General Privacy Statement

Data You Provide Directly

When you book or attend a retreat, you may provide information that we need to deliver care and manage logistics. Below are common items illustrated with short-case examples.

• Identity and contact details: name, date of birth, postal address, phone number, and email. Case: used to confirm a retreat reservation and send arrival instructions.
• Health and medical information: medical history, medications, allergies, mobility assessments, and rehabilitation goals. Case: physiotherapist uses this to design a safe exercise program.
• Payment and billing information: billing address, invoice details, and transaction records (handled by secure payment processors). Case: processing retreat fees and issuing receipts.
• Intake questionnaires and consent forms: signed consent for therapies and data processing choices. Case: consent to share rehabilitation notes with a referring physician.
• Emergency contact and next-of-kin details used for on-site safety and urgent communication. Case: contacting a family member in the event of a sudden medical issue.
• User feedback and outcome surveys collected after stays to evaluate program effectiveness and refine protocols. Case: post-retreat survey used to adjust future therapy plans.

How We Use Your Data

We process data to operate services, keep participants safe, and improve programs. Below are purpose statements accompanied by short practical scenarios illustrating typical processing activities.

• To provide booked services such as retreats, rehabilitation sessions, and teleconsultations. Example: scheduling physiotherapy sessions based on intake findings.
• To manage payments, billing, and refunds. Example: issuing an invoice and reconciliation after a retreat stay.
• To ensure on-site safety and medical coordination. Example: sharing allergy information with the kitchen for meal planning.
• To personalize programs and communicate relevant care instructions. Example: adjusting exercise intensity after weekly progress notes.
• To evaluate outcomes and improve services through aggregated analysis. Example: comparing mobility scores before and after a 14-day program to refine protocols.
• To detect and prevent fraud, abuse, and security incidents. Example: contribute anomalous booking patterns that suggest misuse.
• To comply with legal obligations and respond to lawful requests from authorities. Example: providing records in response to a court order where required.
• To send service-related updates and optional marketing communications where consent was given. Example: informing former participants about a new senior balance workshop if they opted in.

Data Subject Rights (Illustrative Guidance)

Although SeraThealth operates in Malaysia, we recognize internationally accepted privacy protections. The following sections explain rights commonly referenced in international frameworks, illustrated with practical steps for exercising them.

• Right to access: you can request a copy of personal data we hold about you. Example: requesting your intake form and rehabilitation notes to share with another provider.
• Right to rectification: you may ask us to correct inaccurate data. Example: updating a medication list after a physician changes prescriptions.
• Right to erasure: subject to legal and service requirements, you may request deletion of data. Example: asking to remove marketing contact details while retaining clinical records required for safety.
• Right to restriction of processing: you may ask to limit certain uses of your data. Example: pausing data use for secondary research while still receiving care.
• Right to data portability: where technically feasible, we can provide personal data in a structured, commonly used format. Example: exporting your appointment history for transfer to another provider.
• Right to object: you can object to certain processing, such as direct marketing, and we will respect opt-outs in line with applicable law.

When We Share Your Data

We share personal data only as needed to provide services or comply with legal obligations. Each sharing scenario has safeguards and a specific, documented purpose.

• Healthcare partners and consultants for coordinated care and treatment planning.
• Payment processors and banks to complete and reconcile payments.
• Third-party service providers such as telehealth platforms and booking systems under contractual terms restricting use.
• Legal or regulatory authorities when required by law or court orders.
• Aggregated and anonymized data shared with researchers or partners to improve therapies, without personal identifiers.
• Family members or nominated contacts when you have provided consent or in emergency situations for safety.

Security Measures

We apply technical and organizational measures to protect personal data, tailored to the sensitivity of the information and informed by practical risk assessments. Example: clinical notes are stored separately from public profiles and accessed only by authorized clinicians.

• Encryption of data in transit and at rest where applicable to protect confidentiality.
• Access controls and role-based permissions restricting data access to authorized staff only.
• Regular vendor security assessments, staff training on data handling, and incident response procedures.

How to exercise your privacy rights

To submit a request regarding access, correction, portability, restriction, objection, or deletion of your personal data, contact our data protection team via the contact details below or through the contact form on SeraThealth.pro/contact. Please include your full name, Business ID 736504795418 if applicable, and a clear description of the request. We may ask for information to verify your identity before processing the request.

[email protected]

We will acknowledge receipt of your request promptly and aim to respond substantively within 30 calendar days. Complex requests may require additional time; in such cases we will inform you and provide a reasonable timeframe.