Privacy
Policy.

1. Who we are

VitalSync is a clinical deterioration-prediction platform developed and operated by Andalus Health Sdn. Bhd. ("Andalus Health", "we", "us"), a company registered in Malaysia and based in Kuala Lumpur. This policy explains how we handle information collected through our website (andalushealth.com) and, separately, how information is handled within the VitalSync platform deployed inside hospitals.

2. Information we collect

Website visitors

When you use our website or contact us, we may collect information you provide directly and basic technical data:

• Contact details you submit through demo requests or contact forms — name, work email, organisation, and any message content.
• Standard technical information such as browser type, device, and pages visited, used to keep the site secure and understand aggregate usage.

The VitalSync platform

Within a deployed hospital environment, the platform processes clinical data — vital signs, monitor streams, and related records — strictly to generate alerts and clinical insights. This processing happens locally, under the hospital's control, as the data controller.

3. How we use information

Information collected through the website is used to:

• Respond to demo requests, enquiries, and support messages.
• Provide information about VitalSync that you have asked for.
• Maintain the security, reliability, and performance of the website.
• Comply with our legal and regulatory obligations in Malaysia.

We do not sell your information, and we do not use website contact data for automated decision-making.

4. Patient data on the platform

The VitalSync platform is designed around a simple principle: patient data stays in the hospital.

• All AI inference runs locally on the on-premise device — no clinical data is sent to external servers.
• The hospital is the data controller for patient information; Andalus Health does not access or hold identifiable patient records.
• Data at rest on the device is encrypted (AES-256), and access is restricted by clinical role.

For the full technical detail, see our Compliance & Standards page and the PDPA Notice.

5. Sharing and disclosure

We share website information only where necessary and with appropriate safeguards:

• With service providers who help us operate the website and communications, under confidentiality obligations.
• Where required by Malaysian law, regulation, or a valid legal request.
• In connection with a corporate transaction, subject to the protections in this policy.

We never share hospital patient data — because, by design, we never receive it.

6. Data retention

We keep website contact information only as long as needed for the purpose it was collected, or as required by law. Demo and enquiry records are retained for a reasonable period to manage our relationship with you, then securely deleted or anonymised.

Retention of clinical data within the platform is configured and controlled by each hospital under its own policies.

7. Security and your rights

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold. No system is perfectly secure, but we work to protect information against loss, misuse, and unauthorised access.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have rights to access, correct, and limit the processing of your personal data. To exercise these rights, contact us using the details below. Our full PDPA disclosures are set out in the PDPA Notice.

8. Cookies, changes, and contact

Our website uses a minimal set of cookies necessary for basic functionality and aggregate analytics. You can control cookies through your browser settings.

We may update this policy from time to time; the "last updated" date above reflects the current version. Material changes will be reflected on this page.