Privacy Policy & Account Deletion Guidelines

Privacy Policy

KPJ HEALTHCARE BERHAD (KPJ) values your personal data privacy. We subscribe to the personal data protection principles under the Personal Data Protection Act 2010 (hereafter referred to as PDPA) with effect from 15 November 2013, which regulates the processing of personal data in commercial transactions. The terms "personal data", "processing" and "commercial transactions" shall have the meaning provided in the PDPA.

Personal data requested for in the relevant forms is obligatory to be provided by you unless stated otherwise. If you fail to supply us with such personal data, we may not be able to process and/or disclose your data for the purposes as provided in item C) below and provide you with the relevant services.

This Personal Data Notice applies to any person whose personal data is being processed by KPJ and further explains how we collect and handle your personal information, including your sensitive personal data.

If you are under 18 years old, please obtain your parent’s or guardian’s consent before you provide your personal data to us.

We shall reserve the right to amend this Personal Data Notice from time to time without prior notice. We will place notice of such amendments on our website. By continuing to engage or use our services or by continuing to communicate with us following the updates or amendments to this Personal Data Notice, it shall signify your acceptance to such updates or amendments. We wish to inform you how your personal data is being processed by and on behalf of KPJ.

A) Source of the Personal Data

Your personal data is collected from various sources, including information you have provided us, information from third parties and information in the public domain.

B) Description of the Personal Data

Your personal data processed by us may include, where relevant:-name, date of birth, identity card or passport, name of employer/company, home and office address, telephone/handphone number, facsimile number, email address, occupation, age, gender, marital status, weight, height, photos, race, nationality, religion, family and/or next of kin information, remuneration information, EPF Number, SOCSO Number, Income Tax Number, bank details, education background, training attended, working experiences, medical checkup result, medical record, Medical Report No. (MRN), medical report, diagnosis, personal health information, criminal history, investigation result, insurance details, information regarding your family, relatives or third party that you provide to us, your preferences in relation to products and services you purchase from us, CCTV/security recordings and any other personal data required for the purposes set out in item C) below.

C) Purposes of the Personal Data

Your personal data may be processed for the following purposes, where relevant:

1. 1. For medical and healthcare services
2. 2. To facilitate the patients personal needs (i.e. extension of stay for health tourists)
3. 3. To establish and manage medical records and medical reports
4. 4. To facilitate payment process relating to the patients
5. 5. To institute debt recovery proceedings against defaulters
6. 6. To report the personal data to the relevant authorities and/or third parties under the governing laws relevant to the healthcare industry
7. 7. To share the personal data with KPJ Healthcare Berhad and its related companies as defined in the Companies Act 1965
8. 8. To conduct research, analysis and improvement
9. 9. To market and advertise products and services
10. 10. To administer and respond to request, queries, complaints and legal issues
11. 11. To facilitate human resource management activities relating to employees
12. 12. For submission and registration of relevant forms, licenses to the relevant authorities and/or third parties under the governing laws relevant to the healthcare industries
13. 13. To share personal data for the purpose of banking facilities, signing of legal and accounting documents
14. 14. For purpose of purchase of items, outsource of services, new development and others
15. 15. For education and training
16. 16. For any other purpose that is incidental or in furtherance to the above purposes

D) Disclosure of the Personal Data

Your personal data may be disclosed to the following parties, where relevant:

1. 1. Healthcare professional (as defined in PDPA)
2. 2. KPJ Healthcare Berhad and its related companies (as defined under Companies Act 1965)
3. 3. Government agencies, local authorities, non-government agencies
4. 4. Respective foreign embassies of foreign patients who received treatment with KPJ
5. 5. Law enforcement agencies
6. 6. Paying and insurance agents
7. 7. Debt collection authorities and agencies
8. 8. Financial institutions
9. 9. Legal firms
10. 10. Auditors
11. 11. Our independent consultants and specialists within KPJ
12. 12. Vendor/Contractor
13. 13. Other private and public hospitals
14. 14. Other healthcare providers
15. 15. Training providers
16. 16. Family and next of kin
17. 17. To such parties as may be required by law, court, regulator, or legal process to disclose
18. 18. To such parties as may be permitted under the laws of Malaysia
19. 19. Any other person which KPJ may deem necessary

E) Access and Update the Personal Data

If there are any changes to your personal data or if you believe that the personal data we have about you is inaccurate, incomplete, misleading, or not up-to-date, please contact us so that we may take steps to update your personal data.

You have the right to access your personal data. If you would like to request access to your personal data, please contact us. We recommend that your request for access to your personal data held by KPJ be made in writing. We may also take steps to verify your identity before fulfilling your request for access to your personal data. We reserve the right to refuse your requests for any reasons permitted by law.

In accordance with the PDPA:

• Depending on the information requested, we may charge a fee as stipulated in the First Schedule (Regulation 2) of Personal Data Protection [Fees] Regulations 2013 for processing your request for access; and
• We may refuse to comply with your request to access or make a correction in accordance with PDPA.

F) Transfer of Personal Data

We may, under certain circumstances, be required to disclose your personal data outside of Malaysia for the purposes and to such third parties stated in this Personal Data Notice.

G) How to Contact Us

Please contact us by using any of the following modes if you have any queries or complaints in respect of your personal data:

Address: Level 12, Menara KPJ, No. 238, Jalan Tun Razak, 50400 Kuala Lumpur
Attention: Saravanan Desigamanie
Telephone Number: 03-2681 6222
Fax: 03-2681 0191
Email Address: pdpa@kpjhealth.com.my

If you do not wish us or other parties to communicate marketing offers to you, you may email us at pdpa@kpjhealth.com.my.

We provide this Personal Data Notice in both English and Bahasa Malaysia. In case of any inconsistencies between these two, the English version shall prevail.

By providing to us your personal data, you hereby consent to the processing of your personal data in accordance with all of the foregoing.

Guidelines for User Account Deletion on Google Wellness and Apple Health

This guideline was last updated on September 26, 2024.

Purpose:

This guideline outlines the procedures for users to delete their personal data from the KPJ Cares Mobile App, which integrates with Google Wellness and Apple Health applications.

It also aims to provide users with control over their personal data and compliance with laws and regulations in relation to personal data.

This guideline shall be read together with KPJ Cares Mobile App’s terms and conditions and KPJ Personal Data Notice.

Scope:

This guideline applies to all users of the KPJ Cares Mobile App who have linked their accounts to Google Wellness or Apple Health applications.

Personal Data Deletion Process:

1. User Request

Users can request to delete their personal data by:

• i. Contacting our customer support team via marketing@kpjhealth.com.my. Please mention “KPJ Cares Mobile App - Account Deletion” in the subject line of your email communication.
• ii. Using a built-in "Delete Account" feature in the KPJ Cares Mobile App.

2. Data Verification

Upon receiving a user account deletion request via email or the built-in feature in the KPJ Cares Mobile App, we may request the user to verify their identity to ensure the request is genuine. Proof of identification may be required to confirm the account deletion request.

3. Personal Data Deletion

Once verified, we will proceed to delete the user account and the following data associated with the user's account:

• i. All personal data stored within the KPJ Cares Mobile App.
• ii. Any data shared with Google Wellness or Apple Health through the app's integration.
• iii. Any data generated or collected by the KPJ Cares Mobile App related to the user's activities or health metrics.

Please note that upon deletion of your account, your right to use the KPJ Cares Mobile App will cease immediately.

4. Confirmation

We will send a confirmation email to the user notifying them that their account and personal data have been successfully deleted.

Data Retention:

In certain circumstances, we may need to retain your personal data, such as:

• i. Where required by law.
• ii. Where necessary to continue providing the KPJ Cares Mobile App’s services.
• iii. Where necessary to resolve disputes.
• iv. Where we have a legitimate reason for doing so.

Any retained personal data will be handled in accordance with KPJ Cares Mobile App’s terms and conditions, KPJ Personal Data Notice, and applicable laws.

Personal Data Protection Mechanisms:

We implement robust data protection mechanisms to safeguard the sensitivity of users' personal data, including:

• i. Encryption: We use encryption to protect users' personal data both at rest and in transit.
• ii. Access Controls: We implement strict access controls to limit access to users' personal data to authorized personnel.
• iii. Regular Security Audits: We conduct regular security audits to identify and address potential vulnerabilities.
• Compliance with personal data protection law: We adhere to applicable personal data protection laws and regulations, such as the Personal Data Protection Act 2010.

Contact Information:

For any questions or concerns regarding this guideline or personal data deletion, users can contact our customer support team at marketing@kpjhealth.com.my.

Update to this Guideline:

We reserve the right to make changes or modifications to this guideline from time to time. We will alert you about any changes by updating the “Last updated” date of this guideline.