Klinik Pergigian Ark is a dental clinic at Lot B7-1, 1st Floor, Grand Plaza Putatan, Lorong Grand Plaza Putatan, 88200 Putatan, Sabah. In this policy, “we”, “us” and “the clinic” mean Klinik Pergigian Ark.
We process personal data in accordance with the Personal Data Protection Act 2010 (Act 709) and applicable amendments, regulations, standards and guidance issued under it, including the Personal Data Protection (Amendment) Act 2024.
What we collect
We only collect personal data that we reasonably need for the purposes described in this policy.
From anyone who contacts us
If you contact us by phone, WhatsApp, email, social media or through our website, we may collect:
- Your name and contact details
- Information you choose to provide about your dental concerns, symptoms or questions
- Details of your enquiry and our communications with you
Please avoid sending sensitive medical information through an unsecured channel unless it is necessary for your enquiry.
From patients
When you become a patient, we may collect:
- Contact details
- Identification details where required
- Date of birth and other information needed to identify you correctly
- Emergency contact details
- Medical and dental history
- Information about medications, allergies and relevant health conditions
- Clinical notes and examination findings
- X-rays, scans and clinical photographs
- Treatment plans, treatment records and consent records
- Appointment and attendance history
- Payment and transaction records
- Information needed for insurance, referral or other healthcare-related purposes where applicable
Where you provide us with information about another person, such as an emergency contact, please ensure that you are authorised to provide that information where appropriate.
From this website
Our website may automatically receive standard technical information from your browser or hosting infrastructure, such as:
- IP address
- Browser and device information
- Date and time of access
- Pages requested
- Basic server and security logs
We use Google Analytics to understand how the website is used. See Website analytics below for what that involves. We do not use advertising cookies and we do not run behavioural advertising on this website. There is no user account or member login on the website.
Health information
Information about your physical or mental health is sensitive personal data under the PDPA.
Dental and medical information is necessary for us to assess your condition, provide safe and appropriate treatment, maintain your clinical records and manage your care.
We will obtain consent where the law requires it and will otherwise process information in accordance with the applicable provisions of the PDPA, including provisions relating to medical purposes.
You may withdraw consent where consent is the basis for particular processing. Withdrawal of consent does not affect processing that took place before the withdrawal, and it may mean that we are unable to provide certain services or continue treatment where the information is necessary for your care or where another lawful basis for processing is not available.
Why we collect and use your information
We may use your personal data to:
- Assess your dental health and needs
- Diagnose, plan and provide dental treatment
- Maintain accurate clinical and treatment records
- Contact you about appointments, treatment and follow-up care
- Respond to your questions, enquiries and requests
- Process payments and issue receipts
- Manage referrals to other healthcare professionals or facilities
- Provide information to dental laboratories where required for your treatment
- Meet legal, regulatory, professional and record-keeping obligations
- Protect the safety, security and rights of our patients, staff and the clinic
- Handle complaints, disputes, insurance matters or legal proceedings where necessary
- Maintain and improve our services and systems
- Comply with lawful requests from regulators, courts, law-enforcement agencies or other authorities
We do not sell your personal data.
We do not use your personal data for direct marketing unless we have a lawful basis to do so and, where required, your consent.
Which information do you need to provide?
Some information is necessary for us to provide dental care safely and to meet our legal or professional obligations.
If you do not provide information that is necessary for these purposes, we may not be able to:
- Register you as a patient
- Properly assess or treat you
- Contact you about your appointments or treatment
- Provide particular treatments or services
- Meet applicable legal or regulatory requirements
Other information may be voluntary. Where this is the case, we will indicate this when collecting it.
Who may receive your personal data?
We limit access to personal data to people and organisations that reasonably need it for the purposes described in this policy. This may include:
Dental laboratories
Where your treatment involves a crown, bridge, denture, retainer, appliance or other custom-made item, we may provide the dental laboratory with the information necessary to manufacture it.
Healthcare professionals and facilities
Where clinically appropriate, we may share relevant information with dentists, doctors, specialists, hospitals or other healthcare professionals involved in your care, including when we make a referral.
Payment providers
When you pay by card, e-wallet or another electronic payment method, relevant transaction information may be processed by the payment service provider.
Service providers
We may use third-party providers for services such as IT, software, hosting, communications, data storage, cybersecurity, website operation, website analytics, accounting or other administrative functions.
These providers may process personal data on our behalf and are expected to protect it appropriately and use it only for authorised purposes.
Regulators and authorities
We may disclose personal data where required or permitted by law, including to the Ministry of Health, Malaysian Dental Council, Personal Data Protection Commissioner, courts, law-enforcement agencies, insurers or other competent authorities.
Overseas processing
Some service providers we use may store or process information outside Malaysia.
Where personal data is transferred outside Malaysia, we will take the steps required by applicable Malaysian data protection law to ensure that the transfer is subject to appropriate safeguards.
For example, third-party services embedded in our website may process technical information such as your IP address when you access those services.
This website
Our website uses cookies for analytics, described under Website analytics below. It does not use advertising cookies, and we do not run behavioural advertising.
However, some pages may include content or services provided by other companies. When that content loads, the relevant provider may receive technical information such as your IP address. For example:
- Google Maps may be embedded on our Contact page to show our location.
- Instagram, operated by Meta, may be embedded on our website to display social-media content.
- Google Fonts is used to load the typefaces the site is displayed in.
- Google Analytics is used to measure how the site is used.
If you do not want third-party content to load automatically, you may be able to block third-party content or cookies through your browser settings. This may affect how some website features work.
Each of those companies handles the information it receives under its own privacy policy: Google for Maps, Fonts and Analytics, and Instagram and Meta for the photo feed.
Website analytics
We use Google Analytics 4, provided by Google, to understand how people find and use the website: which pages are visited, how long people stay, roughly which region they are in, and what device and browser they use. We use this to improve the site. We do not use it to identify individuals, and we do not use Google Analytics data for advertising.
Google Analytics sets two cookies in your browser, _ga and _ga_CEH5DR03F6, which last up to thirteen months. They hold a randomly generated identifier so that repeat visits can be counted as the same browser rather than as new people each time.
We also record when someone taps our phone number or our WhatsApp button, so that we know how people prefer to contact us. This records that a tap happened, not who made it.
Google processes this information on our behalf, on its own servers, which are outside Malaysia. How Google handles it is set out in the Google Privacy Policy, and more specifically in how Google uses information from sites that use its services.
If you would rather not be counted, you can block cookies in your browser settings, or install the Google Analytics opt-out browser add-on.
Our website is hosted by Hostinger. Our hosting infrastructure may retain standard technical and security logs as part of operating and protecting the website.
How we protect your information
We take reasonable steps to protect personal data against loss, misuse, unauthorised access, modification, disclosure or destruction. Depending on the nature of the information, safeguards may include:
- Limiting access to authorised personnel
- Secure storage of physical and electronic records
- Password and access controls
- Appropriate technical and organisational security measures
- Secure handling of clinical records and diagnostic images
- Secure disposal or deletion when information is no longer required
No method of storing or transmitting information can be guaranteed to be completely secure.
How long we keep your information
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing ongoing care, maintaining appropriate clinical records, complying with legal and professional obligations, resolving disputes and protecting our legal rights.
Clinical records are retained in accordance with applicable Malaysian laws, professional requirements and limitation periods.
When personal data is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it.
Enquiries that do not become appointments are generally retained only for as long as reasonably necessary to respond to the enquiry, maintain appropriate records and deal with any follow-up or dispute.
Your rights
Subject to the conditions and limitations under the PDPA and other applicable laws, you may ask us to:
- Confirm whether we process your personal data
- Provide access to personal data that we hold about you
- Correct personal data that is inaccurate, incomplete or out of date
- Withdraw consent where consent is the basis for processing
- Request that we stop or limit certain processing in circumstances provided for by law
- Request the transfer of your personal data to another data controller where the applicable legal requirements and technical conditions for data portability are met
- Ask questions about how we collect, use and disclose your personal data
Some requests may be subject to legal restrictions. For example, we may need to retain certain clinical records even if you ask us to delete them.
We may ask you to provide reasonable information to verify your identity before processing a request.
Where permitted by law, a fee may apply to certain access requests. We will tell you about any applicable fee before processing the request.
To make a request, email arkdentalputatan@gmail.com or speak to us at the clinic.
If something goes wrong
We take data security seriously.
If we become aware of a personal data breach, we will assess the incident and take appropriate steps to contain, investigate and remedy it.
Where notification is required under the PDPA or applicable data-breach requirements, we will notify the Personal Data Protection Commissioner and affected individuals within the required timeframe.
We will provide affected individuals with appropriate information where the breach causes or is likely to cause significant harm, as required by law.
Complaints
If you are concerned about how we have handled your personal data, please contact us first at arkdentalputatan@gmail.com. We will review your concern and try to resolve it.
You may also contact the Personal Data Protection Commissioner / Jabatan Perlindungan Data Peribadi (JPDP) if you believe your personal data has been handled in breach of applicable data-protection requirements.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or data-processing practices.
When we make changes, we will update this page and the Last updated date below.
We encourage you to check this page periodically for the latest version.