Privacy Policy & PDPA Notice

Who we are

This Privacy Policy and Personal Data Protection Notice explains how Ian Chiropractic, trading as Ian The Chiro, collects, uses, stores, discloses, and protects personal data when you use our website, contact the clinic, book an appointment, attend a consultation, or communicate with us through WhatsApp, email, phone, social media, or other channels.

This notice applies to personal data collected through the Ian The Chiro website, appointment enquiries, WhatsApp messages, contact forms, email, phone calls, clinic records, booking systems, consent forms, and other clinic-related communications.

By using this website, submitting your personal data, contacting the clinic, booking an appointment, or attending a consultation, you acknowledge that you have read and understood this Privacy Policy and Personal Data Protection Notice.

Business name: Ian Chiropractic
SSM registration number: JM0938703-X
Professional Membership: Association of Chiropractic, Malaysia (ACM)
Clinic location: Cheras, Kuala Lumpur
Email: ianchiro.frontdesk@gmail.com
Phone / WhatsApp: +60 10-279 3422

Related legal pages

This Privacy Policy should be read together with our Health Information Disclaimer, especially where website content, WhatsApp messages, health information, and emergency-related boundaries are involved.

It should also be read together with our Terms & Conditions, which explain website use, appointment arrangements, service boundaries, fees, and clinic communication terms.

Notice and choice

This Privacy Policy is intended to inform you how your personal data may be collected, used, stored, disclosed, and protected before you submit your personal data to us or use our services.

You may choose not to provide certain personal data. However, if the requested information is needed for appointment arrangements, clinic records, assessment, care, safety, billing, or legal purposes, we may not be able to respond properly, arrange an appointment, provide care, or continue certain services.

For official information about personal data protection notices in Malaysia, you may refer to the Department of Personal Data Protection Malaysia.

Personal data we may collect

We may collect personal data that you voluntarily provide to us when you contact the clinic, book an appointment, complete a form, attend a consultation, communicate with us, or use our website.

This may include your name, phone number, email address, age or date of birth, gender, occupation, address or general location, appointment details, enquiry details, communication history, and any information you choose to provide about your symptoms or reason for contacting us.

We may also collect clinic-related information such as consultation notes, consent forms, treatment records, appointment history, payment records, invoices, receipts, referral details, and records of advice or care provided during your visit.

Sensitive personal data and health information

Because Ian The Chiro provides health-related care, some information you provide may be sensitive personal data or health-related information.

This may include information about your symptoms, pain patterns, medical history, previous injuries, medications, surgeries, scan reports, x-rays, MRI findings, ultrasound reports, diagnoses, pregnancy status where relevant, lifestyle factors, training history, and other information related to your health or care.

We only collect health-related information when it is relevant to your enquiry, appointment, consultation, assessment, treatment suitability, clinic records, safety, or continuity of care.

Where required, we may ask for your consent to collect, use, or process health-related or sensitive personal data for appointment, assessment, care, safety, record-keeping, and other clinic-related purposes.

How we collect personal data

We may collect personal data directly from you when you contact us through WhatsApp, email, phone, website forms, social media, booking links, clinic forms, consent forms, or in-person conversations at the clinic.

We may also collect information when you use our website, such as device information, browser type, IP address, pages visited, approximate location, referral source, and website usage data through cookies, analytics tools, or similar technologies.

In some cases, we may receive information from a parent, guardian, caregiver, spouse, family member, referral source, another healthcare provider, or third-party platform, where relevant and appropriate.

Why we collect and use personal data

We collect and use personal data for clinic-related, administrative, communication, safety, legal, and service improvement purposes.

This may include responding to enquiries, arranging appointments, confirming bookings, managing schedules, creating clinic records, assessing treatment suitability, providing care, issuing invoices or receipts, following up where appropriate, handling feedback, and maintaining proper business records.

We may also use personal data to improve our website, understand how visitors use our pages, maintain website security, review service quality, manage clinic operations, and comply with applicable legal, regulatory, accounting, or professional obligations.

Appointment, consultation, and clinic records

When you book or attend an appointment, we may collect and store information needed for appointment management, clinical assessment, care planning, treatment records, communication, billing, and continuity of care.

This may include information recorded in clinic management systems, appointment scheduling tools, consent forms, consultation notes, treatment notes, intake forms, payment records, and related clinic documentation.

Clinic records are used to support safe and appropriate care, track what was discussed or provided, and maintain a proper record of your visits.

WhatsApp, email, phone, and online communication

When you contact us through WhatsApp, email, phone, website forms, or social media, we may collect and store the information you provide, including your contact details, messages, images, videos, documents, screenshots, scan reports, appointment requests, and enquiry history.

These communication channels are mainly used for general enquiries, appointment arrangements, reminders, clarification, follow-up, and administrative communication.

Please avoid sending unnecessary sensitive information through online channels unless it is relevant to your enquiry or appointment. Online communication may involve third-party platforms that operate under their own privacy policies and security practices.

Booking systems and third-party service providers

We may use third-party service providers to help manage appointments, clinic records, website hosting, email, WhatsApp communication, analytics, payment records, forms, backups, security, or other business operations.

These providers may process personal data on our behalf where necessary for clinic operations, appointment management, website functionality, communication, record-keeping, or legal compliance.

Examples may include clinic management systems such as Cliniko, website hosting providers, email providers, analytics tools, WhatsApp or Meta-related services, payment processors, accounting support, IT support, and other operational service providers.

Who we may disclose personal data to

We do not sell your personal data.

We may disclose personal data where necessary to clinic staff, administrative support, service providers, IT providers, website providers, clinic management platforms, payment or accounting providers, professional advisers, legal advisers, insurers, regulators, authorities, or other parties where required by law or reasonably necessary for clinic operations.

Where relevant and appropriate, we may also share information with another healthcare provider, hospital, specialist, imaging centre, or referral provider if it is needed for your care, referral, safety, or continuity of care.

Disclosure during medical or safety concerns

If there is a serious medical, safety, legal, or emergency concern, we may use or disclose relevant personal data where necessary to protect your health, safety, or the safety of others, or to comply with legal obligations.

This may include situations involving urgent medical symptoms, suspected serious risk, legal requests, regulatory requirements, or circumstances where disclosure is reasonably necessary and permitted by law.

Cookies, analytics, and website tracking

Our website may use cookies, analytics tools, pixels, tags, or similar technologies to understand website traffic, visitor behaviour, page performance, marketing performance, security, and user experience.

This may include information such as pages visited, time spent on the website, browser type, device type, approximate location, IP address, referral source, and interactions with website buttons or links.

You may adjust your browser settings to block or delete cookies, but some parts of the website may not work as intended if cookies are disabled.

Minors and personal data

If the person seeking care is under 18 years old, personal data may need to be provided by a parent or legal guardian, and parental or guardian involvement may be required before consultation or care is provided.

Parents or guardians are responsible for providing accurate information and ensuring that any personal data submitted on behalf of a minor is provided appropriately.

If you are under 18, please involve a parent or guardian before submitting health-related personal data or booking an appointment.

Storage and protection of personal data

We take reasonable steps to protect personal data from unauthorised access, misuse, loss, disclosure, alteration, or destruction.

These steps may include limiting access to clinic records, using password-protected systems, using reputable service providers, maintaining administrative controls, and keeping records only where reasonably necessary for clinic, legal, accounting, or operational purposes.

However, no website, online platform, email, WhatsApp message, cloud system, or digital storage method can be guaranteed to be completely secure. You acknowledge that online transmission of personal data carries some level of risk.

Data breaches and security incidents

If we become aware of a data breach or security incident involving personal data, we will take reasonable steps to assess, contain, investigate, and respond to the incident.

Where required by applicable law or regulatory guidance, we may notify the relevant authorities and affected individuals.

Retention of personal data

We keep personal data only for as long as necessary for the purposes stated in this Privacy Policy, including clinic care, record-keeping, legal compliance, accounting, tax, insurance, dispute handling, service improvement, and business operations.

Health and clinic records may be kept for a longer period where required or appropriate for continuity of care, legal obligations, professional obligations, insurance, or dispute-related reasons.

Your rights to access and correct personal data

You may request access to your personal data or ask us to correct personal data that is inaccurate, incomplete, misleading, or outdated, subject to applicable laws and reasonable verification.

We may need to verify your identity before processing any request to access, correct, update, or discuss personal data.

Some requests may be refused or limited where permitted by law, including where the request is unreasonable, affects another person’s privacy, conflicts with legal obligations, or relates to information that cannot be disclosed.

Withdrawing consent or limiting use

You may contact us if you wish to withdraw consent, limit certain uses of your personal data, stop non-essential marketing communication, or update your communication preferences.

Please note that withdrawing consent or limiting the use of certain information may affect our ability to respond to enquiries, manage appointments, provide care, maintain records, or comply with legal and administrative obligations.