PDPA Notice

This notice is issued by Axtra Health Sdn Bhd (Company Registration No. 1646544-K), of No. 26, Jalan Eko Botani 2E, Persiaran Eko Botani 2, Taman Eko Botani 2, Iskandar Puteri, 79100 Johor Bahru, Johor Darul Ta'zim, Malaysia ("Axtra Health"), in accordance with the Notice and Choice Principle under section 7 of the Personal Data Protection Act 2010 ("PDPA"). It applies to personal data processed when you create an account, complete a health assessment, or use a consultation, protocol, or fulfilment pathway on the Theo & Thea platform.

This notice sets out what the PDPA requires us to tell you. For a fuller, plain-language explanation of our data practices, see our Privacy Policy.

1. Classes of personal data processed

• Personal and contact data: Full name, date of birth, sex, email address, phone number.
• Sensitive personal data: Health assessment answers, medical history, current medications and allergies, consultation notes, prescription and protocol records, and any health documents you upload.
• Delivery data: Self-pickup or delivery choice; where delivery is chosen, recipient name, phone number, and address.
• Payment-related data: Bank transfer / DuitNow reference details and proof-of-payment files, used only for manual payment verification. We do not collect bank card or online banking login credentials.
• Technical data: IP address and basic access logs automatically collected by our hosting and authentication infrastructure.

2. Purposes of processing

• Creating and administering your account;
• Routing your health assessment to a licensed pharmacist and, where clinically appropriate, a licensed doctor for independent professional review;
• Enabling licensed pharmacy partners to compound, dispense, and arrange delivery or pickup of your order;
• Verifying and reconciling manual payments;
• Sending service notifications relating to your account, orders, consultations, and refills;
• Maintaining the security and audit records of the Platform, and complying with the legal and regulatory record-keeping obligations of a health services platform.

3. Source of your personal data

We collect personal data directly from you when you register, complete a health assessment, book a consultation, place an order, or contact us. We do not purchase personal data from third parties.

4. Classes of third parties data may be disclosed to

• The pharmacist reviewing your case and, where applicable, the doctor assigned to review it, and the licensed pharmacy that compounds or dispenses your order — currently including Amber Pharmacy Sdn Bhd. The current partner list is maintained at Professional partners, and may grow over time.
• Delivery partners, where you choose delivery rather than self-pickup.
• Our cloud infrastructure and email service providers, who process data on our behalf under contractual restrictions and do not use your data for their own purposes.
• Malaysian regulators or courts, only where disclosure is legally required.

We do not disclose your personal data to any other third party for marketing or any other purpose without your separate, explicit consent.

5. Cross-border transfer

Some of our infrastructure service providers may process or store data on servers outside Malaysia. Where this happens, we take reasonable steps under section 129 of the PDPA to ensure your data continues to receive comparable protection.

6. Your rights and choices

You have the right to:

• Request access to the personal data we hold about you;
• Request correction of any inaccurate or incomplete personal data;
• Withdraw your consent to our processing of your personal data at any time;
• Limit our processing of your personal data.

To exercise any of these rights, contact admin@axtrahealth.com. We will respond within 21 days as required by the PDPA, and may need to verify your identity first.

7. Consequence of not providing your data

We need your personal and health data to create your account and allow a pharmacist or doctor to review your health assessment. If you do not provide the requested data, we may not be able to create your account, process your health assessment, or complete your order.

8. Marketing

We do not use your health data for marketing. If we send you information about products or services unrelated to your current service, we will only do so with your separate, explicit opt-in consent. You may withdraw that consent at any time by emailing admin@axtrahealth.com.

9. Versioned consent

When you accept this notice, we record the version of the notice you agreed to and the date of your consent. If we make a material change to this notice, we will ask you to review and confirm the updated version.

10. Contact

Questions about this notice, or requests relating to your personal data, can be sent to admin@axtrahealth.com.