1. Introduction
Rimba Health Sdn. Bhd. ("Rimba Health", "we", "us", or "our") is committed to handling personal data with care and transparency. This Privacy Policy describes how we collect, use, store, and protect information provided to us through our website and professional services.
We operate in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and observe the principles of notice, choice, disclosure, security, retention, data integrity, and access as set out therein.
If you have questions about this policy, please contact us at [email protected] before using our services.
2. Data Collection
What We Collect
When you contact us, request a service quotation, or submit an inquiry through our website, we may collect:
- Full name and professional title
- Organisation name and role (clinic manager, administrator, director)
- Email address and telephone number
- The content of your message or inquiry
- IP address and browser type (collected automatically)
- Pages visited and referral source (via analytics)
How We Collect It
- Contact forms: when you submit an inquiry via our website
- Direct correspondence: email, telephone, or in-person meetings
- Service delivery: data shared during an Admin Process Review engagement or Pilot programme
- Cookies and analytics: automatically when you browse our website
Legal Basis for Processing
- Consent: where you voluntarily submit a form or opt in to communications
- Contract: where processing is necessary to deliver a service you have engaged us for
- Legitimate interest: for security, fraud prevention, and improving our services
- Legal obligation: where required by Malaysian law or regulatory authority
Data Retention
Inquiry and contact data is retained for up to 24 months after last contact, unless an ongoing service relationship exists. Service engagement records are held for 7 years in line with standard Malaysian business record-keeping requirements. Analytics data is retained in aggregate form and not linked to individuals after 26 months.
3. How We Use Your Data
We use personal data only for purposes connected to why it was collected:
- Service delivery: responding to inquiries, scoping engagements, delivering reports and training
- Communications: sending you documents, proposals, governance briefs, and meeting summaries related to your engagement
- Invoicing and administration: issuing statements and receipts for services rendered
- Website improvement: understanding which pages are useful and where navigation may be unclear
- Legal compliance: meeting obligations under PDPA, MMC guidelines, and MOH administrative requirements as they relate to our work
Marketing Communications
We do not send unsolicited marketing material. If you have engaged with us and wish to receive periodic governance or AI-in-healthcare updates, you may opt in by contacting us at [email protected]. You may withdraw at any time.
Data Sharing
We do not sell personal data. We may share data with:
- Professional advisors (legal, accounting) bound by confidentiality obligations
- Cloud infrastructure providers for hosting and email delivery, under data processing agreements
- Analytics platforms (Google Analytics) in anonymised or aggregated form
- Regulatory bodies or law enforcement where required by law
4. Data Protection Measures
We take reasonable and appropriate steps to protect the personal data we hold:
- Encryption in transit: all website traffic uses TLS (HTTPS)
- Access controls: internal data access is limited to personnel who need it for their role
- Secure storage: client documents and engagement records are held in access-controlled environments
- Vendor review: third-party processors are assessed for adequate data handling practices before engagement
- Periodic review: our data handling practices are reviewed at least once per year as part of our Quarterly Administrative Stewardship work
Breach Notification
In the event of a data breach that is likely to result in risk to individuals, we will notify affected parties and, where required, the relevant authority in Malaysia within the timeframe stipulated by applicable law. We maintain a near-miss and incident log as part of our governance practice.
6. Your Rights
Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to personal data we hold about you:
Right of Access
You may request a copy of personal data we hold about you.
Right to Correction
You may request that inaccurate or incomplete data be corrected.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw it at any time.
Right to Object
You may object to processing carried out on the basis of legitimate interest.
Right to Portability
Where technically feasible, you may request data in a structured, machine-readable format.
Right to Lodge a Complaint
You may file a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your data rights have been breached.
To exercise any of these rights, write to us at [email protected]. We aim to respond within 21 days. Identity verification may be required before we process a request.
7. Third-Party Links
Our website may contain links to external resources — such as MOH publications, MMC circulars, or BNM guidelines — for reference purposes. We are not responsible for the privacy practices of those external sites and encourage you to read their individual privacy notices. The presence of a link does not constitute an endorsement.
8. Children's Privacy
Our services are directed at healthcare administrators, clinic managers, and institutional decision-makers. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted data through our website, please contact us promptly so we can remove it.
9. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or the services we offer. When we make changes, the "Last Updated" date at the top of this page will be revised.
If changes are material, we will make reasonable efforts to notify active clients directly. Continued use of our website after a policy update constitutes acknowledgement of the revised terms.
10. Contact — Data Inquiries
For questions about this Privacy Policy, to exercise your data rights, or to submit a concern, please use the details below. We handle all privacy-related correspondence with appropriate care.
Rimba Health
Unit 11-2, Menara Boustead, Jalan Raja Chulan, 50200 Kuala Lumpur
Supervisory authority: Department of Personal Data Protection Malaysia (JPDP)