At Emax Clinic Sdn Bhd [Company No.: 202101045107(1445407-V)], and its related companies, including but not limited to “B+” (collectively, “we”, “us” or “our”), we are committed to protecting your privacy in accordance with the Personal Data Protection Act 2010 of Malaysia ("PDPA").

By communicating with us, using our services, purchasing products or services from us, submitting your personal data to us, or otherwise engaging with us, you acknowledge that you have read and understood this Notice and agree and consent to the collection, use, disclosure, processing and transfer of your Personal Data by us in accordance with this Notice and the Personal Data Protection Act 2010.

We reserve the right to modify, update or amend the terms of this Notice from time to time by publishing the revised Notice on B+ Clinic’s websites (“Websites”). Your continued communication with us, use of our services, purchase of our products or services, or continued engagement with us after the effective date of the revised Notice shall constitute your acknowledgement and acceptance of such modifications, updates or amendments.

In the event of any inconsistency between the English version and any translated versions of this Notice and/or the revised Notice, the English version shall prevail.

"Personal Data" refers to any information in respect of commercial transaction that relates directly or indirectly to you, who is identified from the information or from that and other information in our possession, and includes any sensitive personal data and expression of opinion about you, where applicable.

The Personal Data that we may collect about you will vary depending on how you interact and engage with us. For example, it may include:

Personal Data

• your name, address, telephone number, mobile phone number, social media account and email address;
• your interests and preferences in relation to our products and/or services and those of our business partners;
• device data and log data when you access any of B+ Clinic’s applications or Websites, including but not limited to your username, operating system version, device type, device identifiers (IDs) such as IMEI, UUID and MAC address, system and performance information, browser type, network information and IP address;
• your communications with us such as email, telephone recordings, registration forms;

Sensitive Personal Data

• your biometric data, including but not limited to facial images, body images, fingerprints or other biometric identifiers used for identification or authentication purposes;
• your health-related information, including but not limited to your medical history, allergies, medication, health conditions, treatment history and other information relevant to the provision of our products and/or services;
• information relating to your religion or religious beliefs; and
• such information is reasonably necessary for the purposes set out in this Notice or otherwise required or permitted under applicable written law.

Certain Personal Data requested by us is mandatory in order for us to provide our products or services, process your requests, perform our contractual obligations or comply with applicable legal and regulatory requirements. Where the provision of such Personal Data is mandatory, failure to provide the requested Personal Data may result in our inability to provide the requested products or services, process your requests or otherwise fulfil the purposes described in this Notice.

We may collect, use, disclose, and process your Personal Data for the Purposes and Marketing Purpose outlined below.

a. We may obtain Personal Data from you directly when you:

• communicate with us, including when you contact us regarding any inquiries;
• enter into any commercial transactions or contractual relationship with us;
• directly from you when you register for, purchase, enquire about or receive any of our products, services, treatments, packages or memberships;
• from forms, documents or information provided by you, including registration forms, consultation forms, consent forms, health declaration forms, treatment records, survey forms, feedback forms and complaint forms;
• when you communicate or interact with us, whether in person, by telephone, email, WhatsApp, social media, online chat or through any other communication channel;
• when you visit any of our outlets, branches, premises, websites, mobile applications, online platforms or social media pages;
• when you make an appointment, participate in a consultation, undergo a treatment or service, make a payment or otherwise enter into a transaction with us;
• from photographs, videos, CCTV recordings, call recordings or other audio-visual materials collected during your visit to, or interaction with, us, where applicable;
• from surveys, questionnaires, promotions, campaigns, contests, events or other activities organised by us or on our behalf;
• from your authorised representatives, family members, parents, guardians or other persons acting on your behalf, where applicable;
• from our related companies, business partners, service providers, payment service providers, healthcare professionals or other third parties with whom we deal, where permitted by law;
• from publicly available sources, including public websites, social media platforms and other publicly accessible records, where applicable;
• automatically through our websites, applications or digital platforms, including through cookies, device information, log data and similar technologies; and
• from such other sources where you have consented to the disclosure of your Personal Data to us, or where the collection of such Personal Data is otherwise permitted or required under applicable written law.
• use any B+ products and/or services;
• request any information or register any interest in any of our or our partners’ products and services;
• respond to any marketing or promotional materials circulated by B+;
• enter or participate in any campaign organized by or on behalf of B+;
• visit any B+ or our partners’ offices or premises;
• visit, browse, post on or otherwise submit any information through B+ applications, social media platforms and/or Websites; and
• provide any feedback to B+.

b. Other than Personal Data obtained from you, we may also obtain your Personal Data from third parties, including our business partners, publicly available sources, social media platforms linked by you (such as your Facebook or YouTube account), or other person authorized by you to disclose your Personal Data to us, and/or where otherwise permitted under applicable written law.

c. We collect information about your use of our Websites from cookies. Cookies are packets of information stored in your computer or device which assist your website navigation by customizing site information tailored to your needs. Cookies in themselves do not identify the individual user, just the computer or device used. You are not obliged to accept cookies and may disable it through your browser settings. If you are concerned, you can set your computer or device either to accept all cookies, to notify you when a cookie is issued, or not to receive cookies at any time. However, rejection of cookies may affect your use of our Websites as we will be unable to personalize aspects of your use of the website.

d. Please be informed that this Privacy Notice applies solely to B+’s applications, social media platforms, Websites and B+’s products and/or services and does not apply to any third party websites you may access from our applications or Websites. We are not responsible for the privacy practices of such third-party websites. You are encouraged to review their respective privacy notices before providing any Personal Data. If you use or subscribe to any product and/or service from any third party and you subsequently provide your Personal Data directly to that third party, your Personal Data will be subject to that third party’s privacy notice.

We may collect, use, disclose and otherwise process your Personal Data for the purposes set out below.

A. Purposes Necessary for the Provision of Our Services

The provision and processing of certain Personal Data may be necessary for us to provide our products, services and treatments to you, to manage our relationship with you, and to comply with applicable legal and regulatory requirements. Such purposes may include:

• to verify your identity and maintain accurate customer records;
• to register and manage your customer account, membership, treatment package, appointment and other transactions with us;
• to provide, administer and manage our products, services and treatments, including consultations, treatment planning, treatment records, follow-up care and after-treatment support;
• to assess your suitability for any treatment or service, including reviewing your health information, medical history, allergies, medication, treatment contraindications and other relevant health-related information;
• to monitor and document your treatment progress, including through treatment records, before-and-after photographs and other relevant records, where such records are reasonably necessary for treatment, consultation or follow-up purposes;
• to schedule, confirm, reschedule and manage your appointments and to communicate with you in relation to your treatments, services, packages or membership;
• to process payments, refunds, billing and other financial transactions relating to the products, services or treatments provided to you;
• to respond to and manage your enquiries, requests, feedback, complaints, disputes and customer service matters;
• to provide post-treatment support and to manage any adverse reaction, treatment-related concern or incident;
• to maintain records for operational, accounting, audit, insurance, legal, regulatory, claims management and dispute resolution purposes;
• to protect and enforce our legal rights, recover any sums owing to us, and establish, exercise or defend any legal claims;
• to maintain the safety and security of our outlets, premises, customers, employees and property, including through CCTV and other security measures;
• to prevent, detect and investigate fraud, misuse, security incidents or other unlawful activities;
• to comply with any applicable laws, regulations, guidelines, court orders, regulatory requirements or requests from competent authorities;
• to engage our related companies, professional advisers, service providers and other third parties to provide services to us or on our behalf for the purposes stated above; and
• for such other purposes which are reasonably necessary or directly related to the provision and administration of our products, services and treatments, or as otherwise permitted or required under applicable written law.

Where the relevant Personal Data is identified as mandatory, failure to provide such Personal Data may result in us being unable to provide or continue to provide the relevant products, services or treatments to you.

B. Optional Marketing and Promotional Purposes

Subject to your consent, we may also process your Personal Data for optional marketing and promotional purposes, including:

• to send you information regarding our products, services, treatments, promotions, packages, membership benefits, events and offers;
• to contact you for marketing and promotional purposes via telephone, SMS, WhatsApp, email, social media or other communication channels;
• to conduct marketing-related surveys, campaigns, promotions, contests, events and customer engagement activities;
• to personalise or tailor marketing communications, promotions and offers based on your interests, preferences or previous interactions with us; and
• to use your photographs, videos, testimonials, reviews or other materials for advertising, publicity, promotional or marketing purposes, where your separate consent has been obtained.

Providing Personal Data for the above marketing and promotional purposes is optional. You may choose not to provide your consent, or may withdraw your marketing consent at any time, without affecting your eligibility to receive our products, services or treatments.

Your Personal Data may be transferred to, stored, used and processed in a jurisdiction outside Malaysia, including by B+’s related corporation, affiliates, service providers and/or where B+’s servers are located outside Malaysia, such as Singapore.

Any such transfer of your Personal Data shall be carried out in accordance with the Personal Data Protection Act 2010 and any other applicable laws. Where your consent is required under applicable law, such transfer shall be made with your consent. Where appropriate, B+ will take reasonable steps to ensure that your Personal Data transferred outside Malaysia continues to be afforded a level of protection comparable to that provided under the Personal Data Protection Act 2010.

You understand and consent to the transfer of your Personal Data outside Malaysia as described herein.

Your personal data may be transferred, disclosed or made accessible to third parties for the Purposes and the Marketing Purpose set out in this Notice. Further, we may engage other companies, service providers or individuals to perform functions on its behalf, and consequently may provide access to or disclose your Personal Data to such service providers or third parties. The third parties referred to in this section include (without limitation):

• Our partners and advertisers, which include parties with whom we collaborate with for certain events, campaigns and activities;
• Event management companies and event sponsors;
• Marketing research companies;
• healthcare professionals, medical practitioners, clinics, laboratories or other healthcare service providers, where such disclosure is necessary in connection with your consultation, treatment, follow-up care or health and safety;
• payment gateways, payment processors, banks, financial institutions and other service providers involved in processing payments, refunds or other financial transactions;
• Service providers, including but not limited to, information technology (IT) service providers for infrastructure, software and development work, cloud hosting providers, payment processors and financial institutions, courier and logistics providers and/or customer support providers;
• Professional advisors and external auditors, including legal advisors, financial advisors and consultants;
• Other entities within B+; and
• Governmental authorities to comply with statutory, regulatory and governmental requirements.

Your Personal Data may also be disclosed in connection with a corporate transaction, including but not limited to any merger, acquisition, restructuring, disposal of assets, sale of shares, consolidation, business transfer or winding-up.

We are committed to take reasonable practical measures to safeguard your Personal Data from any loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction, by ensuring that:

• your Personal Data is kept as required by the Personal Data Protection Act 2010;
• requiring our employees who have access to your Personal Data to comply with appropriate confidentiality obligations;
• any appointed suppliers and service providers who process any of your Personal Data on B+’s behalf to comply with appropriate confidentiality, security and data protection obligations, in accordance with the terms of their contractual arrangement with B+.
• Nevertheless, you are responsible for maintaining the confidentiality of your account credentials, including your username and password, and should not disclose them to any third party. B+ shall not be responsible for any unauthorized access arising from your failure to safeguard such credentials.

We will maintain your Personal Data in our business records while you remain a subscriber, customer or user of any of our products and/or services or a user of the B+ applications and Websites. We will also maintain your Personal Data for as long as necessary to fulfil the Purposes set out in this Notice, to comply with applicable legal or regulatory requirements, resolve disputes or enforce our legal rights.

When your Personal Data is no longer required for the purposes for which it was collected or otherwise required by applicable law, we will take reasonable steps to securely destroy, permanently delete or anonymise such Personal Data in accordance with the Personal Data Protection Act 2010 and our internal retention policies.

In most instances, it is necessary for us to process your Personal Data in order to provide B+’s products and services and for B+ to operate in the ordinary course of business. However, subject to the Personal Data Protection Act 2010 and any applicable legal restrictions, you may exercise your rights in relation to your Personal Data in the manner described herein.

You may at any time contact B+’s Personal Data Protection Team via registered post or email as set out in our contact details in the last section below to make inquiries or raise complaints about the processing of your Personal Data and you may request in writing to:

• access your Personal Data;
• withdraw your consent to B+’s processing of your Personal Data;
• limit the processing by B+ of your Personal Data;
• request the correction (including the deletion) of your Personal Data where it is inaccurate, incomplete, misleading or not up to date; and
• request that B+ cease processing your Personal Data for direct marketing purposes or cease sending marketing communications via email, phone, WhatsApp message or SMS message.

B+ will respond to your data access and data correction requests within the 21 days, subject to any extension permitted under Personal Data Protection Act 2010.

Please note that we reserve our right to decline any data access request or data correction request in certain situations, including:

• where we are unable to confirm your identity;
• where information requested for is of a confidential nature;
• if we receive repeated requests from you and the burden or expense of providing access is disproportionate to the risks of your privacy; and
• We also reserve the right to charge a reasonable fee (where permitted under the applicable law) for processing any data access request.

We do not knowingly collect or process Personal Data from individuals under 18 years of age. If you are a parent or legal guardian, please ensure that any minor under your care does not submit Personal Data to us without your consent or supervision. In the event that such Personal Data relating to a minor is provided to us, the parent or legal guardian submitting such Personal Data confirms that he or she has the authority to do so, you hereby consent to the processing of the minor’s Personal Data in accordance with this Notice, and personally accept and agree to be bound by this Notice and take responsibility for his or her actions.

In some circumstances you may have provided personal data relating to other individuals (such as your spouse, family members or friends) and in such circumstances you represent and warrant that you have obtained the necessary consent or are otherwise authorized under applicable law to provide their Personal Data to us and to permit us to process and use such Personal Data in accordance with the manner as set forth in this Notice.