Privacy Policy

Home » Privacy Policy

Last updated: [02-06-2026]

This Privacy Policy explains how Cyrona Cell Malaysia (“Cyrona Cell”, “we”, “our”, “us”) collects, uses, discloses, and protects your personal data when you:

browse or use our website and Online Services;
complete enquiry forms or contact us by email, phone, or WhatsApp; or
attend consultations, treatments, and follow-up at our clinic.

This Policy is intended to comply with the Personal Data Protection Act 2010 (PDPA) of Malaysia and related regulations.

By providing your personal data, you agree to the practices described in this Policy. If you do not agree, please do not submit personal data and contact us to discuss alternatives.

1. Data Controller

For the purposes of PDPA, the data user / data controller is:

Cyrona Cell Malaysia

Clinic address: Suite 4801-1-09, CBD Perdana, Jalan Perdana Off Persiaran Flora, 63000 Cyberjaya, Selangor, Malaysia.

Email: info@cyronacell.com

Phone: +60182220032

2. What Personal Data We Collect

The types of personal data we may collect include:

Identity data
Name, date of birth, gender, nationality, passport or ID number, marital status.
Contact data
Address, email, phone number, emergency contact details.
Medical and health data (sensitive personal data)
Medical history, diagnoses, medication list, allergies, lab and imaging results, treatment history, lifestyle information (e.g. smoking, alcohol), and any details you provide in forms or consultations.
Travel and logistics data
Flight details, accommodation, visa status, travel companions, and appointment schedules for international patients.
Financial and billing data
Payment records, invoice details, and limited card/payment information processed via secure third-party payment providers.
Technical data
IP address, device type, browser type, pages visited, time spent on the Site, and cookies or similar technologies.
Marketing and communication preferences
Your choices about receiving updates, newsletters, or service information.

We collect data directly from you, from your authorised representatives, from healthcare providers you authorise to share information, and from publicly available sources where appropriate.

3. How We Use Your Personal Data

We may use your personal data for the following purposes:

To respond to your enquiries
Assess whether our services may be suitable for your condition.
Provide information about programmes, costs, and logistics.
To provide medical and supportive services
Conduct consultations and medical assessments.
Design personalised treatment plans, including stem cell treatments, exosome support, and rehabilitation.
Coordinate lab testing, imaging, and referrals.
To manage our relationship with you
Schedule appointments and follow-ups.
Send administrative messages (confirmations, reminders, updates).
Handle payments, receipts, and billing issues.
For safety, quality and regulatory compliance
Maintain accurate medical records.
Monitor outcomes, side effects, and treatment safety.
Comply with legal obligations, audits, and regulatory requests in Malaysia.
For service improvement and internal analysis
De-identify or anonymise data to analyse trends, outcomes, and service quality.
Evaluate and improve our clinical protocols and patient experience.
For marketing (with consent where required)
Send clinic news, educational content, or special updates by email, SMS, or messaging apps.
Use anonymised feedback or case summaries (never revealing identity without explicit written consent).
For security and fraud prevention
Protect our systems and networks.
Detect suspicious activity or misuse of the Site.

We will not sell your personal data to third parties.

4. Legal Basis for Processing

Depending on the context, we process your personal data based on one or more of the following:

Your consent, especially for sensitive health data and marketing communications.
Necessity for medical diagnosis, treatment, or health care management.
Performance of a contract or steps at your request before entering into a contract (e.g. assessment and booking).
Compliance with legal obligations (for example, record-keeping, reporting requirements).
Protection of your vital interests (such as managing serious risks to life or health).
Our legitimate interests in running a safe, effective medical practice, where your rights do not override those interests.

You may withdraw consent at any time, but this may limit our ability to provide or continue certain services.

5. Sharing Your Personal Data

We may share your personal data, on a need-to-know basis, with:

Our medical team and staff
Doctors, nurses, lab personnel, coordinators, and administrative staff involved in your care.
Partner hospitals, clinics and laboratories
For tests, imaging, additional treatments, or emergency care.
Technical and service providers
IT support, secure cloud storage providers, email and SMS platforms, payment processors, and analytics tools, who must handle data under confidentiality obligations.
Regulators and authorities
Where required by Malaysian law, court order, or to protect safety and legal rights.
Professional advisors
Lawyers, auditors, or insurers, where access is necessary for legitimate business purposes.
Research and education (de-identified)
We may use anonymised or aggregated data for clinical audits, quality improvement, or research and teaching. Individuals are not identifiable in this form.

We do not disclose your personal data for unrelated marketing purposes without your explicit consent.

6. International Transfers

Some of our technology providers or secure data storage services may be located outside Malaysia.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the receiving party provides a level of protection comparable to the PDPA (for example, by using contractual safeguards).
By using our services, you consent to such international transfers where necessary for the purposes described in this Policy.

7. Data Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure or destruction. These measures may include:

secure, access-controlled electronic medical record systems;
encryption and secure transmission protocols where appropriate;
role-based access for staff;
staff training on confidentiality and data protection; and
secure disposal or anonymisation of data when no longer needed.

However, no system can be completely secure. You acknowledge that transmission of information over the internet is at your own risk.

8. Data Retention

We keep your personal data for as long as necessary to fulfil the purposes outlined in this Policy and to meet legal, regulatory, and operational requirements, including:

minimum retention periods for medical records under Malaysian health regulations;
accounting and tax record requirements; and
the need to respond to any future queries or complaints.

When data is no longer required, we will securely delete or anonymise it.

9. Your Rights Under PDPA

Subject to certain conditions in the PDPA, you have the right to:

Access your personal data that we hold.
Request correction of inaccurate, incomplete, or outdated data.
Withdraw consent to processing (where processing is based on consent).
Limit certain processing activities where allowed by law.
Object to direct marketing at any time.

To exercise these rights, please contact us using the details in Section 13. We may require proof of identity and may charge a reasonable administrative fee for repeated or complex requests, as permitted by law.

10. Cookies and Online Tracking

Our Site may use cookies and similar technologies to:

remember your preferences;
understand how visitors use the Site; and
improve Site performance and content.

You can usually control cookies through your browser settings. However, disabling certain cookies may affect the functionality of the Site.

11. Children’s Privacy

Our Site and services are primarily intended for adults. Where treatment involves a child or young person, personal data is usually provided by a parent or legal guardian, and consent is obtained from them in line with Malaysian law and local ethical standards.

12. Third-Party Websites

This Policy applies only to data collected by Cyrona Cell. If you follow a link to a third-party website, that site’s privacy policy will apply. We are not responsible for the privacy practices of third parties.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal changes, technology updates, or improvements in our practices.

The “Last updated” date shows when the Policy was last revised.
Significant changes may be highlighted on our Site or communicated by email where appropriate.

Your continued use of our Site and services after any changes means you accept the updated Policy.

14. Contact & PDPA Requests

If you have questions, concerns, or requests about this Privacy Policy or how we handle your personal data, please contact: