Privacy Policy

Privacy Policy and Personal Data Protection Notice

Effective date: 20 August 2026

Last updated: 20 August 2026

1. About this Privacy Policy

This Privacy Policy explains how NextMed Clinic, operated by NM Medical Group Sdn Bhd (Company Registration No. 879031-P), and its affiliated clinics (“NextMed Clinic”, “NextMed”, “we”, “us” or “our”) collect, use, disclose, store and protect personal data.

This Privacy Policy applies when you:

  • Visit https://www.nextmedclinic.com.my or any NextMed landing page;

  • Submit an appointment or enquiry form;

  • Submit a Meta/Facebook or Instagram Instant Form;

  • Contact us through WhatsApp, telephone, email or social media;

  • Register for a consultation, treatment, promotion or event;

  • Visit or receive services at a NextMed Clinic branch; or

  • Otherwise provide personal data to us.

We process personal data in accordance with Malaysia’s Personal Data Protection Act 2010 and its applicable amendments, regulations, standards and guidelines (“PDPA”).

This Privacy Policy is a general data-protection notice. It does not replace any medical consent, treatment consent or other specific notice provided during registration or treatment.

2. Personal data we may collect

Depending on how you interact with us, we may collect:

Identification and contact information

  • Full name;

  • Telephone and WhatsApp number;

  • Email address;

  • Date of birth or age group;

  • Gender;

  • Identification information where reasonably required;

  • Residential address; and

  • Emergency contact information.

Appointment and enquiry information

  • Preferred NextMed branch;

  • Preferred appointment date and time;

  • Preferred contact method;

  • Services or treatments in which you express interest;

  • Enquiry details;

  • Communication history; and

  • Referral or advertising source.

Medical and sensitive personal data

When necessary for consultation or treatment, we may collect sensitive personal data, including:

  • Medical and treatment history;

  • Allergies;

  • Medications;

  • Relevant health conditions;

  • Clinical notes and assessments;

  • Photographs and treatment images;

  • Test results;

  • Consent forms; and

  • Other information reasonably necessary for safe clinical care.

We will only collect and process sensitive personal data where necessary and permitted by applicable law, including where explicit consent has been obtained or processing is required for medical purposes or legal obligations.

Please do not provide detailed medical information through public comments or unsecured social-media channels.

Payment and transaction information

We may collect:

  • Payment status;

  • Invoice and receipt information;

  • Treatment or package purchases; and

  • Limited payment-related information.

Payment-card details may be processed directly by an authorised payment provider rather than stored by us.

Technical and website information

When you use our website or landing pages, we may collect:

  • IP address;

  • Browser and device type;

  • Operating system;

  • Referring page;

  • Pages viewed;

  • Date and time of visits;

  • Advertisement and campaign information;

  • Form and button interactions;

  • Cookie identifiers; and

  • General location information derived from your device or IP address.

Photographs and media

Clinical, before-and-after, testimonial or promotional photographs and videos will only be used for the purposes communicated to you and subject to the appropriate consent.

Where website users are permitted to upload images, they should remove embedded location data, such as EXIF GPS information, before uploading.

3. How we collect personal data

We may collect personal data:

  • Directly from you;

  • From a parent, guardian or authorised representative;

  • Through our website and landing-page forms;

  • Through Meta/Facebook and Instagram Instant Forms;

  • Through WhatsApp, telephone, email or social media;

  • During clinic registration, consultation and treatment;

  • Through cookies, analytics and advertising technologies;

  • Through authorised referral or business partners; and

  • From publicly available sources where permitted by law.

If you provide personal data concerning another person, you confirm that you are authorised to do so and have informed that person about this Privacy Policy.

4. Why we use personal data

We may process personal data to:

  • Respond to enquiries;

  • Contact you through WhatsApp, telephone, SMS or email;

  • Arrange, confirm, reschedule and manage appointments;

  • Recommend an appropriate consultation pathway;

  • Register patients and maintain clinical records;

  • Provide safe medical, aesthetic, skin and wellness services;

  • Communicate pre-treatment and aftercare information;

  • Process payments, invoices and refunds;

  • Manage packages, memberships, promotions and loyalty programmes;

  • Follow up on consultations, treatments and patient experience;

  • Manage feedback, complaints and service recovery;

  • Improve our services, website, landing pages and patient experience;

  • Measure advertising and campaign performance;

  • Prevent fraud, spam, misuse and security incidents;

  • Maintain business and clinical records;

  • Comply with medical, regulatory, tax, accounting and legal obligations;

  • Establish, exercise or defend legal rights; and

  • Send marketing information where consent has been obtained or where otherwise permitted by law.

Where providing information is optional, we will indicate this where reasonably practicable. If required information is not provided, we may be unable to respond to an enquiry, confirm an appointment or provide certain services safely.

5. Meta Instant Forms and social-media enquiries

When you submit a form through Facebook or Instagram, Meta may pre-fill information from your Meta account. Meta processes information according to its own terms and privacy policy.

Information submitted through a NextMed Meta Instant Form may be sent to NextMed so that we can:

  • Respond to your enquiry;

  • Contact you through your selected method;

  • Arrange a consultation or appointment; and

  • Measure campaign and lead performance.

Submitting an enquiry form does not confirm an appointment. A NextMed representative must contact you to confirm availability.

We do not ask users to submit detailed medical histories, identification documents or other unnecessary sensitive information through Meta Instant Forms.

6. WhatsApp and other communication services

If you contact us through WhatsApp or another third-party communication service, that service provider may process your telephone number, profile information, messages, device information and other data according to its own privacy policy.

We may retain relevant communications as part of our enquiry, appointment, customer-service or clinical records.

Please avoid sending highly sensitive medical information through WhatsApp unless requested by an authorised NextMed representative and reasonably necessary for your care.

7. Marketing communications

With your consent, or where otherwise permitted by law, we may send information about:

  • Services and treatments;

  • Educational content;

  • Promotions and campaigns;

  • Events;

  • Appointment reminders; and

  • Relevant NextMed updates.

You may withdraw marketing consent at any time by:

  • Replying “STOP” to an applicable message;

  • Using an unsubscribe link where provided; or

  • Contacting us using the details in Section 17.

Withdrawing marketing consent will not prevent us from sending essential appointment, treatment, safety, payment or administrative communications.

8. Cookies, analytics and advertising technologies

Our website and landing pages may use cookies and similar technologies to:

  • Operate and secure the website;

  • Remember preferences;

  • Prevent spam and fraud;

  • Understand website usage;

  • Measure campaign performance;

  • Improve website functionality; and

  • Deliver or measure relevant advertising.

These technologies may include services provided by Google, Meta and other authorised technology providers, such as Google Analytics, Google Tag Manager, Google Ads and Meta Pixel.

Where required, non-essential advertising and analytics technologies will be used in accordance with applicable consent choices.

You may restrict cookies through your browser settings. Disabling certain cookies may affect website functionality.

9. Comments and embedded content

If comments are enabled and you leave a comment, we may collect the information entered in the comment form, your IP address and browser information to assist with spam detection and website security.

Our website may include embedded videos, maps, images, articles, social-media posts or other content from third parties. Embedded content may behave as if you visited the third party’s website directly. Those third parties may use cookies, collect usage information and monitor interactions according to their own privacy policies.

10. Who we may disclose personal data to

Where necessary and permitted, we may disclose personal data to:

  • NextMed branches, affiliated entities and authorised personnel;

  • Doctors and healthcare professionals involved in your care;

  • Website hosting, IT, cybersecurity and cloud-service providers;

  • Customer relationship management and appointment-system providers;

  • Communication providers, including email, SMS and WhatsApp services;

  • Meta, Google and authorised advertising or analytics providers;

  • Payment processors, banks and financial institutions;

  • Accountants, auditors, insurers, lawyers and professional advisers;

  • Laboratories, pharmacies, suppliers or healthcare partners where required for your care;

  • Regulators, governmental authorities, law-enforcement agencies or courts; and

  • A buyer, investor or successor in connection with a genuine corporate restructuring, merger or transfer, subject to appropriate safeguards.

We require service providers handling personal data on our behalf to use it only for authorised purposes and to apply appropriate safeguards.

We do not sell personal data.

11. International transfers

Some technology, cloud, communication, analytics or advertising providers may process or store information outside Malaysia.

Where personal data is transferred internationally, we will take reasonable steps to ensure that the transfer is permitted under applicable law and that appropriate data-protection safeguards are applied.

12. Data security

We take reasonable administrative, technical and physical measures to protect personal data against:

  • Loss;

  • Misuse;

  • Unauthorised access;

  • Unauthorised disclosure;

  • Alteration; and

  • Destruction.

Access to personal and clinical information is restricted according to role and legitimate business or clinical need.

However, no website, internet transmission or electronic storage system can be guaranteed to be completely secure. Please contact us immediately if you believe your personal data has been compromised.

Where a personal-data breach occurs, we will assess and manage it in accordance with applicable legal and regulatory requirements.

13. Data retention

We retain personal data only for as long as reasonably necessary to:

  • Fulfil the purposes described in this Privacy Policy;

  • Provide medical services and maintain continuity of care;

  • Comply with legal, regulatory, professional, tax and accounting requirements;

  • Resolve disputes and complaints; and

  • Establish, exercise or defend legal claims.

Different categories of information may have different retention periods. Clinical and treatment records may be retained for the period required by applicable laws, regulations and professional standards.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it.

14. Data accuracy

We take reasonable steps to keep personal data accurate, complete and current.

Please inform us if your contact, appointment or other personal information changes or is inaccurate.

15. Your rights

Subject to applicable law and permitted exceptions, you may request to:

  • Access personal data held about you;

  • Correct inaccurate, incomplete or outdated information;

  • Withdraw consent;

  • Stop or limit direct-marketing communications;

  • Obtain information about how your data is processed;

  • Request data portability where applicable; or

  • Make a complaint regarding our processing of personal data.

Certain requests may be restricted where information must be retained for medical, legal, regulatory, security or administrative reasons.

We may need to verify your identity before processing a request. Where an authorised representative submits a request, we may require evidence of authority.

Withdrawal of consent does not affect processing already performed lawfully before the withdrawal.

16. Children and minors

Where services involve a child or person who cannot legally provide consent, personal data should be provided by or with the involvement of a parent, legal guardian or authorised representative, as applicable.

We do not knowingly use a minor’s information for direct marketing without the appropriate consent.

17. Contact us

For questions, requests or complaints concerning this Privacy Policy or your personal data, contact:

NextMed Clinic
Operated by: NM MEDICAL GROUP SDN BHD
Company Registration No.: 879031-P
Address: 8G, JALAN SIMFONI 1, BALAKONG, 43300 SERI KEMBANGAN, SELANGOR D.E.
Email: adminhr@nextmedasia.com
General email: enquiry@nextmedasia.com
Telephone/WhatsApp: +60 11-1968 0688

Please write “Personal Data Request” in the email subject line.

18. Third-party websites

Our website may link to third-party websites, platforms or services. We do not control those third parties and are not responsible for their privacy practices.

Please review the applicable third-party privacy policy before providing personal data.

19. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, business practices or legal obligations.

The revised version will be published on this page with an updated “Last updated” date. Material changes may also be communicated through other reasonable channels.

20. Language

This Privacy Policy may be provided in more than one language. If there is any inconsistency between versions, the English version will prevail to the extent permitted by law.