PRIVACY POLICY AND PERSONAL DATA PROTECTION NOTICE

Effective date: 01 OCTOBER 2026

1. WHO WE ARE

VERSE Clinic is operated by VERSE CARE SDN BHD, registration number 202601001609 (1663706-A) (“we”, “us” or “our”). This notice explains how we handle personal data in connection with our websites, enquiries, appointments, BioAge™ assessments and clinical services, in accordance with Malaysia’s Personal Data Protection Act 2010, as amended.

For privacy enquiries or requests, email admin@verseclinic.com with the subject “Privacy Request”.

2. INFORMATION WE COLLECT AND ITS SOURCES

Depending on the service you request, we may collect:

– Identity and contact details, such as your name, date of birth, telephone number, email address and identification details where necessary.
– Enquiry, appointment, communication, billing and transaction records.
– Health and lifestyle information, medical history, assessment answers, laboratory results, BioAge™ results, treatment records and clinical photographs where relevant to your care.
– Website information, such as IP address, browser and device details, pages visited and cookie data, where collected by the tools disclosed below.

We obtain information from you, from your authorised representative, from healthcare professionals or laboratories involved in your care where permitted, and from your interactions with our websites and service providers. If you provide another person’s information, you must have authority to do so and make this notice available to them.

3. WHY WE USE YOUR INFORMATION

We use relevant information to respond to enquiries; manage appointments and payments; assess suitability for services; provide BioAge™ assessments, clinical care and follow-up; maintain records; operate and secure our websites and systems; handle complaints or legal claims; and meet legal, regulatory and professional obligations. With your consent, we may also send clinic news, offers or other marketing communications.

Health information is sensitive personal data. We obtain explicit consent where required, or process it only where another condition permitted by law applies, including necessary medical processing by a healthcare professional or a person under an equivalent duty of confidentiality.

BioAge™ assessments use information supplied during the relevant assessment to produce an estimate of biological age. [Complete before publication: confirm whether automated scoring or profiling is used. If so, explain that processing, its purpose, the factors considered and how results influence recommendations, referrals or treatment decisions. Identify any use of AI only if applicable.]

Any use of identifiable clinical photographs, testimonials or treatment results for publicity requires separate permission.

4. REQUIRED INFORMATION AND YOUR CHOICES

We identify information that is required when requesting it. Without information necessary for an enquiry, booking, assessment or safe care, we may be unable to respond, complete the booking or provide the relevant service. Other information is voluntary. Marketing consent is optional and is not a condition of receiving care.

You may withdraw consent or ask us to limit processing by emailing admin@verseclinic.com. You may stop marketing messages using an available unsubscribe option or by contacting us. Withdrawal may affect services that depend on the relevant information. It does not override lawful medical-record retention or other processing required or permitted by law.

5. WHO MAY RECEIVE YOUR INFORMATION

Where necessary for the purposes described above and legally permitted, recipients may include:

– Treating healthcare professionals, referral providers and laboratories involved in your care.
– Providers supporting website hosting, IT, record management, bookings, communications or payments.
– Insurers or third-party payers where you request or authorise their involvement.
– Professional advisers, auditors, regulators, public authorities or courts where appropriate or legally required.

We limit disclosures to relevant information and require service providers processing information on our behalf to apply appropriate confidentiality and security safeguards. Disclosures for unrelated purposes require an appropriate legal basis and any necessary additional notice or consent.

6. COOKIES AND EXTERNAL SERVICES

[Complete before publication: identify the cookies, analytics tools, advertising pixels and embedded services actually used; their providers, purposes and durations; and how visitors can make or change their choices. If only essential cookies, or no cookies, are used, describe that accurately.]

You can manage cookies through your browser settings. Blocking necessary cookies may affect website functions. If you choose to use an external service, such as WhatsApp, a payment service or an external booking platform, that provider may also process information under its own privacy notice.

7. OVERSEAS PROCESSING

If our service providers process personal data outside Malaysia, we will make transfers only where permitted by Malaysian law and apply appropriate safeguards for the relevant transfer. You may contact us for information about applicable overseas processing.

8. SECURITY AND RETENTION

We take reasonable administrative, technical and physical measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. Access is limited according to work responsibilities.

We retain information only as long as needed for the purposes described, including applicable clinical-record, legal, regulatory and professional requirements and the handling of claims. Information is securely deleted or anonymised when it is no longer required. Where legally required, we will notify the relevant authority and affected individuals of a personal data breach.

9. YOUR RIGHTS AND COMPLAINTS

Subject to applicable legal conditions, you may request access to your personal data, correction of inaccurate or incomplete data, withdrawal of consent, prevention of processing likely to cause damage or distress in the circumstances provided by law, and cessation of direct marketing. You may also request, by electronic written notice, that we transmit your personal data directly to another data controller, subject to technical feasibility and compatibility of the data format.

Email admin@verseclinic.com to make a request or complaint. We may need to verify your identity or your representative’s authority and will respond within applicable legal timeframes. Any legally permitted fee or restriction will be explained. You may also complain to Malaysia’s Personal Data Protection Commissioner through www.pdp.gov.my.

10. CHILDREN AND UPDATES

For individuals under 18, we obtain consent from a parent, guardian or person with parental responsibility where required. An authorised representative may contact us about the individual’s information.

We may update this notice and will display the revised effective date. Where required, we will provide further notice or obtain fresh consent before a new use or disclosure. Publication of an update does not itself constitute consent.