PERSONAL DATA PROTECTION NOTICE AND CONSENT FORM

1. Purpose and Scope

This Personal Data Protection Notice and Consent Form (“Notice”) is issued pursuant to the Personal Data Protection Act 2010 of Malaysia (“PDPA”). This Notice explains how WELLNESSDAY, operated by Detoxi Wellness Sdn. Bhd. (“Company”, “we”, “our” or “us”), collects, records, holds, stores, uses, discloses and otherwise processes your personal data in connection with our products, services, facilities, customer relationship management and related commercial transactions.

For the purposes of this Notice, “Personal Data” means any information in respect of commercial transactions that relates directly or indirectly to an individual who is identified or identifiable from that information, whether collected manually, electronically, verbally, through forms, booking systems, messaging platforms, CCTV, payment records or other lawful means.

Where you provide personal data relating to another individual, you confirm that you have obtained that individual’s consent or are otherwise authorised to provide such data to us.

This Notice is intended to satisfy the notice and choice requirements under the PDPA and to enable you to make an informed decision before providing your Personal Data to us.

1. Categories of Personal Data Collected

We may collect and process the following categories of personal data (“Personal Data”):

• Identification Data refers to full name, NRIC number, passport number, nationality, date of birth, gender and signature.
• Contact Data refers to mobile number, telephone number, email address, residential address, emergency contact details and communication preferences.
• Transactional Data refers to invoices, receipts, package purchases, payment history, refund records, appointment bookings and account records.
• Service-Related Data refers to appointment history, session usage, customer notes, preferences, suitability information, attendance records and service feedback.
• Health or Sensitive Personal Data refers to any health-related information, medical declarations, physical condition, allergies, contraindications, pregnancy status, medication information or other sensitive information voluntarily disclosed by you for service suitability, safety or advisory purposes.
• Digital and Technical Data refers to CCTV images or recordings, online form submissions, electronic communications, website or booking-system records, device identifiers and system logs, where applicable.

We will only collect Personal Data that is necessary or directly related to the purposes stated in this Notice. Sensitive personal data will only be processed where you have given explicit consent, where the processing is necessary for the services requested or where otherwise permitted by law.

2. Purposes of Processing

Your Personal Data may be processed for the following purposes:

• Service delivery refers to registering you as a customer, scheduling, administering, monitoring and recording service sessions, managing appointments and verifying service eligibility.
• Customer management refers to creating and maintaining customer accounts, managing package redemption, responding to enquiries, handling complaints, providing customer support and maintaining service records.
• Health, safety and suitability refers to assessing whether a service, treatment, facility or product is suitable for you, recording voluntarily disclosed health or safety information and reducing foreseeable operational or service risks.
• Billing and finance refers to issuing invoices, processing payments, maintaining accounting records, administering refunds, conducting internal audits and satisfying tax, accounting or reporting requirements.
• Operational requirements refers to internal administration, staff training, service improvement, quality assurance, system maintenance, fraud prevention, risk management and business continuity.
• Legal and regulatory compliance refers to complying with applicable Malaysian laws, lawful requests, court orders, regulatory requirements, enforcement authorities, record-keeping obligations and dispute resolution processes.
• Marketing and communication refers to sending service updates, promotional materials, membership offers, events, reminders and notices, but only where required consent has been obtained and subject to your right to opt out.

We may also process your Personal Data for any purpose that is incidental, ancillary or related to the purposes stated above, provided that such processing is carried out in accordance with the PDPA and applicable law.

3. Disclosure of Personal Data

Your Personal Data may be disclosed to the following parties when reasonably necessary:

• Directors, officers, employees, consultants, agents and authorised representatives of the Company on a need-to-know basis.
• Payment processors, banks, e-wallet providers, financial institutions, accountants, auditors, tax advisers and professional advisers.
• IT service providers, cloud service providers, software vendors, booking-system providers, data storage providers, maintenance contractors and cybersecurity service providers.
• Insurers, legal advisers, debt recovery agents, dispute resolution bodies and other professional service providers where reasonably required.
• Government departments, regulators, enforcement agencies, courts, tribunals or statutory bodies where disclosure is required or permitted by law.
• Successors, assigns, potential purchasers, investors or transferees in connection with any merger, restructuring, sale, transfer or reorganisation of the Company or its business, subject to appropriate confidentiality safeguards.
• Any other person or organisation authorised by you, instructed by you or otherwise permitted under applicable law.

We will not sell, rent or trade your Personal Data to unauthorised third parties. Disclosure will be limited to what is reasonably necessary for the purposes stated in this Notice or as otherwise permitted by law.

Where our service providers process Personal Data on our behalf, we will take reasonable steps to require them to maintain confidentiality, implement appropriate security safeguards and process Personal Data only for authorised purposes.

4. Data Storage, Security and Retention

We will take reasonable practical steps to protect Personal Data against loss, misuse, unauthorised access, unauthorised disclosure, alteration, destruction or similar risks. Such measures may include administrative, technical and physical safeguards, internal access controls, confidentiality obligations, staff awareness measures, password protection, system controls and secure storage practices.

Your Personal Data will be retained only for as long as necessary to fulfil the purposes stated in this Notice, to satisfy legal, regulatory, accounting, tax, audit or operational requirements, to resolve disputes or to enforce our rights and obligations. When Personal Data is no longer required, we will take reasonable steps to securely destroy, anonymise or otherwise dispose of it in accordance with our retention practices and applicable law.

5. Accuracy and Customer Responsibilities

You are responsible for ensuring that all Personal Data provided to us is accurate, complete, not misleading and kept up to date. You should promptly notify us in writing of any changes to your Personal Data. We may request supporting documentation to verify the accuracy of any information or correction request.

6. Transfer and Storage Outside Malaysia

Your Personal Data may be stored, hosted, accessed or processed outside Malaysia where our systems, service providers, cloud platforms, support teams or data storage facilities are located. Where such transfer or access occurs, we will take reasonable steps to ensure that the Personal Data is protected in a manner consistent with the PDPA and applicable legal requirements.

7. Access, Correction, Withdrawal and Other Rights

Under the PDPA, you have the right to:

• Request access to your Personal Data held by us, subject to any permitted exceptions.
• Request correction of Personal Data that is inaccurate, incomplete, misleading or not up to date.
• Withdraw consent to the processing of your Personal Data, subject to legal, contractual and operational limitations.
• Request that we cease or do not begin processing your Personal Data for direct marketing purposes.
• Raise enquiries or complaints concerning the manner in which your Personal Data is processed.

All requests must be submitted in writing to us. We may require reasonable verification of your identity before processing a request and may charge a prescribed fee where permitted by law. Withdrawal of consent will not affect the lawfulness of processing carried out before such withdrawal.

8. Consequences of Failure to Provide Personal Data

Failure to provide necessary Personal Data may result in:

• We may be unable to register or maintain your customer account.
• We may be unable to process your purchase, booking, payment, refund or package redemption.
• We may be unable to assess service suitability, provide services safely or respond properly to your enquiries.
• We may be unable to comply with applicable legal, accounting, tax, audit or regulatory obligations.
• We may suspend, restrict or terminate the relevant service, account or transaction where the Personal Data is necessary for such purpose.

9. Consent to Processing of Personal Data

By signing this Notice, you expressly:

• Consent to the collection, recording, holding, storage, use, disclosure and processing of your Personal Data for the purposes stated in this Notice.
• Explicitly consent to the processing of any sensitive personal data voluntarily provided by you, including health-related information, where such processing is necessary or appropriate for service suitability, safety, advisory or operational purposes.
• Acknowledge that you have read, understood and been given an opportunity to ask questions regarding this Notice.
• Confirm that all Personal Data provided by you is true, accurate, complete and not misleading.
• Agree that the Company may continue to process your Personal Data for ongoing and future services unless and until you withdraw consent in writing, subject to legal, contractual and operational limitations.

10. Customer Acknowledgement and Execution

I, the undersigned, hereby confirm that I have read and understood this Personal Data Protection Notice and Consent Form and I voluntarily consent to the collection, recording, holding, storage, use, disclosure and processing of my Personal Data, including any sensitive personal data voluntarily provided by me, in accordance with the terms stated above.