) third parties outside Malaysia, including entities licensed or permitted to use any Asia OneHealthcare Group brand, where required for your care or at your request; and (c) our service providers located outside Malaysia, and you hereby give your consent to the transfer.

We will take reasonable steps to ensure the accuracy and completeness of your Personal Data. You are responsible for ensuring that the information you provide to us is accurate, complete, not misleading and kept up to date.

In respect of: (i) Personal Data relating to a minor (i.e. individuals under 18 years of age, “Minor”), please note that consent is required from the Minor’s parent or guardian or person who has parental responsibility over the Minor; and (ii) an individual who is deemed incapable of managing his/her own affairs (“Special Person”), please note that we require consent from the person appointed by a court to manage the Special Person’s affairs or the person who has been legally or validly authorised to act on the Special Person’s behalf. Where applicable, you hereby confirm that you are authorised to act on the Minor’s or the Special Person’s behalf as described above and that you consent, on the Minor’s or the Special Person’s behalf, to the processing (including disclosure and transfer) of the Minor’s or the Special Person’s Personal Data in accordance with this Policy. In the event that you submit any of your Personal Data to us (in addition to the Minor’s Personal Data or the Special Person’s Personal Data), you also consent to the processing of your Personal Data in accordance with this Policy. We may process your Personal Data (in addition to the Minor’s Personal Data or the Special Person’s Personal Data) pursuant to this Policy by virtue of this provision, or if we rely on any other legal bases available under any applicable laws.

In the event of any inconsistency between the English version and the Bahasa Malaysia version of this Policy, the English version shall prevail.

We may change this Policy as needed for example, to comply with the changes in business operations or laws or regulations. We will notify you of any changes to this Policy via notices on our Platform or other appropriate means (e.g. by updating this page). You should check this page from time to time to ensure that you are updated on any changes. By continuing to use our products/services, communicate with us and/or access or use any of our Platform, and/or agreeing by ticking the box we provide specifically for processing of Personal Data, after being notified of any changes to this Policy, you will be considered as having agreed to such changes.