سياسة الخصوصية
Last updated: 15 September 2026
هذه الوثيقة القانونية متاحة باللغة الإنجليزية، والنسخة الإنجليزية هي المرجع المعتمد. للمساعدة، تواصل معنا على cares@medtoursmalaysia.com.
This Privacy Policy explains how we collect, use, share and protect your personal data when you use medtoursmalaysia.com or contact us by WhatsApp, email or phone. It is written to meet Malaysia's Personal Data Protection Act 2010 (PDPA) and, for patients in Indonesia, Law No. 27 of 2022 on Personal Data Protection (UU PDP).
Who is responsible for your data
The data user and controller is Virtual Dynamic Ventures, Business Registration No. 202603217802 (TR0347936-T), which operates MedToursMalaysia. Privacy contact: cares@medtoursmalaysia.com.
What we collect
Identity and contact details: your name, phone and WhatsApp number, email address, country, city, language, nationality and, where a hospital needs it, your date of birth. Medical information: reports, scans, laboratory results, diagnoses, medication lists and treatment history that you choose to send us. Travel and stay details: passport details, flight and accommodation information where you ask us to arrange them. Communications: the content of your WhatsApp, email and phone communications with us. Technical data: IP address, browser, device type and pages viewed, including through cookies. Our enquiry form requires your name, phone number, email address, country, city, treatment area (specialty) and a description of your case; without these we cannot understand your case or approach a hospital for you. Uploading your medical reports is optional when you first enquire, but a hospital cannot carry out a specialist review or issue a written cost estimate without them, so those steps cannot proceed until you provide them. Passport details, travel dates and companion information are optional, and we need them only if you ask us to arrange your travel and stay. If you do not provide the required information you can still read this website, but we cannot process your enquiry.
Why we use it and our lawful basis
We use your data to answer your enquiry and prepare your case file; to share your case with the hospitals and specialists you choose so that they can assess it and issue a written cost estimate; to arrange the travel, stay and support you ask for; to communicate with you about your case; to meet legal, accounting and regulatory obligations; and to improve our website and services. Under Malaysia's PDPA we rely on the consent you give us, together with the limited exceptions the Act allows — for example where processing is necessary to perform the service you requested or to comply with the law. The PDPA does not recognise a general legitimate-interest basis, so we do not rely on one. Where you are in Indonesia we may additionally rely on the bases available under UU PDP, including performance of an agreement and our legitimate interests, balanced against your rights. Your medical information is sensitive personal data, and we process it only with your explicit consent. For our forms, you give that consent by ticking the consent box. Where you send us medical documents directly by WhatsApp or email without using a form, receiving your file is not by itself your consent: before we process those documents we ask you to confirm that you agree to the purposes described in this policy and to our sharing them with the hospital you choose, and we record that confirmation, including the date and the channel through which it was given. In our first reply we also confirm in writing what you have consented to and how you can withdraw it. You can withdraw your consent at any time as described in 'Your rights'.
Medical information
Your medical documents are shared only with the hospitals and specialists needed to assess your case, and only for that purpose. We do not sell your data, we do not use your medical information for advertising, and we do not use it for automated decision-making or profiling.
Sharing your data
We share your data with: the hospitals, clinics and licensed specialists you choose to consult — these are independent organisations that act as their own data controllers, with their own data-protection obligations, and once your records are with them you can also exercise your rights directly against them; the hospitality, accommodation, transport and translation providers we arrange for you, who receive only what they need for your booking; the technology providers that host and run this website, our forms and our messaging, which act only on our instructions under contract as our processors; Meta Platforms, which provides the WhatsApp Business messaging service (see 'Messaging on WhatsApp'); and professional advisers, auditors or authorities where the law requires it. We do not sell your personal data.
Messaging on WhatsApp
Our WhatsApp number is operated on the WhatsApp Business Platform provided by Meta Platforms. When you message us, Meta processes your message content, your phone number and message metadata in order to deliver the message. For that messaging activity Meta acts as our processor under the WhatsApp Business Terms of Service, handling the data on our behalf to deliver the messages. Meta may also process certain data as an independent controller for its own separate purposes under its own terms and privacy policy; that processing is governed by Meta, not by us. We use WhatsApp only to talk to people who have contacted us first or who have asked to be contacted. We do not buy contact lists and we do not send marketing messages to people who have not asked to hear from us. You can stop WhatsApp messages at any time by replying STOP or by asking us to move to email.
International transfers
Our website, email and messaging providers may store data on servers outside Malaysia, including in the European Union, the United States and Singapore. For transfers of personal data out of Malaysia we rely on a condition permitted by the PDPA — your consent, the necessity of the transfer in order to perform the service you asked us for, or another applicable statutory condition — and we require each provider by contract to protect the data to a standard comparable to the PDPA. If you are in Indonesia, your data will be transferred to Malaysia and to these providers so that we can prepare your hospital estimate. For personal data originating in Indonesia we apply the transfer sequence UU PDP requires: we transfer only to a country whose level of personal-data protection is at least equivalent to UU PDP; where that is not established, we put in place binding and adequate safeguards with the recipient for the transfer; and where neither applies, we transfer only with your consent.
How long we keep it
The original clinical record of your treatment is created and held by the hospital under its own retention rules; we do not hold that original record. What we hold are the copies of the reports and correspondence you send us, together with the estimate the hospital issues through us. We keep your case file with us for 24 months after the end of your treatment. A case is closed when your treatment ends or, if you do not proceed, when our last contact about it ends; we delete the copies we hold at case closure plus 24 months, or earlier if you ask us to, except where the law requires us to retain a record — such as the accounting and tax documents below — in which case retention continues until the end of the required period. In addition we keep: accounting and tax documents relating to any invoice we issue, for seven years as Malaysian tax law requires; enquiry records that do not proceed to treatment, for 24 months from our last contact; and website analytics for 14 months.
Your rights
You may ask us for access to the personal data we hold about you, ask us to correct it, withdraw a consent you have given, ask us to delete it, and object to or restrict certain uses. In Malaysia, the Personal Data Protection (Amendment) Act 2024 also lets you ask us — where it is technically feasible and the data formats are compatible — to transmit your personal data directly to another organisation in a portable form. If you are in Indonesia, UU PDP additionally gives you the right to obtain and reuse your personal data and to request that we transmit it to another controller where technically feasible, and the right to seek compensation for loss caused by processing of your personal data in breach of UU PDP; these rights apply subject to the conditions and exceptions in the law. To exercise any of these rights, email cares@medtoursmalaysia.com. If you are in Malaysia we will comply with an access or correction request within 21 days, as the PDPA requires. If you are in Indonesia we will complete a request to access or correct your data, to stop processing after you withdraw consent, and to restrict processing, within 3 x 24 hours of receiving it, subject only to the exceptions UU PDP allows. Withdrawing your consent may mean we can no longer help with your treatment enquiry. If you are not satisfied with our response you may complain to the Personal Data Protection Department (JPDP) in Malaysia or, in Indonesia, to the authority responsible for personal data protection under UU PDP.
How we protect your data
We take reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. We limit access to your medical documents to the people and providers who need them to handle your case, we engage our technology providers under contract, and we transmit data over encrypted connections. No method of transmission or storage is completely secure; if a breach affects your personal data we will act promptly to investigate it and, where the law requires, notify you and the relevant authority.
Cookies
We use essential cookies to make this website work and analytics cookies to understand which pages are useful. You can block cookies in your browser settings, although essential parts of the site may then not work.
Children
Our services are for adults. Where a patient is a minor, we ask a parent or legal guardian to provide the information and the consent on their behalf.
If you register as a partner
If you apply through our partner registration form — for example as a medical travel or tour company, a concierge provider or a medical escort service — we collect your company name, your contact person's name, business email, phone or WhatsApp number, country, city, website or social-media details and the description of services you provide. We use this only to evaluate your application, to communicate with you about it and, if we proceed, to onboard and manage the working relationship, on the basis of your consent and of taking steps to enter into an agreement with you. We share it with the members of our team who assess partnerships and with our technology providers acting as our processors; we do not share it with patients. We keep partner-application data for 24 months after our last contact if we do not proceed, and for the duration of the relationship plus seven years for accounting and tax purposes if we do.
Changes to this policy
We will update this page and its last updated date when our practices change. Material changes will be announced on this website.
Contact
cares@medtoursmalaysia.com
Notis Perlindungan Data Peribadi (Bahasa Malaysia)
Notis ini dikeluarkan dalam Bahasa Malaysia menurut seksyen 7 Akta Perlindungan Data Peribadi 2010 (Akta 709), dan hendaklah dibaca bersama Dasar Privasi penuh di halaman ini. 1. Pengguna data. Data peribadi anda dikendalikan oleh Virtual Dynamic Ventures, No. Pendaftaran Perniagaan 202603217802 (TR0347936-T), yang mengendalikan jenama MedToursMalaysia. Anda boleh menghubungi kami di cares@medtoursmalaysia.com untuk sebarang pertanyaan berkaitan privasi. 2. Asas undang-undang. Kami memproses data peribadi dan data peribadi sensitif (maklumat perubatan) anda berdasarkan persetujuan anda, berserta pengecualian terhad yang dibenarkan oleh Akta. Bagi maklumat perubatan, kami hanya memprosesnya dengan persetujuan nyata anda, iaitu apabila anda menanda kotak persetujuan pada borang kami atau menghantar dokumen perubatan kepada kami melalui WhatsApp atau e-mel. 3. Tujuan pemprosesan. Data anda digunakan untuk: menjawab pertanyaan anda dan menyediakan fail kes anda; berkongsi kes anda dengan hospital dan pakar yang anda pilih supaya mereka dapat menilainya dan mengeluarkan anggaran kos bertulis; mengatur perjalanan, penginapan, pengangkutan dan sokongan yang anda minta; berkomunikasi dengan anda mengenai kes anda; mematuhi kewajipan undang-undang, perakaunan dan kawal selia; dan menambah baik laman web serta perkhidmatan kami. 4. Data yang dikumpul. Kami mengumpul: butiran identiti dan hubungan (nama, nombor telefon dan WhatsApp, alamat e-mel, negara, bandar, bahasa, kewarganegaraan dan, jika hospital memerlukannya, tarikh lahir); maklumat perubatan (laporan, imbasan, keputusan makmal, diagnosis, senarai ubat dan sejarah rawatan yang anda hantar); butiran perjalanan dan penginapan (butiran pasport, penerbangan dan penginapan jika anda meminta kami menguruskannya); kandungan komunikasi anda dengan kami; dan data teknikal (alamat IP, pelayar, jenis peranti dan halaman yang dilihat, termasuk melalui kuki). 5. Sumber data. Data dikumpul terus daripada anda melalui borang laman web kami, WhatsApp, e-mel atau telefon; sebahagian data teknikal dikumpul secara automatik melalui kuki apabila anda melayari laman web. 6. Kelas pihak ketiga. Data anda boleh didedahkan kepada: hospital, klinik dan pakar perubatan berlesen yang anda pilih (mereka bertindak sebagai pengawal data bebas); penyedia perhotelan, penginapan, pengangkutan dan penterjemahan yang kami aturkan untuk anda; penyedia teknologi yang kami kontrakkan dan yang bertindak sebagai pemproses kami; Meta Platforms bagi perkhidmatan pemesejan WhatsApp Business; serta penasihat profesional, juruaudit atau pihak berkuasa jika dikehendaki oleh undang-undang. Kami tidak menjual data peribadi anda. 7. Wajib atau pilihan. Nama, nombor telefon, alamat e-mel, negara, bandar, bidang rawatan dan penerangan kes anda adalah wajib; tanpa maklumat ini kami tidak dapat memproses pertanyaan anda atau menghubungi hospital. Laporan perubatan adalah pilihan semasa pertanyaan awal, tetapi hospital tidak dapat membuat semakan pakar atau mengeluarkan anggaran kos bertulis tanpanya. Butiran pasport, tarikh perjalanan dan maklumat pengiring adalah pilihan dan hanya diperlukan jika anda meminta kami mengatur perjalanan dan penginapan anda. 8. Hak akses dan pembetulan. Anda berhak meminta akses kepada data peribadi anda, meminta pembetulannya, menarik balik persetujuan yang telah diberi, meminta penghapusan data, serta membantah atau menyekat penggunaan tertentu. Untuk melaksanakan hak ini, e-mel cares@medtoursmalaysia.com. Kami akan mematuhi permintaan akses atau pembetulan dalam tempoh 21 hari sebagaimana dikehendaki oleh Akta. Menarik balik persetujuan mungkin bermakna kami tidak lagi dapat membantu pertanyaan rawatan anda. Jika anda tidak berpuas hati, anda boleh membuat aduan kepada Jabatan Perlindungan Data Peribadi (JPDP). 9. Penyimpanan. Rekod klinikal asal disimpan oleh hospital mengikut peraturannya sendiri; kami hanya menyimpan salinan yang anda hantar kepada kami. Kami menyimpan fail kes anda selama 24 bulan selepas rawatan tamat; dokumen perakaunan dan cukai selama tujuh tahun; rekod pertanyaan yang tidak diteruskan selama 24 bulan dari hubungan terakhir; dan data analitik laman web selama 14 bulan. Kami memadam salinan fail kes anda pada penutupan kes tambah 24 bulan, atau lebih awal jika anda memintanya, kecuali apabila undang-undang mewajibkan kami menyimpan rekod — seperti dokumen perakaunan dan cukai di atas — yang penyimpanannya diteruskan sehingga tamat tempoh yang diwajibkan. 10. Permohonan sebagai rakan kongsi. Jika anda memohon melalui borang pendaftaran rakan kongsi kami — contohnya sebagai syarikat perjalanan atau pelancongan perubatan, penyedia perkhidmatan konsierj, atau perkhidmatan pengiring perubatan — kami mengumpul nama syarikat anda, nama orang yang boleh dihubungi, e-mel perniagaan, nombor telefon atau WhatsApp, negara, bandar, butiran laman web atau media sosial, serta penerangan perkhidmatan yang anda tawarkan. Kami menggunakan maklumat ini hanya untuk menilai permohonan anda, berkomunikasi dengan anda mengenainya, dan — jika kami meneruskan — untuk memulakan serta mengurus hubungan kerja, atas dasar persetujuan anda dan langkah-langkah untuk membuat perjanjian dengan anda. Kami berkongsi maklumat ini dengan anggota pasukan kami yang menilai permohonan dan dengan penyedia teknologi kami yang bertindak sebagai pemproses; kami tidak berkongsinya dengan pesakit. Medan yang wajib pada borang rakan kongsi ialah nama syarikat, nama orang yang boleh dihubungi, e-mel perniagaan, nombor telefon atau WhatsApp, negara, bandar dan jenis perkhidmatan. Kami menyimpan data permohonan rakan kongsi selama 24 bulan dari hubungan terakhir jika tidak diteruskan, dan sepanjang tempoh hubungan tambah tujuh tahun untuk tujuan perakaunan dan cukai jika diteruskan. 11. Pilihan bahasa. Notis ini disediakan dalam Bahasa Malaysia dan Bahasa Inggeris. Dasar Privasi penuh turut disediakan dalam Bahasa Indonesia, dan dalam bentuk Bahasa Inggeris untuk pembaca Bahasa Cina dan Bahasa Arab. Jika terdapat sebarang percanggahan tafsiran undang-undang, versi Bahasa Inggeris mengatasi, kecuali di mana undang-undang Malaysia menghendaki versi Bahasa Malaysia terpakai.
Virtual Dynamic Ventures · Business Registration No. 202603217802 (TR0347936-T) · cares@medtoursmalaysia.com