Your information, handled with care.
This notice explains what personal and health information Nova Clinic collects, why we need it, who we share it with, and the choices you have. It applies to our website, WhatsApp channel and clinic operations in Malaysia.
1. Who we are
Nova Clinic Sdn. Bhd. (“Nova Clinic”, “we”, “us”) operates a private general practice at Ground Floor, Menara Nova, 18 Jalan Telawi 3, Bangsar Baru, 59100 Kuala Lumpur, Malaysia. We are the data controller for the information described in this notice.
Questions about privacy, or requests to exercise your rights, can be sent to our Data Protection Officer at privacy@novaclinic.my or by post to the address above, marked “For the attention of the DPO”.
2. What we collect
When you become a patient
- Identity and contact details: name, NRIC or passport number, date of birth, sex, address, phone number and email address.
- Health information: symptoms, medical and family history, examination findings, diagnoses, test results, imaging, prescriptions, allergies and vaccination records.
- Insurance and panel details: insurer or TPA name, policy or member number, employer and guarantee-of-payment information.
- Payment and billing records, including receipts and outstanding balances.
- Clinical correspondence, referral letters and consent forms.
When you contact us or use this website
- Your name, phone number and the content of messages you send by WhatsApp, email or the appointment form.
- Appointment preferences, such as preferred doctor, date and reason for the visit.
- Basic technical information from our web host, such as IP address, browser type and pages requested, used for security and to understand how the site is used.
We do not intentionally collect information about children without the consent of a parent or guardian. Please keep website and WhatsApp messages to appointment and administrative details; a brief reason for the visit is helpful, but detailed clinical history is better discussed in consultation.
3. Why we use it
- To register you as a patient and provide medical care, including diagnosis, treatment, follow-up and referrals.
- To maintain accurate medical records and meet our professional and legal record-keeping duties.
- To process panel claims, insurance guarantees and payments, and to recover unpaid fees.
- To arrange appointments, reminders and results follow-up that you have asked for.
- To respond to enquiries made through WhatsApp, email, phone or this website.
- To run the clinic safely, including infection control, complaints handling, audit and quality improvement.
- To meet legal, regulatory, tax and Malaysian Medical Council obligations.
- With your separate consent, to send occasional clinic updates or health information. You can opt out at any time and we will stop.
4. Our basis for processing
Under the PDPA, we rely on your consent for most processing, and on the necessity of processing for the performance of a contract, compliance with legal obligations, and the protection of vital interests in an emergency. Where we process sensitive health data, we do so as part of providing healthcare and with your consent, or as otherwise permitted by law.
Providing your information is generally voluntary, but if you choose not to provide details we need, we may not be able to register you, provide safe care or process an insurance claim.
5. Who we share it with
We share information only where it is needed for your care or the operation of the clinic, and only to the extent necessary:
- Doctors, nurses and clinic staff involved in your care, on a need-to-know basis.
- Laboratories, radiology providers and other diagnostic services you have been referred to.
- Specialists and hospitals to whom we refer you, with your knowledge.
- Your insurer, third-party administrator or employer’s panel, where you ask us to bill them or where a guarantee of payment is in place.
- Pharmacies, suppliers and secure IT service providers who support our operations under confidentiality obligations.
- Government authorities, regulators, courts or the police, where disclosure is required or permitted by law.
- Our professional advisers, auditors and insurers, where necessary and under duties of confidence.
We do not sell personal data, and we do not share it for third-party advertising.
6. WhatsApp, maps and third-party services
Our WhatsApp links open a conversation in WhatsApp, which is operated by Meta. Messages sent through WhatsApp are processed by Meta under its own terms and privacy policy, and may be stored outside Malaysia. We use WhatsApp because patients find it convenient, but please use it only for appointment and administrative matters. If you prefer not to use WhatsApp, call us on +60 3-2711 8899 or email care@novaclinic.my.
Our contact page embeds a Google Map. Loading the map may allow Google to set cookies and collect technical information such as your IP address and approximate location. We do not control Google’s processing. You can avoid this by using the written directions and not interacting with the embedded map. Our site does not otherwise use advertising or analytics cookies.
7. How long we keep it
Medical records are retained for at least seven years after your last visit, or longer where the law or professional guidance requires it. Records for minors are kept for seven years after they reach the age of majority. Billing and tax records are kept for seven years. Messages and enquiries that do not become part of your medical record are kept only as long as needed to deal with the matter, and are then deleted or anonymised.
When records are no longer required, we destroy or anonymise them securely.
8. How we protect it
We use access controls, staff confidentiality undertakings, secured systems, encrypted backups and locked physical storage. Only staff who need your information for their work can access it. While no system is completely secure, we review our safeguards regularly and will notify affected individuals and the relevant authorities if a personal data breach occurs, as required by law.
9. Your rights
Subject to the PDPA and applicable professional duties, you may:
- Ask for a copy of the personal data we hold about you, and information about how it has been used and disclosed.
- Ask us to correct information that is inaccurate, incomplete or out of date.
- Withdraw consent for future processing, including marketing communications, though this does not affect processing already carried out or records we must keep by law.
- Ask us to limit or stop certain processing, where the law allows.
- Ask questions or raise a concern about how we have handled your information.
To make a request, email privacy@novaclinic.my. We may need to verify your identity before acting. We aim to respond within 21 days. If you are not satisfied with our response, you may contact the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi) in Malaysia.
10. Changes to this notice
We may update this notice from time to time to reflect changes in our practice or the law. The current version is always available on this page, with the date it was last revised. Material changes affecting how we use your information will be communicated to patients where appropriate.