Legal

Privacy Policy

How Medtech Healthcare Sdn Bhd collects, uses and protects your personal data when you buy from us, consult our doctor or pharmacist, or open a trade account.

1. About this policy

We are a licensed pharmaceutical wholesaler and retail pharmacy supplying clinics, pharmacies and members of the public in Malaysia. We also provide teleconsultation with a registered medical practitioner and pharmacist-led e-prescription services. We are a data user under the Personal Data Protection Act 2010 (PDPA), and this policy explains what we do with the personal data you give us through our website, our order and consultation channels (including WhatsApp and email), and in person at our premises.

By placing an order, booking a consultation or opening an account with us, you confirm you have read this policy. Where the law requires your consent — in particular for health information — we will ask for it separately and clearly.

2. What we collect

• Identity and contact data — name, email address, phone number, delivery and billing addresses, and for clinical services your date of birth, gender and NRIC or passport number where required to identify you.
• Order and transaction data — items ordered, quantities, prices, order history, delivery records, invoice and payment records.
• Account data — username, password (stored encrypted), account preferences and correspondence with us.
• Trade account data (business customers only) — company name, SSM registration number, business licence and pharmacy or clinic licence details, Tax Identification Number (TIN), SST number, authorised contacts, requested credit limit and payment terms, and the supporting documents you upload.
• Health and clinical data — symptoms and history you give during a teleconsultation, the doctor's clinical notes and diagnosis, any prescription issued, prescriptions you upload from your own doctor, allergies, current medication, and your dispensing history with us. This is sensitive personal data under the PDPA and we treat it accordingly.
• Technical data — IP address, browser and device type, and cookie data described in section 10.

We do not collect or store your full card number, expiry date or CVV. Card details are entered directly with our payment processor and never reach our systems.

3. Why we use your data

4. Health and clinical data

Consultation notes, prescriptions, allergy information and dispensing history are used for one purpose: so that a registered doctor or pharmacist can care for you safely. They are visible only to the clinical staff involved in your care and the administrative staff who must process the order. They are never used for marketing, never sold, and never shared for commercial purposes.

Your clinical record is kept confidential in the same way as it would be at any clinic or pharmacy, and is subject to the same professional duties of confidentiality.

5. Who we share it with

• Our payment processor, CHIP (operated by CHIP In Sdn Bhd) — to take and, where applicable, refund your payment. CHIP handles your card or banking credentials directly under its own privacy terms; we receive only the payment outcome and a transaction reference. Clinical information is never shared with the payment processor.
• Delivery partners and couriers — your name, address and phone number only, so they can deliver to you. Parcels are packed so that the contents are not identifiable from the outside.
• The Inland Revenue Board of Malaysia (LHDN) — invoice data submitted through the MyInvois e-Invoice system, as required by law.
• Regulators and enforcement bodies — the Ministry of Health, the Pharmacy Enforcement Division, the Malaysian Medical Council or other authorities, where we are legally required to disclose or where it is necessary for patient safety or a product recall.
• Other healthcare providers — only with your consent, or where necessary to refer you for urgent care.
• Our IT and hosting providers — who operate our website and business systems under contract, and who may not use your data for their own purposes.

We do not sell your personal data.

6. Transfers outside Malaysia

Some of the service providers above operate managed cloud infrastructure that may store or process data outside Malaysia. Where that happens we take reasonable steps to ensure your data receives a level of protection comparable to that required under the PDPA, including contractual confidentiality and security obligations on the provider. You may ask us where your data is held at any time using the contact details below.

7. How long we keep it

• Clinical, consultation and dispensing records — retained for the period required of a registered medical practitioner and a licensed pharmacy under Malaysian law and professional guidelines.
• Invoices, payment and accounting records — 7 years, as required under the Income Tax Act 1967.
• Account and marketing data — until you close your account or withdraw consent, then deleted or anonymised except where we must keep it for the reasons above.

8. How we protect it

Access to personal data is restricted to staff who need it for their role, and clinical records are restricted further to the clinical team. Our website runs over encrypted connections (HTTPS), passwords are stored hashed, and payment credentials never touch our servers. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access.

9. Your rights

Under the PDPA you may ask us to:

• give you access to the personal data we hold about you;
• correct data that is inaccurate, incomplete or out of date;
• stop or limit processing, including stopping direct marketing;
• withdraw a consent you previously gave.

Email medtech.healthcare.my@gmail.com with your request and enough detail for us to identify you. We will respond within 21 days. A small fee may apply to a data access request, as permitted under the PDPA. Note that withdrawing consent for health data will mean we can no longer provide consultations or supply prescription medicines to you, and that we must still retain clinical records for the period the law requires.

10. Cookies

Our website uses cookies that are necessary for it to work — keeping you logged in, remembering your cart, and keeping your session secure. We do not currently use third-party advertising, retargeting or analytics pixels. You can block or delete cookies in your browser settings, but the shopping cart and login will not work without the necessary ones. If we add analytics in future, we will name the provider in this policy before switching it on.

11. Children

Our online store and consultation service are intended for people aged 18 and above. We do not knowingly collect personal data from children without the consent of a parent or guardian. A consultation or medicine for a child must be arranged by their parent or guardian.

12. Changes to this policy

We may update this policy from time to time. The current version is always the one published on this page, with the effective date shown at the top. Material changes will be notified to account holders by email.