How we protect personal and health information

1. Scope

This Policy applies to personal data and health-related information obtained through our hospitals and clinics, telehealth encounters, websites and patient portals operated by us, mobile messaging where we deploy it, billing and payer interactions, and quality or patient-experience programmes—consistent with disclosures published by internationally recognised hospital networks.

2. Categories of information

Depending on your interaction, we may process categories such as:

• Identity & demographics: name, identifiers, date of birth, contact details, emergency contacts, language preferences.
• Clinical & administrative health data: symptoms, diagnoses, medications, allergies, orders and results, imaging, operative notes, nursing documentation, referrals, and care coordination records.
• Financial & coverage information: insurer or employer scheme identifiers, guarantor details, payment transactions, pre-authorisation references.
• Technical & usage data: IP address, device type, browser characteristics, pages viewed, and cookie or similar technologies on our digital properties.
• Audio, video, or photographs: where clinically indicated or where you participate in telemedicine or education with consent.

3. Purposes of processing

We use information for purposes that major hospitals routinely disclose, including to:

• Deliver safe, coordinated medical care, maternity services, emergency treatment, and surgical programmes;
• Verify identity, manage appointments, admissions, transfers, and discharge planning;
• Bill for services, pursue authorised reimbursement, and manage credit risk within policy;
• Support infection prevention, medication safety, clinical audit, accreditation readiness, and regulatory reporting;
• Maintain our workforce credentials, on-call lists, and mandatory disclosure to public-health authorities when required by law;
• Operate patient portals, secure messaging, and appointment reminders you opt into;
• Conduct de-identified or aggregate analytics to improve pathways and outcomes, where permitted;
• Respond to complaints, risk/Legal holds, and litigation subject to professional privilege rules.

4. Legal bases & consent

Processing may rely on performance of a contract (care or billing), compliance with legal obligations, protection of vital interests in emergencies, legitimate interests balanced against your rights (for example IT security logging), or your informed consent where consent is the appropriate basis—particularly for marketing communications, certain research participation, or optional digital features.

You may withdraw consent where processing is voluntary without affecting care that does not depend on that consent, except where law requires continued retention.

5. Sharing & recipients

Consistent with tier-one hospitals, disclosure occurs only on a need-to-know or contractual basis, including:

• Members of your multidisciplinary care team, diagnostic partners, and pharmacies processing prescriptions;
• Insurers, employers providing letters of guarantee, and third-party administrators for approved claims workflows;
• Health information exchanges or referring institutions when continuity of care requires it;
• Vendors bound by business associate or data-processing agreements (cloud hosting, transcription, patient engagement tools);
• Government bodies when mandated (reportable diseases, court orders, oversight inspections).

We do not sell personal health information. Where analytics or benchmarking involves third parties, we require de-identification or strict contractual controls.

6. International transfers

If data crosses borders—for example cloud infrastructure or teleconsultation platforms—we implement safeguards such as standard contractual clauses, adequacy decisions, or equivalent mechanisms recognised under applicable law, and we assess vendor security posture before onboarding.

7. Security safeguards

Our programme aligns with hospital-grade expectations: role-based access controls, audit trails, encryption in transit and at rest where appropriate, workforce confidentiality training, incident response playbooks, vendor due diligence, and physical security for records rooms and clinical workstations.

8. Retention

Clinical and billing records are retained for periods defined by medical licensing rules, statute of limitations, paediatric milestones, and institutional policy. Marketing logs and web analytics may be retained for shorter horizons. Destruction, when permitted, uses secure shredding or certified digital wiping.

9. Your rights

Subject to jurisdictional limits and clinical safety, you may request:

• Access to or copies of your records through formal channels;
• Correction of inaccurate demographic or administrative details;
• Restriction or objection to certain processing where law allows;
• Escalation pathways if you believe your privacy rights were infringed.

To exercise rights, contact us using the details below. We may verify identity before fulfilling sensitive requests. If unresolved, you may lodge a complaint with your national data-protection authority where applicable.

10. Cookies & similar technologies

Our websites may use cookies or pixels for essential functions (session security), analytics to improve usability, and—only with consent—personalisation. You can manage browser controls or banners where presented; disabling essential cookies may impair portal login experiences.

11. Minors

Paediatric information is processed with heightened protections. Parents or lawful guardians typically exercise privacy choices on behalf of minors, subject to evolving consent capacity rules and clinical ethics guidance used by paediatric centres of excellence.

12. Changes

We may revise this Policy to reflect legal, technological, or operational changes. Material updates will be posted prominently with a revised “Last updated” date. Continued use of optional digital services after notice may constitute acceptance where permitted by law.

13. Contact

Questions about this Policy or our privacy programme may be directed to info@stmathewhospitalcare.com or in writing to St Mathew Hospital and Maternity, Kuala Lumpur, Malaysia. For privacy requests linked to ongoing care, you may also speak with our front-line registration or patient-experience teams.