Introduction

Our policies contain essential information about how Alba Dental manages your personal data and delivers our services If you need more details, please call us or book a consultation and our team will be happy to assist.

This Privacy Statement and Personal Data Protection Policy (“Privacy Policy”) explains how Alba Dental collects, uses, discloses, stores and protects your personal data when you visit our clinic, contact us, or use our services.

We Respect Your Privacy

1.1 At Alba Dental (“we”, “us”, “our”), we take your privacy seriously.

1.2 We are committed to complying with the Personal Data Protection Act 2010 of Malaysia (“PDPA”), including the seven data protection principles (General, Notice & Choice, Disclosure, Security, Retention, Data Integrity and Access), and any relevant regulations, standards and guidelines.

1.3 By visiting our clinic, using our website or social media, or otherwise providing your personal data to us, you are deemed to have read and understood this Privacy Policy.

1.4 We may update this Privacy Policy from time to time to reflect changes in law, technology or our practices. Updates will be published on our website and are effective from the date of posting.

Definitions

2.1 “Alba Dental”, “we”, “us”, “our”
Means [Alba Dental legal entity name, e.g. Alba Dental Sdn. Bhd.], its branches, associated clinics, dentists and authorised staff.

2.2 “you”, “your”
Means any individual who is our patient, potential patient, website visitor, social media follower, guardian, next-of-kin, supplier, job applicant or any person whose personal data is processed by us.

2.3 “personal data”
Means any information about you which you can be identified from, whether directly or indirectly, as defined under the PDPA.
This may include, for example, your name, NRIC or passport number, contact details, health and dental records.

2.4 “sensitive personal data”
Includes information relating to your physical or mental health or condition, religious beliefs or any alleged or actual commission of an offence, as defined in the PDPA. Your dental and medical information is generally treated as sensitive personal data.

2.5 “processing”
Means any operation performed on personal data, including collecting, recording, holding, storing, using, disclosing and any other such operation, whether by automated or manual means.

3. Collection of Information

3.1 Information We Collect

We will only collect personal data that is necessary and reasonable for us to provide you with appropriate dental or related services and to operate our clinic safely and efficiently.

The personal data we collect may include (but is not limited to):

• name, address, telephone and email contact details;
• personal details such as age and gender;
• details of previous dentists you have been a patient of;
• your Medicare number;
• financial information (for example, credit card numbers to assist in the administration of payments for dental services);
• sensitive information including:
  • medical history;
  • family medical history; and
  • current health and dental assessment.

3.2 How We Collect Your Information

We may collect personal and/or health information directly from you or from your authorised representatives in various ways, including when you or they:

• complete booking, registration, medical history or consent forms at our clinic (paper or digital);
• complete online booking or contact forms on our website or social media;
• communicate with us in person, or via phone, WhatsApp, SMS, email or social media;
• subscribe to our newsletters, educational updates or marketing materials;
• participate in our campaigns, events, surveys or promotions;
• use our services or purchase products from us.

We may also collect health information from third parties, such as:

• referring dentists or other healthcare professionals;
• insurance companies, panel clinics or corporate clients;
• laboratories, imaging centres or other service providers;

but only if:

• you have given consent; or
• you would reasonably expect us to obtain the information for purposes related to your care; or
• it is necessary to provide you with appropriate dental or health care; or
• we are otherwise permitted or required by law to do so.

4. Use and Disclosure of Your Personal Data

The primary purpose of collecting and processing your personal data is to deliver, manage and administer dental and related
services to you, while ensuring safe and efficient operation of our clinic in compliance with the PDPA.

4.1 How We Use Your Personal Data

Your personal data may be used for purposes including (but not limited to):

A. Clinical and care purposes

• To provide dental consultations, diagnosis, treatment and follow-up care;
• To assess suitability and risks of proposed treatment;
• To maintain complete and accurate clinical records.

B. Administration and billing

• To register you as a patient and manage appointments;
• To prepare quotes, invoices, receipts and process payments;
• To process insurance or panel claims (where applicable);
• To chase and collect unpaid invoices, which may involve external collection agencies.

C. Communication and customer service

• To contact you about appointments, treatment plans, results and follow-up;
• To respond to your enquiries, feedback and complaints;
• To send service-related notices and important updates.

D. Legal, regulatory and risk management

• To comply with applicable laws, regulations, guidelines and professional requirements;
• To respond to requests from authorities or regulators;
• To manage incidents, complaints, audits and disputes;
• To protect our legal rights, including intellectual property and contractual rights.

E. Improvement and general business purposes

• To carry out internal reporting, quality assurance and staff training;
• To use de-identified data to create statistics, evaluate services, identify trends and improve our website and services.

4.2 Use of Your Health Information

Your health and dental records are sensitive personal data. We will only use your health information for:

• providing you with dental or health care services; or
• purposes directly related to providing you with such care (for example, consultation with another dental specialist for a second opinion); or
• purposes required or authorised by law (for example, responding to public health requirements, court orders or regulatory investigations).

We will not use your health information for other purposes unless you have given clear consent or we are otherwise legally permitted to do so.

4.3 Disclosure to Third Parties

To deliver our services, ensure efficient business operations and comply with applicable laws and regulations, we may need to
share your information with third parties, including in the following circumstances:

• to government and regulatory bodies;
• to your emergency contact in an emergency;
• to any person or entity acting on our behalf;
• to our professional advisors;
• to dentists, dental specialists and other healthcare professionals, for the purpose of seeking a second opinion or a referral, where you have consented to obtaining the second opinion or the referral;
• to third party health benefit providers and insurance companies to help process claims for reimbursement or payment of all or part of your dental treatment costs;
• to review the services for the purpose of quality of our services;
• to protect our copyright, trade marks and other legal rights;
• to a purchaser or potential purchaser under an agreement to maintain confidentiality, where there is a change of control in one of our businesses (whether by merger, sale, or otherwise), or a sale or transfer of its assets; and/or
• where disclosure is required by law.

We will only disclose your personal data to third parties on a need-to-know basis, and where those parties are subject to confidentiality obligations and are required to handle the data in a manner consistent with this Privacy Policy and the PDPA.

4.4 Direct Marketing

Our marketing functions support our growth and development and provide you with information about services offered by us. Our practice may use your personal information for the purpose of direct marketing, such as sending newsletters. However, we will not on-sell your personal information.

We understand that you may not wish to receive marketing materials. If you would prefer not to receive such information, a request can easily be made to the Privacy Officer or another staff member of ours.

5. Data Quality

We take reasonable steps to ensure that the personal data we collect and hold is accurate, complete and up to date.

These steps may include:

• checking your details at registration and during subsequent visits;
• updating our records when you tell us of any changes;
• reviewing and correcting information where necessary.

Please inform us promptly if there are any changes to your personal or medical details.

6. Data Security

We have implemented practical steps and security measures to protect your personal data from loss, misuse, unauthorised access, modification or disclosure and other risks.

These measures may include:

• physical security (restricted areas, locked cabinets, CCTV where appropriate);
• administrative controls (role-based access, staff training and confidentiality obligations);
• technical measures (password protection, firewalls, antivirus, encryption where appropriate);
• secure disposal or anonymisation of data once it is no longer needed.

However, no method of transmission or storage is completely secure. Information transmitted over the internet, email, messaging apps or other networks is done at your own risk.

7. Employer / Employee Responsibilities

In our role as an employer, we also collect and process personal data of employees and job applicants for human resource
and employment-related purposes, such as recruitment, payroll, performance management, training, benefits administration
and compliance with employment laws.

All staff at Alba Dental are:

• briefed on their responsibilities in maintaining patient and employee confidentiality;
• required to comply with the PDPA, internal policies and contractual obligations;
• granted access to personal data only on a “need-to-know” basis.

8. Access and Correction

8.1 Your Right to Access

Subject to the PDPA and any applicable exemptions, you have the right to request access to personal data that we hold about you.

To make an access request, please contact us in writing (see Section 15). We may:

• ask you to provide sufficient information to confirm your identity;
• charge a reasonable administrative fee as allowed under the PDPA;
• refuse access in limited circumstances (for example, where required by law, where it would unreasonably affect another person’s privacy, or where the request is frivolous or vexatious).

If we refuse access, we will explain why, as far as we are reasonably able to.

8.2 Your Right to Correction

If you believe that any personal data we hold about you is inaccurate, incomplete, misleading or out of date, you may request
that it be corrected or updated.

We will:

• correct the data where appropriate and practicable; or
• if we do not agree that the data is incorrect, we will record your request and our reason.

9. Cookies and Analytics

Our website may use cookies, pixels and similar technologies to improve its functionality and your browsing experience.
These technologies may:

• remember your settings and preferences;
• help us understand how visitors use our website;
• allow us to improve content, layout and performance.

You can choose if and how cookies are accepted by adjusting the settings in your browser. If you disable certain cookies,
some features of the website may not work properly.

We may also use third-party tools (e.g. analytics or advertising platforms) that collect de-identified or aggregated
information about website usage to help us:

• measure and analyse traffic and usage patterns;
• develop statistics and improve our services;
• show you more relevant advertisements on our own or third-party websites.

These tools do not collect information that directly identifies you, such as your name or NRIC, unless you have provided
such information through other means.

10. Our Website and Third-Party Links

Our website may contain links to other websites or resources operated by third parties.

These links are provided for your convenience only. The presence of a link does not mean that we endorse or approve the
other site, its content, or its privacy practices.

We are not responsible for the privacy policies or practices of any third-party websites. We encourage you to read the
privacy statements of any website that collects personal data about you.

11. Non-Personal Information

Any non-personal information, communications or material you send to us (for example, general feedback that cannot identify
you) may be kept, used and disclosed by us on a non-confidential basis.

We may use such information freely, including for service improvement, marketing statistics, research or product
development, provided it does not identify you personally.

12. Sending Information Overseas

In the course of providing our services and maintaining records, we may disclose or store personal data in systems or with
service providers located outside Malaysia (for example, cloud storage, appointment or communication platforms hosted on
overseas servers).

Where cross-border transfers occur, we will take reasonable steps to ensure that:

• the transfer is made in compliance with the PDPA and relevant guidelines;
• the overseas recipient is subject to conditions of use and security obligations that are at least comparable to those under the PDPA; and
• your personal data is not processed in a manner inconsistent with this Privacy Policy.

By using our services or sharing your personal data with us, you acknowledge and consent to such cross-border transfers
where necessary and lawful.

13. Non-Disclosure of Information and Consequences of Not Providing Data

You are not obliged to provide all the personal data we request. However, if you choose not to provide certain information,
or you later withdraw consent (where consent is required), we may not be able to:

• properly assess your dental and general health conditions;
• safely recommend or deliver certain treatments;
• process payments, claims or appointment bookings; or
• fulfil legal, regulatory or contractual obligations.

In some cases, this may result in delayed, limited or discontinued services, and could potentially affect your treatment outcomes.

14. Complaints

We take your privacy seriously. If you suspect there has been, or may have been, a breach of your privacy or this Privacy
Policy, you may lodge a complaint with us.

Please contact:

Alba Dental
3A-01 Corporate Tower 9, Pavilion Damansara Height,
3, Jalan Damanlela, Pusat Bandar Damansara,
50490 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur
Tel: 03-6211 8855
WhatsApp: +603-6211 8855

Please include:

• your name and contact details;
• a brief description of your concern or complaint;
• relevant dates and any supporting documents (if available).

We will acknowledge your complaint and seek to resolve it within a reasonable timeframe.

If you are not satisfied with our response, you may contact the relevant authority (e.g. Jabatan Perlindungan Data Peribadi – JPDP)
according to the current contact details published by the Malaysian Government.

15. Enquiries

We review and update this Privacy Policy from time to time. For further information about how Alba Dental manages personal
data, or if you have any questions about this Policy, please contact us:

Alba Dental – Privacy Enquiries
Email: alba@albadental.com.my
WhatsApp: +603-6211 8855