Privacy & PDPA compliance
This page explains what personal data we collect when you use this site, submit medical records or receive our service, why we collect it, why your records have to be transferred to China, on what basis that transfer happens, how the data is protected, and what rights you have.
Last updated: 16 September 2025
1What personal data we collect
We collect only what is needed for record review, hospital coordination and travel arrangements. Nothing is collected for unrelated purposes.
- Identity and contact data: name, passport bio-page details, date of birth, contact details
- Medical data: diagnosis letters, admission and discharge records, imaging and pathology reports, laboratory and genomic test reports, medication records
- Travel and visa data: intended arrival dates, accompanying family members
- Payment and insurance data: policy details and the documents needed for a claim
- Site usage data: access logs and cookies (see section 7)
2Why we collect it, and on what legal basis
Under section 6 of Malaysia’s Personal Data Protection Act 2010 (PDPA, Act 709) we process the data above on the basis of your consent. Consent can be withdrawn at any time (see section 5).
- Restructuring and bilingual translation of medical records
- Submitting records to the receiving hospital in China for an admission feasibility assessment
- Preparing the materials needed for the medical invitation letter and visa
- Assistance with insurance claims
- Travel, escort and remote follow-up arrangements
- Record-keeping required by law, and service improvement
3Cross-border transfer of your data (the key part of this policy)
To complete the review and admission, your medical and identity data is transferred to the receiving hospital and the consulting specialists in mainland China. This transfer is inseparable from the service: without it, the second opinion and admission coordination you asked for cannot be delivered. Before you submit records you will see this consent listed separately, not buried in general terms.
Under section 129 of the PDPA, transferring personal data outside Malaysia requires the conditions in that section to be met. We rely primarily on your explicit consent, and back it with contractual and technical arrangements so that the recipient protects the data to a standard no lower than this Act requires.
- Destination: mainland China (the cities of the receiving hospitals, such as Beijing, Shanghai, Guangzhou and Shenzhen)
- Recipients: the receiving hospital’s international medical department or special needs clinic, and the specialist team consulting on that case
- Purpose: specialist review, admission feasibility assessment, and issuing the invitation letter and admission opinion
- Content: the part of the data listed in section 1 that is necessary for those purposes
- Safeguards: encrypted transfer channels, minimum-necessary scope, de-identified form wherever the material allows it, and recipients limited to clinicians involved in that case
- Your choice: you may refuse or withdraw at any time; we will then be unable to complete the record review and hospital coordination, the service ends accordingly, and fees already paid are handled under the terms of service
4Data security and retention
The site uses HTTPS throughout. System access is minimised by role: only coordinators working on your case can view your records.
- Paper and electronic records are filed separately and destroyed or anonymised once the retention period ends
- Your medical records are not used for anything unrelated to this episode of care
- Where the law requires medical and financial records to be kept longer, they are retained accordingly
5Your rights
You can make the following requests through the channel at the bottom of this page. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
- Access the personal data we hold about you
- Have inaccurate or incomplete data corrected
- Restrict or object to particular processing
- Withdraw consent at any time
- Complain to us about how your data has been handled, or to Malaysia’s Department of Personal Data Protection (JPDP)
8Updates and language versions
When this policy changes we update the date on this page and keep a record of the revision. This page is provided in Chinese, English and Malay; if the versions differ in meaning, the English version prevails.