Personal Data Protection Notice & Privacy Policy

This Personal Data Protection Notice and Privacy Policy (“Notice”) applies to personal data processed by Medirani Sdn Bhd in connection with the DR.D Clinic brand (“Dr D Clinic”, “we”, “us” or “our”), including our website, enquiry channels, appointment systems, clinic, consultations, treatments, patient administration, events, social-media interactions and related services.

This Notice is intended to satisfy the Notice and Choice Principle under the Personal Data Protection Act 2010 [Act 709] (“PDPA”), as amended from time to time. It should be read together with any treatment-specific consent form, patient registration form, photography/video consent, marketing consent, clinical consent, cookie notice or other notice provided for a particular activity.

For the activities covered by this Notice, the data controller is Medirani Sdn Bhd, operating the DR.D Clinic brand in Malaysia.

• Bangsar Branch: 2-8 Second Floor, Wisma Life Care, No. 5, Jalan Kerinchi, Bangsar South, 59200 Kuala Lumpur.

If the legal entity responsible for a particular service differs from the above, we will identify that entity in the relevant form, invoice, consent or notice.

The categories of personal data we collect depend on your interaction with us. They may include:

• Identity and contact data: name, date of birth, age, gender/sex where relevant to care, identification or passport details where required, residential address, email address, telephone number and emergency-contact details.
• Appointment and relationship data: appointment history, enquiries, referrals, preferences, membership/loyalty information (if any), complaints, feedback and customer-service records.
• Health and treatment data: medical history, allergies, medication, diagnoses or relevant conditions, previous procedures, symptoms, treatment suitability, clinical assessments, treatment plans, procedure records, products or devices used, outcomes, adverse events and follow-up information.
• Clinical photographs, video and likeness data: before-and-after photographs, treatment-area images, videos or similar records taken for clinical assessment, progress monitoring, treatment documentation, training or publicity where separately authorised.
• Sensitive or biometric data: health information is sensitive personal data under the PDPA. Where a system uses biometric characteristics for identification or verification, such biometric data is also sensitive personal data.
• Payment and transaction data: invoices, receipts, payment status, transaction references and limited payment information. Full payment-card details may be processed directly by a payment service provider rather than stored by Dr D Clinic.
• Communications data: emails, website/contact-form messages, telephone communications, WhatsApp or other messaging interactions, and any attachments or photographs you choose to send.
• CCTV and premises data: CCTV images or access/security records where cameras or security systems are used at the clinic premises.
• Website and device data: IP address, browser and device information, cookie identifiers, pages viewed, referral information and approximate location derived from technical data.

Some information is necessary for us to safely assess or provide treatment, maintain medical/clinical records, comply with law, process payment or manage an appointment. If you do not provide required information, we may be unable to provide the relevant service.

• Directly from you, including when you register, book an appointment, attend a consultation, receive treatment, complete forms, provide photographs, make payment, contact us or interact with our website or social channels.
• From a parent, guardian, family member, emergency contact or authorised representative where you have authorised this or where otherwise permitted by law.
• From healthcare professionals, referring providers, laboratories, pharmacies, insurers or other healthcare participants where relevant and lawfully permitted.
• From authorised service providers supporting appointments, CRM, cloud hosting, payment, communications, website operation, analytics and security.
• Automatically from your device when you use our website, subject to applicable cookie/consent settings.
• From publicly available sources or social-media platforms where you interact with us publicly, subject to applicable law.

We process personal data only for specific and lawful purposes and in accordance with the PDPA, based on your consent, the performance of a contract, a legal or regulatory obligation, protection of vital interests, medical purposes, or another condition permitted by the PDPA.

• Clinical assessment and treatment: to assess suitability, provide aesthetic/medical care, document procedures, monitor progress, manage aftercare, address adverse events and maintain appropriate patient records.
• Appointments and patient administration: to book, confirm, reschedule and manage appointments, respond to enquiries, and provide reminders and service communications.
• Billing and payments: to issue invoices and receipts, process payments and refunds, and maintain financial records.
• Patient safety and quality of care: to review outcomes, quality assurance, incident management, infection control, training and clinical governance.
• Legal and regulatory compliance: to comply with healthcare, tax, accounting, regulatory, court and law-enforcement requirements, and to establish, exercise or defend legal rights.
• Security and fraud prevention: to protect patients, staff, premises, systems and information, and to prevent misuse and investigate security incidents.
• Service improvement and analytics: to understand service performance, improve patient experience and website functionality, using minimised or aggregated data where practicable.
• Marketing and relationship communications: to send promotions, service news or educational content where permitted, and to publish promotional images/content only where the required consent has been obtained.
• Corporate administration: for audit, insurance, professional advice or other legitimate corporate administration, subject to confidentiality and legal safeguards.

Health and medical information is sensitive personal data under the PDPA. We process sensitive personal data only where permitted by section 40 of the PDPA, including where you have given explicit consent or where processing is necessary for medical purposes and is undertaken by a healthcare professional or a person owing an equivalent duty of confidentiality.

Access to patient records and sensitive information is restricted to authorised personnel and service providers who need access for the relevant purpose and are subject to appropriate confidentiality and security obligations.

Clinical photography can serve different purposes, and we distinguish between clinical documentation and promotional/publicity use.

• Clinical documentation: photographs or videos may be taken where reasonably necessary to assess a treatment area, document baseline condition, monitor progress or support patient safety. These form part of the clinical record and are handled as confidential patient data.
• Training or internal quality review: de-identified or appropriately controlled clinical material may be used for internal professional education or quality review where lawful and appropriate.
• Marketing, social media or public portfolio use: identifiable photographs, videos, testimonials or before-and-after materials will not be used for advertising or public-facing purposes unless we have obtained the appropriate separate consent. Marketing consent is optional and is not a condition of receiving treatment.

Where consent is withdrawn, we will stop future use to the extent reasonably practicable. Withdrawal may not require recall of materials already lawfully published before the withdrawal, but we will consider reasonable removal requests for content under our control.

We may disclose personal data only where reasonably necessary for the purposes described in this Notice and subject to applicable confidentiality, contractual and legal safeguards, including to:

• Doctors, nurses, therapists, clinic staff and other authorised personnel involved in your care or clinic administration.
• Laboratories, pharmacies, healthcare providers, referral partners, insurers or third-party administrators relevant to your treatment.
• Approved service providers such as appointment/CRM platforms, cloud hosting, IT support, cybersecurity, communications, payment processors, website providers and analytics providers.
• Professional advisers including lawyers, auditors, accountants and consultants, subject to professional or contractual confidentiality duties.
• Regulators, the Ministry of Health, the Personal Data Protection Commissioner, courts or law-enforcement authorities where disclosure is required or permitted by law.
• Any other person where you have requested or authorised the disclosure, or where the PDPA otherwise permits it.

We do not sell patient personal data for monetary consideration.

Some approved technology, cloud, communications, website, analytics, payment or professional-service providers may process or store personal data outside Malaysia. Where personal data is transferred outside Malaysia, we will comply with section 129 of the PDPA and applicable guidance.

Depending on the transfer, the applicable condition may include that the destination has a law substantially similar to the PDPA, that the transfer is necessary for a permitted contractual or legal purpose, that appropriate safeguards are in place, or that you have consented where consent is relied upon.

Our website may use cookies or similar technologies for essential functionality and may use analytics, performance or functional technologies where enabled. You can manage cookies through available website controls and your browser settings. Disabling certain cookies may affect website functionality.

Our website and communications may link to or use third-party services such as WhatsApp, social-media platforms, booking tools, maps or payment services. When you use a third-party service, that provider may process information under its own privacy terms.

We may use digital or AI-enabled tools to support administrative workflows, content creation, search/website optimisation, customer-service support, analytics and security. Where such tools process personal data, we limit access to the authorised purpose and apply appropriate contractual, confidentiality and security controls.

Patient-identifiable medical records, clinical photographs or other sensitive patient data are not used to train or improve unrelated general-purpose third-party AI models. Where AI-assisted tools are used in a clinical workflow, they support — not replace — professional judgement, and decisions on medical suitability or treatment remain subject to review by qualified healthcare professionals.

We take practical steps designed to protect personal data against loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction. Measures may include access controls, authentication, confidentiality obligations, staff training, secure systems, encryption where appropriate, backups and incident-response procedures.

No system is completely risk-free. If a personal data breach occurs, we will investigate, contain and remediate the incident and will notify the Personal Data Protection Commissioner and affected individuals where and within the timeframes required by the PDPA.

We take reasonable steps to keep personal data accurate, complete and up to date for the purposes for which it is used. Please inform us if your contact details, medication, allergies or other relevant information changes.

We retain personal data only for as long as reasonably necessary for the relevant clinical, legal, regulatory, tax, accounting, safety, insurance, audit or dispute-management purpose. At the end of the applicable retention period, personal data will be securely deleted, destroyed or irreversibly anonymised.

Subject to the PDPA, applicable procedures and permitted exceptions, you may have the right to:

• Request access to personal data we hold about you and information concerning its processing.
• Request correction of personal data that is inaccurate, incomplete, misleading or not up to date.
• Withdraw consent where processing is based on consent, without affecting processing already lawfully carried out before withdrawal.
• Require us to stop processing your personal data for direct-marketing purposes and opt out of promotional communications at any time.
• Request the transmission of your personal data to another data controller under the PDPA's data-portability right, subject to technical feasibility.
• Make an enquiry or complaint to us and, where appropriate, to the Personal Data Protection Commissioner.

Opting out of marketing does not stop necessary appointment, treatment, billing, safety or service communications. A permitted fee may apply to certain access requests, and some requests may be limited where the PDPA permits.

Our general website and marketing are not intended to solicit personal data from children without appropriate involvement of a parent or guardian. Where a person under 18 receives or enquires about a service and parental/guardian authorisation is required by law, professional standards or clinic policy, we will obtain the relevant authorisation and apply additional safeguards.

If you provide personal data about another person — for example an emergency contact, family member or person for whom you are making an appointment — you should ensure that you are authorised to provide that information and, where required, have informed the individual about the relevant processing.

Our website or social-media pages may contain links to third-party sites or services that we do not control. Their privacy practices are governed by their own notices. We are not responsible for the privacy practices of third parties merely because we link to them.

We may update this Notice when our services, technologies, legal obligations or data practices change. The “Last updated” date identifies the current version. Where a material change requires additional notice or consent under law, we will provide it through an appropriate channel.

This Notice is governed by the laws of Malaysia, including the PDPA. It is provided in English and Bahasa Malaysia to support compliance with the PDPA's notice requirements. If an inconsistency arises between the two versions, the version that best gives effect to the requirements of Malaysian law should be applied.

Separate consent remains advisable for: (1) treatment/medical consent; (2) optional marketing messages; (3) identifiable before-and-after photographs, testimonials and social-media publicity; and (4) any cross-border transfer that relies specifically on the data subject's consent.