Privacy Policy

1. Who We Are

Klinik Pergigian Aurea Dental ("we", "us", "our") is a dental clinic registered and operating in Malaysia. We are the data controller responsible for the personal data you provide to us, as defined under the Personal Data Protection Act 2010 (PDPA) and its 2024 amendments.

2. Personal Data We Collect

We collect only the personal data necessary for the purposes described in this policy. This may include:

Identity & Contact Data

• Full name, Malaysian IC or passport number, date of birth, gender
• Phone number, WhatsApp contact, email address, residential address

Dental & Medical Data (Sensitive)

• Dental history, treatment records, and clinical notes
• Medical history, allergies, and current medications
• X-rays, intraoral photographs, and clinical images
• Treatment plans and signed consent forms

Transaction & Appointment Data

• Appointment dates, times, and treatment types
• Payment records (amount, method — full card numbers are never stored)
• Insurance information (if applicable)

Communications Data

• WhatsApp messages and enquiries sent to us
• Feedback, reviews, or complaints submitted

Website & Technical Data

• IP address, browser type, and device information
• Pages visited, time on site, referring URL (via Google Analytics / Google Ads)
• Cookie identifiers (see Section 12)

3. How We Collect Your Data

• Directly from you — when you register, complete a medical history form, book an appointment, or contact us via WhatsApp, phone, or email
• During treatment — clinical examinations, X-rays, and photographs taken in the course of providing dental care
• From our website — when you click WhatsApp buttons or browse our site (via cookies and analytics tools)
• From third parties — referrals from other healthcare providers or insurance companies, with your prior consent

4. Why We Use Your Data (Purposes)

Provision of Dental Services

• To register you as a patient and maintain clinical records
• To provide dental treatment, diagnosis, and aftercare
• To manage appointments, reminders, and follow-ups
• To process payments and issue receipts

Operational

• To communicate about your care via phone, WhatsApp, or email
• To respond to enquiries or complaints
• To comply with professional and statutory obligations

Marketing & Analytics (with consent)

• To send appointment reminders, health tips, or promotional offers where you have consented
• To measure website performance and ad effectiveness via Google Analytics and Google Ads
• To display relevant ads to prior website visitors (remarketing)

5. Legal Basis for Processing

• Consent — for marketing messages, clinical photography, and other discretionary uses
• Contractual necessity — to provide the dental services you requested
• Legal obligation — to retain records under the Dental Act 1971, National Health Act 2006, and other applicable laws
• Legitimate interests — for operational and security purposes, balanced against your rights

For sensitive personal data (dental/medical records), we rely on your explicit written consent obtained at registration, or as permitted under Malaysian healthcare law.

6. Disclosure to Third Parties

We do not disclose your personal data to third parties except in the following circumstances:

• Service providers — vendors who assist with clinic or website operations, bound by confidentiality obligations
• Referrals — other healthcare professionals (specialists, hospitals) where clinically necessary and with your knowledge
• Google — anonymised analytics and advertising data via Google Analytics and Google Ads (AW-18381934201). See Google's Privacy Policy
• Insurance providers — where you have authorised us to submit claims
• Legal authorities — where required by law, court order, or regulatory demand

7. Cross-Border Data Transfers

Some tools (including Google Analytics and Google Ads) may process data on servers outside Malaysia. Under Section 129 of the PDPA (as amended 2024), we ensure cross-border transfers occur only to countries or organisations with comparable data protection standards, or with your explicit consent. Google operates under Standard Contractual Clauses. See Google's compliance documentation.

8. Data Retention

• Clinical and medical records — minimum 7 years from last treatment (or until 7 years after a minor patient turns 18)
• Financial records — 7 years under the Income Tax Act 1967
• Marketing consents — until withdrawn, then deleted within 30 days
• Website analytics — up to 26 months (Google Analytics default)

After the applicable retention period, data is securely deleted or anonymised.

9. Security Safeguards

• Physical security (CCTV, locked record storage)
• Password-protected, access-controlled practice management systems
• HTTPS encryption on this website (TLS 1.2+)
• Access limited to authorised staff on a need-to-know basis
• Regular review of security practices and access privileges

No electronic transmission or storage is 100% secure. We strive to protect your data but cannot guarantee absolute security.

10. Your Rights as a Data Subject

Right of Access

Request a copy of personal data we hold. We respond within 21 days. A reasonable fee may apply.

Right to Correction

Request correction of inaccurate or incomplete data. Corrections made within 21 days.

Right to Withdraw Consent

Withdraw consent for discretionary processing (e.g., marketing) at any time. Note: withdrawing consent for clinical data may affect our ability to treat you.

Right to Limit Processing

Request that we restrict processing to storage only, pending a correction or complaint.

Right to Data Portability

Receive your data in a structured, machine-readable format and request direct transmission to another data controller where feasible.

Right to Complain

• Contact us directly first (see Section 15)
• Personal Data Protection Department (PDPD), Ministry of Digital — pdp.gov.my

11. Children's Privacy

For patients under 18, we collect personal data from the parent or legal guardian, who must provide written consent. Our website is not directed at children under 13. If you believe a child has submitted data through our website without consent, contact us and we will delete it promptly.

12. Cookies & Website Tracking

• Essential cookies — required for basic site functionality
• Analytics cookies — Google Analytics collects anonymised usage data (pages visited, traffic source)
• Advertising cookies — Google Ads (AW-18381934201) tracks WhatsApp enquiry conversions to measure ad performance

Opt out of Google Analytics: tools.google.com/dlpage/gaoptout
Opt out of ad personalisation: adssettings.google.com

13. Data Breach Notification

In the event of a breach, we will:

• Notify the PDPD within 72 hours of becoming aware, per PDPA 2024 amendments
• Notify affected data subjects without undue delay where there is a high risk to their rights
• Maintain an internal breach register regardless of notification threshold

If you suspect your data has been compromised, email helloaureadental@gmail.com immediately.

14. Changes to This Policy

We may update this policy periodically. Material changes will be reflected in the "Last updated" date above and notified on our website or directly where required. Continued use of our services constitutes acceptance of the updated policy.

15. How to Contact Us

Prepared in accordance with the Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection (Amendment) Act 2024, Malaysia.