General Privacy Principles

Definitions

The following definitions explain terms used throughout this policy to clarify how data is processed in relation to sanatorium care and administrative activities.

Personal data means any information that identifies an individual directly or indirectly, including names, contact details, health-related notes and emergency contact information used for care planning.

Processing refers to any action performed on personal data such as collection, storage, adaptation, consultation, sharing with care partners and deletion as part of case management.

User refers to guests, prospective guests, family members, healthcare referrers and other individuals who interact with HealthMResort services, portals and communications.

Service covers the sanatorium stays, assessments, rehabilitation programs, consultations, bookings and related administrative operations provided by HealthMResort.

Cookies are small data files placed on devices to remember preferences, enable sessions, and collect usage metrics to improve scheduling and resource allocation in practice-focused settings.

Purposes of Processing

We process personal data for specific, practical purposes tied to case workflows: to provide sanatorium services, manage bookings, coordinate care, handle payments and perform quality improvement.

• To register guests and manage reservations for sanatorium stays.
• To plan and deliver personalized care and rehabilitation based on clinical input and documented assessments.
• To communicate with guests, family members and referrers about schedules, treatment notes and discharge plans.
• To process payments, invoices and necessary interactions with insurers or payers.
• To aggregate anonymized data for operational improvements and case study development.
• To comply with legal obligations and respond to lawful requests from authorities.
• To maintain records for clinical governance, safety reviews and incident contribute related to service delivery.
• To send informational material, appointment reminders and follow-up guidance relevant to documented care pathways.

Legal Basis for Processing

We rely on applicable legal bases to process personal data. Processing is limited to what is necessary for the stated purposes and supported by consent, contractual necessity, legitimate interests or legal obligations where relevant.

• Contractual necessity: processing required to provide a booked sanatorium stay and related services.
• Consent: where explicit consent is provided for specific uses such as marketing or optional assessments.
• Legitimate interests: for internal quality improvement, fraud prevention and ensuring safety during stays, balanced against individual rights.
• Legal obligation: when retention or disclosure is necessary to meet regulatory or statutory duties.

Alignment with GDPR Principles

Although HealthMResort operates in Malaysia, we apply recognized data protection principles consistent with international practice where they help protect guest privacy and support cross-border care coordination.

• Lawfulness, fairness and transparency: clear notices and case-driven explanations of processing.
• Purpose limitation: data used for documented care, billing and case-related follow-up.
• Data minimization: collecting only what is necessary for a given care pathway or administrative need.
• Accuracy: steps to keep records up to date based on guest or referrer notifications.
• Storage limitation: defined retention periods for different categories of records.
• Integrity and confidentiality: technical and organizational measures to protect data.

Cookies and Tracking Technologies

We use cookies and similar technologies to enable essential functions, maintain session state during bookings, and collect anonymized usage information to refine case materials and scheduling.

Cookie types include session cookies for active booking sessions, persistent cookies for remembered preferences, and analytics cookies for aggregated usage insights.

Categories: strictly necessary, preferences, analytics. Strictly necessary cookies enable basic functionality; analytics cookies help us improve content and service flow using aggregated patterns.

You can manage cookies through your browser settings or device preferences. Opting out of analytics cookies may reduce personalized site improvements but will not prevent core booking functionality.

Read our Cookie Policy

Data Sharing and Disclosure

We share personal data only when necessary to deliver services or comply with legal obligations. Each disclosure is assessed against the need to support a care pathway or administrative requirement.

• Healthcare partners involved in direct care coordination or referrals for continued rehabilitation.
• Payment processors and insurers to verify transactions and process claims.
• Service providers who host or maintain booking systems, analytics tools and secure record storage under contractual confidentiality obligations.
• Legal and regulatory bodies when disclosure is required by law or to protect safety in urgent situations.
• In the event of a corporate transaction, relevant data may be transferred to successors for continuity of records and care.
• Anonymized, aggregated data that cannot be linked to individuals may be shared for research and quality improvement.

International Transfers

Some service providers we engage may operate in jurisdictions outside Malaysia. When transfers are necessary, we assess legal frameworks and apply appropriate safeguards to protect personal data during transfer.

Safeguards may include contractual data protection clauses, careful selection of providers and technical measures such as encryption to protect data in transit and at rest.

Data Retention

Retention periods depend on the category of data and the purpose for which it was collected, taking into account clinical governance and local legal requirements.

Account and registration records are retained for the duration of the active relationship and typically for up to 7 years after last interaction to support clinical governance and business record-keeping.

Communications, appointment messages and routine correspondence are kept for a limited period to ensure continuity of care and may be archived for case reference for up to 3 years.

System logs and security records are retained for operational monitoring and troubleshooting, usually for 1 to 3 years depending on the purpose.

When data is no longer required for the purposes described and no legal need to retain it exists, we delete or anonymize the records in accordance with our retention schedule and documented case-handling procedures.

Security Measures

We implement technical and organizational measures proportionate to the sensitivity of data to reduce risk. Security practices are regularly reviewed and updated based on operational lessons and case reviews.

• Encryption of sensitive data in transit and at rest where appropriate for care coordination and payments.
• Access controls and role-based permissions to ensure only authorized staff can view case records relevant to their duties.
• Regular staff training, incident response procedures and audits to maintain operational security and protect guest information.

Your Privacy Rights

Depending on applicable law, users have rights regarding their personal data. Below are the practical steps you can take and rights you may exercise in relation to HealthMResort records.

• Right to access personal data we hold about you and receive a copy of those records.
• Right to request correction of inaccurate or incomplete information.
• Right to request deletion of data when it is no longer necessary for the purpose collected and no legal basis requires retention.
• Right to restrict processing in certain circumstances, for example during a dispute about accuracy.
• Right to data portability where applicable for data you provided to us in a structured format.
• Right to object to processing based on legitimate interests, subject to assessment of compelling reasons related to care and safety.
• Right to withdraw consent for specific processing activities at any time without affecting processing based on consent prior to withdrawal.
• Right to lodge a complaint with a supervisory authority if you consider our processing does not comply with applicable laws.

How to Submit Rights Requests

To exercise any rights, contact our privacy team with sufficient details to identify the records and the request. Provide relevant identifiers such as booking reference, name and email to help us process the request efficiently.

[email protected]

We aim to respond to verifiable requests within 30 days. Complex requests may require additional time and we will communicate any necessary extensions and reasons.