--- title: "Privacy Notice | BioApps Sdn Bhd" description: "How BioApps collects, uses and protects personal data, issued under the Personal Data Protection Act 2010." url: https://bioapps.com.my/privacy-notice/ --- # Privacy Notice How the Company collects, uses and protects personal data, issued under the Personal Data Protection Act 2010. Contents - [1 Personal data collected](#clause-1) - [2 Purposes of processing](#clause-2) - [3 Whether supply is obligatory](#clause-3) - [4 Sources of personal data](#clause-4) - [5 Disclosure](#clause-5) - [6 Transfer outside Malaysia](#clause-6) - [7 Security and retention](#clause-7) - [8 This website](#clause-8) - [9 Rights of the individual](#clause-9) - [10 How to make a request](#clause-10) - [11 Changes to this notice](#clause-11) ## Personal Data Protection Notice Last revised: 25 July 2026 BioApps Sdn Bhd, of Level G, South Tower, Universiti Malaya Medical Centre, Jalan Profesor Diraja Ungku Aziz, 59100 Kuala Lumpur, processes personal data in the course of providing prosthetic and orthotic care. This notice is issued under section 7 of the Personal Data Protection Act 2010 and explains what personal data the Company collects, why it is collected, to whom it may be disclosed, and the rights available to the individual concerned. ### 1 Personal data collected The Company collects the personal data that an individual provides when requesting an appointment, attending the centre, or corresponding with the Company. This includes name, telephone number, email address, the limb or joint concerned, the referring hospital or clinic, and any further information volunteered in support of the request. - Identifying data: name, telephone number, email address. - Clinical data: the limb or joint concerned, the referral, measurements taken during casting, and the devices supplied. - Funding data: where an application is made to a funding body, the reference details required by that body. Clinical data is sensitive personal data within the meaning of the Act. It is processed only for the purposes set out below, and only where the individual has given explicit consent or where the Act otherwise permits. ### 2 Purposes of processing Personal data is processed for the following purposes. - To arrange, confirm and reschedule appointments. - To assess the individual, take casts, fabricate devices and carry out fitting and review. - To maintain the clinical record required for continuing care and for the adjustment of devices over time. - To support an application to a funding body where the individual asks the Company to do so. - To respond to enquiries and complaints. - To meet legal, regulatory and accreditation obligations. ### 3 Whether supply is obligatory The supply of name and telephone number is obligatory. Without them the Company cannot confirm an appointment. The supply of an email address is optional. Where clinical data is not supplied, the Company may be unable to assess suitability or to fabricate a device, and care may not be able to proceed. ### 4 Sources of personal data Personal data is collected directly from the individual, from a parent or guardian where the individual is a minor, and from the hospital or clinic that made the referral. ### 5 Disclosure Personal data is not sold and is not disclosed for marketing. It may be disclosed to the following classes of third party, and only so far as is necessary for the purposes above. - Clinicians at Universiti Malaya Medical Centre and at the referring hospital or clinic, for the purpose of continuing care. - Funding bodies, including the Social Security Organisation, where the individual applies for funding through the Company. - Suppliers of prosthetic and orthotic components, where a component must be ordered to individual measurements. - Professional advisers, auditors and regulators, where the Company is required to disclose. - Any party to whom the Company is required to disclose by law or by order of a court. ### 6 Transfer outside Malaysia Personal data is held in Malaysia. Where a component is ordered from a supplier outside Malaysia, only the measurements and the order reference are transferred, and no identifying data is sent unless the individual consents. ### 7 Security and retention The Company takes practical steps to protect personal data from loss, misuse, unauthorised access, alteration and disclosure. Access to clinical records is restricted to staff who need it in order to provide care. - An appointment request submitted through this website is retained for 60 days from the date it is received, and is then destroyed. - Where the individual goes on to attend the centre, the information given in that request forms part of the clinical record and is retained with it. - Clinical records are retained for the period required of medical records, and are destroyed at the end of that period. ### 8 This website This website does not require registration, does not use advertising cookies, and does not embed third party trackers. The video clip on the homepage is served from this website. The appointment form is submitted to the Company and is not passed to any third party. ### 9 Rights of the individual Subject to the Act, an individual may exercise the following rights. - To request access to the personal data the Company holds about them. - To request the correction of personal data that is inaccurate, incomplete or out of date. - To withdraw consent to the processing of personal data, in whole or in part. - To limit the processing of personal data for a particular purpose. A request may be refused or limited where the Act permits, for example where complying would disclose information about another individual. Withdrawing consent may mean that the Company can no longer provide or adjust a device. ### 10 How to make a request A request under this notice, or a complaint about the handling of personal data, should be addressed to the Company at pno@bioapps.com.my, by telephone on 03-7954 1830, or in writing to Level G, South Tower, Universiti Malaya Medical Centre, Jalan Profesor Diraja Ungku Aziz, 59100 Kuala Lumpur. The Company will respond within the period allowed by the Act. ### 11 Changes to this notice This notice may be revised. The version in force is the version published on this page, and the date it was last revised is shown above. In the event of any inconsistency between the English version and the Bahasa Malaysia version of this notice, the Bahasa Malaysia version prevails.