Privacy notice

• Contact and account details — your name, email, phone number, password (stored securely, never visible to our staff), gender, date of birth and preferred language.
• Health information — details you choose to share so our Vaidyas and therapists can treat you safely, such as allergies, medications, medical conditions, height, weight, pregnancy or menstrual status, and your Prakriti (dosha) assessment answers.
• Booking and treatment records — appointments, treatments received, and notes recorded by our practitioners.
• Orders — products ordered and your delivery address.
• Payment and refund details — payments are processed by our payment provider; we do not see or store your full card details. For refunds we may ask for your bank details.
• Messages — enquiries, contact-form messages and conversations with our team.
• Technical data — basic cookies needed to keep you signed in, and a referral code if you arrive through one of our Brand Partners' links.

• To book, confirm, remind you about and deliver your consultations and treatments, including matching you with a same-gender therapist.
• To plan your care safely and keep an accurate record of your treatment.
• To process payments, refunds, orders and deliveries.
• To reply to your messages and provide customer support.
• To send you offers and wellness updates — only if you have agreed, and you can opt out at any time.
• To keep our website and accounts secure and to meet our legal and accounting obligations.

Health details are sensitive personal data. We collect them only with your consent and only to provide safe care. They are visible only to our clinical team and the staff who need them to look after you, and are never used for marketing.

We never sell your personal data. We share it only with trusted service providers who help us run the centre, under strict confidentiality:

• our website hosting and database providers;
• our payment provider, to process payments and refunds;
• our email provider, to send booking confirmations and sign-in codes;
• courier companies, to deliver your orders;
• authorities, where the law requires it.

Some of these providers store data on servers outside Malaysia (for example in Singapore). Where that happens, we take steps to ensure your data remains protected.

We keep your data for as long as your account is active or as needed to provide our services. Treatment and financial records may be kept longer where the law requires. When data is no longer needed, we delete or anonymise it.

Under the PDPA you may access and correct your personal data, and limit how it is used. From your account you can:

• update your details and health information in Profile;
• turn marketing messages and reminders on or off;
• download a copy of your data;
• request deletion of your account.

You can also contact us at admin@ayurvedicwellness.com.my. If you choose not to provide certain information, we may not be able to book or safely provide some treatments.

We use secure, encrypted connections, restricted staff access based on job role, and verification codes when you sign in. No system is completely secure, so please keep your password private and let us know straight away if you suspect misuse.

Treatments for children must be booked by a parent or guardian, who provides the child's details on their behalf.

We may update this notice from time to time. The latest version will always be on this page, with the date it was last updated.