Personal Data Protection Policy | Malaysia Healthcare Travel Council (MHTC)

Personal Data Protection Notice

At all times during the engagement of our services, Malaysia Healthcare Travel Council (MHTC) prioritises the security and confidentiality of your personal data. We are committed to ensuring that your personal data, including sensitive personal data, is processed in a lawful, fair, and secure manner in accordance with the Personal Data Protection Act 2010 (PDPA).

This Personal Data Protection Notice explains how we collect, use, disclose, store, and protect your personal data.

Definition of Personal Data and Sensitive Personal Data Under the PDPA:

Personal Data means any information that relates directly or indirectly to an individual who is identified or identifiable, including but not limited to name, identification number, contact details, images, and location data.

Sensitive Personal Data includes personal data relating to health, medical condition, medical history, and other data defined as sensitive under the PDPA.

Collection of Personal Data

We collect personal data either directly from you or indirectly through authorised third parties such as:

legal representatives or next of kin;
agents (including medical tourism agents);
affiliated hospitals and healthcare providers;
registration or enquiry forms (online or physical);
website usage and analytics tools; and
social media interactions or communications with MHTC.

By providing personal data to MHTC, you acknowledge that you have consented to its processing in accordance with this Notice.

Purpose of Processing Personal Data

MHTC processes your personal data for purposes including but not limited to:

providing healthcare travel facilitation services;
managing enquiries, registrations, and contracts;
facilitating engagement with affiliated hospitals and healthcare providers;
organising events, webinars, and promotional activities;
marketing, communications, and service improvement;
compliance with legal and regulatory obligations;
internal administration, reporting, and record management;
data analytics and service enhancement;
audit, investigation, and security purposes; and
other legitimate business purposes.

Where you choose not to provide required personal data, MHTC may be unable to process your request or provide certain services.

Where you have consented to receive any marketing or promotional updates from MHTC and wish to opt-out from our updates, you may select the “unsubscribe” option provided in MHTC’s email blasts or contact us at our details below.

Disclosure of Personal Data

Your personal data may be disclosed to:
1.1 Internal Parties
Authorised employees and departments within MHTC on a need-to-know basis.
1.2 External Parties
Relevant third parties including but not limited to:

affiliated hospitals and healthcare providers;
service providers, consultants, contractors, and professional advisers;
event organisers, travel agencies, hotels, and airlines;
insurance providers and healthcare-related partners;
government authorities, regulators, and enforcement agencies;
accreditation or industry bodies; and
technology or system service providers.

1.3 Corporate Transactions
In the event of restructuring, merger, acquisition, or sale of business assets.
1.4 Cross-border Transfer
Where necessary, your personal data may be transferred outside Malaysia. In such cases, MHTC will ensure appropriate safeguards are in place and compliance with PDPA requirements.

Cookies and Website Usage

Our website may use cookies and analytics tools to enhance user experience and improve service delivery. Cookies may be used to:

remember user preferences;
analyse website traffic and usage patterns; and
improve content and functionality.

You may adjust your browser settings to disable cookies; however, certain features may be affected.

Data Subject Rights (Access, Correction & Other Requests)

You have the right to:

access your personal data; Personal Data Access Request Form
request correction or update of your personal data; Personal Data Correction Request Form and
withdraw consent (subject to legal and contractual limitations).

All requests must be submitted in writing to:

Data Protection Officer (DPO)
Malaysia Healthcare Travel Council (MHTC)
Email: privacy@mhtc.org.my

MHTC may require identity verification before processing any request. Requests will be handled in accordance with applicable PDPA requirements and internal procedures.

Trust, Integrity and Accountability