Privacy Policy

ARC CLINIC (“ARC CLINIC”, “we”, “us” or “our”) is a physician-led clinic offering personalised preventive health, wellness and longevity care (ARC Sanctum, ARC Onyx, ARC Privé and ARC Élan). This Privacy Policy explains how we collect, use, disclose, store and protect your personal data, and the choices and rights you have.

ARC CLINIC is operated by KAYSHAA PLASTIC LASER & COSMETIC SURGERY SDN BHD (Company Registration No. 200301018463), the data user responsible for your personal data under the Personal Data Protection Act 2010 (“PDPA”). Our clinic is located at 102 Jalan Gasing, Bukit Gasing, Petaling Jaya, 46000 Selangor, Malaysia, and is registered with the Ministry of Health Malaysia (Registration No. 231008-10727-11).

This Policy applies to personal data we collect in connection with enquiries, appointments, consultations, assessments, treatment programmes, follow-up care, our website and social media channels, and visits to our premises. It covers patients, prospective patients, clients, parents or guardians, representatives, emergency contacts and website visitors.

ARC CLINIC is a medical practice. It does not operate, sell through or promote any retail store. Any purchase you may make from a separate retailer or online store is a transaction with that business, which is governed by its own terms and privacy notice and is not covered by this Policy.

This Policy works alongside our duty of medical confidentiality and applicable professional and healthcare laws. It does not reduce those duties.

• Identity and contact details: name, NRIC or passport number where necessary, date of birth, gender, nationality, address, telephone number, email address, and emergency contact or next-of-kin details.
• Health information (sensitive personal data): medical, medication, allergy, lifestyle and family history; symptoms; examination findings; diagnoses; treatment plans; clinical notes; prescriptions; laboratory and imaging results; biomarkers; body-composition and wellness assessments; data from monitoring devices such as continuous glucose monitors; and genetic or other test results where such tests are offered.
• Images and recordings: clinical photographs and videos taken for assessment, treatment planning and documentation. These form part of your confidential clinical record.
• Payment and administrative data: invoices, payment status, and insurer or third-party payer details. Card payments are handled by payment providers, and we do not keep your full card details.
• Communications: enquiries, appointment requests, feedback, complaints and correspondence by telephone, email, messaging applications, forms or social media.
• Website and technical data: IP address, device and browser information, pages viewed and cookie preferences.
• Premises security data: CCTV footage in designated common areas. We do not operate CCTV in consultation, examination or treatment rooms.

We collect personal data directly from you and, where appropriate and lawful, from your parent, guardian or representative, a referring doctor, hospital, laboratory, imaging centre, insurer or employer involved in arranging your care. We use personal data to:

• respond to enquiries, register you and manage appointments;
• assess your health needs and provide, coordinate and follow up clinical, preventive and wellness care;
• plan and document procedures, and coordinate with hospitals or other providers involved in your care;
• communicate appointment details, test results, care instructions and follow-up arrangements;
• administer billing, payments, and insurance or authorised third-party claims;
• maintain accurate clinical records and carry out clinical audit, quality assurance, patient safety and service improvement;
• handle feedback, complaints, disputes, legal claims and professional indemnity matters;
• protect the safety and security of patients, visitors, staff, premises and information systems;
• meet our legal, regulatory and professional obligations; and
• send you optional service updates, where permitted and, where required, with your consent.

Health information is sensitive personal data under the PDPA. We process it only where the PDPA permits, namely with your explicit consent, where necessary for medical purposes and carried out by a healthcare professional or a person owing an equivalent duty of confidentiality, or where another lawful basis applies.

Where we use your information for something separate from your care, such as education, publication or promotional material, we will ask for your separate, specific and written consent. Giving that consent is always optional and never a condition of receiving care.

You may withdraw consent at any time where the law allows. Withdrawal does not affect processing already carried out lawfully, and we may still need to keep and use information that is necessary to provide your care, comply with the law or maintain records that the law requires.

Is providing your data compulsory?

Identity, contact, medical and administrative information is needed for us to assess you safely, deliver care, communicate with you and meet record-keeping obligations. If you choose not to provide information that is necessary for these purposes, we may be unable to provide some or all of the services you request. Marketing preferences, testimonials and the use of images for publication are voluntary.

Clinical photographs and videos are taken only where relevant to your care and, where required, with your consent. They are stored in clinic-controlled systems and treated as confidential health information.

We do not use identifiable clinical images, patient stories or testimonials in advertising, on websites or social media, in brochures or in presentations. Any education or publication use of images requires your separate written consent, de-identification where practicable, and compliance with Malaysian Medical Council and Ministry of Health requirements. You may withdraw consent for future use. We will then stop further use and remove the material from channels we control, although we cannot recall material that has already been lawfully printed or distributed.

We disclose personal data only on a need-to-know basis, for the purposes in this Policy and as permitted by law, to:

• healthcare professionals and care teams involved in your care, and your referring doctor where appropriate;
• hospitals, laboratories, imaging centres, pharmacies and other healthcare providers relevant to your services;
• insurers, third-party administrators or employers involved in payment or administration, where you have authorised disclosure or the law permits it;
• service providers acting on our behalf, such as clinical and appointment software, secure cloud storage, IT support, communications platforms and payment processors;
• professional advisers, auditors and indemnity providers; and
• regulators, courts, law enforcement and other authorities where disclosure is required or permitted by law.

Service providers handling data for us are bound by contractual, organisational and technical safeguards and may process your data only on our instructions. We do not sell personal data.

Separation from retail businesses

Your health information is held for your care. We do not disclose patient or client data to any retail, e-commerce or product-supply business, whether related to us or not, for product promotion or marketing. Any disclosure to a separate entity must have a lawful basis, serve a defined purpose and satisfy the consent, confidentiality and PDPA requirements that apply.

We communicate with you about our services only where the law permits and, where required, with your consent. Our communications comply with Malaysian Medical Council and Ministry of Health advertising requirements. You can opt out at any time by using the unsubscribe option, replying “STOP” where supported, or contacting us at info@arcclinic.my.

Opting out of marketing does not stop necessary messages such as appointment reminders, results notifications and communications about your ongoing care. We do not use your diagnoses, treatment history or clinical photographs to target advertising, and we do not give patient lists to advertising partners.

If any of our service providers, such as cloud or software providers, may store or process personal data outside Malaysia, we transfer personal data abroad only as section 129 of the PDPA permits, that is, where the destination has a law substantially similar to the PDPA or ensures an adequate level of protection, or where another lawful condition under the PDPA applies. We take reasonable steps to ensure your data remains protected to an equivalent standard.

We use reasonable technical, organisational and physical safeguards to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. These include role-based access controls, authentication, staff confidentiality obligations and training, secure systems, supplier controls, and physical protection of records.

No method of electronic transmission or storage is completely secure. Please avoid sending sensitive health information through unsecured channels unless we have confirmed the channel is appropriate.

We maintain procedures to detect, assess, contain and investigate personal data breaches and to keep a record of them. Where a breach causes or is likely to cause significant harm, or is of a significant scale, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it. We will notify affected individuals without unnecessary delay where the PDPA and applicable rules require it.

We keep personal data only for as long as necessary for the purposes it was collected, including ongoing care, legal and regulatory obligations, and dispute resolution. Clinical records are retained for the periods required by Malaysian healthcare law and professional guidance, which are longer for records of minors. Enquiries, marketing preferences and CCTV footage are kept according to our documented retention schedules and are securely deleted or destroyed once no longer needed, unless retention is required for an investigation, legal claim or other lawful purpose.

Subject to the PDPA and its exceptions, you have the following rights:

To make a request, contact us using the details in section 17. We may need to verify your identity and authority first, and a reasonable fee may apply, which we will explain beforehand. A parent, guardian or legally authorised representative may make a request for a minor or a person who lacks capacity. We will respond within the period set by the PDPA. Some requests may be limited where the law permits or requires us to retain or withhold information.

Our website may use cookies and similar technologies to support essential functions, remember your preferences and, where enabled and permitted, understand how the site is used. You can manage cookies through your browser settings and any preference tool we provide.

We do not pass enquiry or booking form content containing health information to advertising platforms. Our website may link to third-party sites, which are governed by their own privacy notices and for which we are not responsible.

For patients under 18, we obtain consent from a parent, guardian or other authorised person as the law requires, subject to any legal exceptions. We apply the same confidentiality and security protections to minors’ data, and we may verify the identity and authority of anyone who asks for information on another person’s behalf.

If you have a question or concern about how we handle your personal data, please contact us first and we will review it and respond promptly. If you remain dissatisfied, you may contact the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, JPDP), Malaysia, through its official channels.

We may update this Policy to reflect changes in our services, systems or legal obligations. The current version is published on our website and available at our premises, with the effective date shown at the top.

This Policy is available in English and Bahasa Malaysia. If there is any inconsistency between the two versions, the English version prevails.