PDPA
Notice.

1. About this notice

This notice is issued by Andalus Health Sdn. Bhd. ("Andalus Health", "we", "us") in accordance with Malaysia's Personal Data Protection Act 2010 ("PDPA"). It explains how we process the personal data of individuals who interact with us — for example, by requesting a demo, contacting us, or applying for a role.

2. Personal data we process

Depending on how you interact with us, we may process:

• Identity and contact details — name, work email, phone number, and organisation.
• Correspondence — the content of enquiries, demo requests, and support messages.
• Professional information — role and institution, where relevant to your enquiry or application.
• Technical data — limited website usage information collected to keep the site secure.

Providing this data is voluntary, but if you choose not to, we may be unable to respond to your request.

3. Purposes and disclosure

We process personal data to:

• Respond to enquiries and demo requests, and provide information you have asked for.
• Manage our relationship with hospitals, partners, and prospective team members.
• Meet our legal, regulatory, and record-keeping obligations in Malaysia.

We may disclose personal data to service providers who support our operations (under confidentiality obligations), to professional advisers, and to authorities where required by law. We do not sell personal data, and we do not transfer it outside Malaysia without appropriate safeguards.

4. Your rights under the PDPA

Subject to the conditions in the PDPA, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent to, or limit, our processing of your data.
• Request that we stop processing your data for direct marketing.

We will respond to valid requests within the timeframes required by the PDPA.

5. Retention and security

We retain personal data only for as long as necessary to fulfil the purposes described above or to comply with legal requirements, after which it is securely deleted or anonymised. We apply administrative, technical, and physical safeguards — including encryption and role-based access — to protect personal data against loss, misuse, and unauthorised access.

For platform-level and clinical data safeguards, see our Privacy Policy and Compliance & Standards page.

6. Contact and complaints

To exercise any of your rights, ask a question about this notice, or make a complaint about how we handle personal data, contact us:

In the event of a conflict between the English version of this notice and any translation, the English version prevails.