Who this policy covers
MM Care Group Sdn Bhd ("MM Care Group", "we", "us") operates Poliklinik MM FamilyCare & Surgeri in Mutiara Rini together with ten Klinik MM Care branches across Johor, offering both medical and dental services.
The same policy applies at every branch and to this website, whether your visit is for a medical consultation or dental treatment. It covers patients, the parents or guardians who bring them, company clients who send staff to us for medical or dental services, and anyone who contacts us through the website form or by phone.
We handle personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA), and we treat medical and dental records with the additional duty of confidentiality expected of registered medical and dental practitioners.
Information we collect
We only ask for what we need to treat you safely and to run the clinic properly.
| Type of information |
Examples |
| Identity and contact details |
Full name, NRIC or passport number, date of birth, gender, address, phone number, email, emergency contact |
| Medical and dental information |
Symptoms, diagnosis, allergies, medication history, dental charting, X-rays and treatment notes, test and screening results, immunisation records, treatment and referral notes |
| Payment information |
Billing name, amounts charged and paid, receipt records, insurance or panel scheme details |
| Employment or panel details |
Employer name and staff number, where your visit is covered by a company panel arrangement |
| Website information |
What you type into our enquiry form, plus basic technical data such as browser type and pages visited |
Where it comes from
Most of it comes directly from you at registration or during consultation. Some may come from a parent or guardian, from your employer under a panel arrangement, from an insurer, or from another clinic, hospital or laboratory involved in your care.
Why we use your information
- To identify you correctly and keep an accurate medical record
- To diagnose, treat, prescribe for and follow up on your medical or dental condition
- To refer you to a specialist, dentist, hospital or laboratory when needed
- To issue medical certificates, receipts, invoices and insurance or panel claims
- To contact you about appointments, test results and follow-up visits
- To take part in national immunisation and public health screening programmes
- To meet legal duties, including notifiable disease reporting and record-keeping requirements
- To answer enquiries you send through this website or by phone
We do not sell your personal data, and we do not use your medical information for advertising.
Who we share it with
Your record stays within MM Care Group unless there is a clear reason to share it. We may disclose information to:
- Other MM Care branches, so a doctor at any of our clinics can treat you safely
- Hospitals, specialists and laboratories we refer you to, limited to what they need for your care
- Pharmacies and medical suppliers, where dispensing requires it
- Your insurer or your employer's panel administrator, limited to what is needed to process a claim you have asked us to submit
- Government health authorities, where reporting is required by law, such as notifiable diseases and immunisation records
- Our service providers, such as clinic management system and IT support vendors, who are bound to keep the data confidential
- Courts or regulators, where we are legally compelled to produce records
Where a disclosure is not covered above, we ask for your consent first.
Storage and retention
Records are held in our clinic systems and in secure physical files at the branch you attended. Data is stored in Malaysia. If a service provider ever needs to process data outside Malaysia, we make sure it is protected to a standard equal to what the PDPA requires.
We keep medical records for as long as needed for your continuing care and to meet retention periods set by Malaysian healthcare regulations — normally at least seven years from your last visit, and longer for minors. Financial and claim records are kept for the period required by tax and company law. Enquiry form messages are kept for up to two years unless they become part of a patient record.
Keeping your data safe
- Access is limited to clinic staff who need the record to do their job
- Systems are password-protected, with individual staff accounts
- Paper records are kept in locked storage at the branch
- All staff sign confidentiality undertakings as a condition of employment
- Records are backed up regularly, and old paper files are destroyed securely
No system is completely immune to risk. If a breach happens that affects your data, we will act to contain it and tell you and the relevant authority where required.
Your rights
Under the PDPA you may:
- Ask for a copy of the personal data we hold about you
- Ask us to correct anything inaccurate, incomplete or out of date
- Withdraw consent for uses that are not required for your treatment or by law
- Limit how we contact you, for example asking us to stop appointment reminders by SMS
- Ask a question or complain about how we have handled your data
Write to us using the details in section 11. We may ask you to verify your identity before we release anything, and we aim to respond within 21 days. A small fee may apply to a request for copies of records, as allowed under the PDPA.
Withdrawing consent for information we need to treat you may limit the care we can safely provide. We will explain the effect before acting on your request.
Website, forms and cookies
The enquiry form on our Contact Us page sends what you type to our head office so we can reply. Please do not use it to send detailed medical information — call the branch or come in instead.
Cookies
This site uses only what is needed to display pages correctly and to load fonts and icons hosted by third parties. We do not run advertising trackers. You can block or delete cookies in your browser settings; the site will still work.
Links to other sites
Where we link out to a government health portal or another organisation, their own privacy policy applies once you leave our site.
Children and dependants
For patients under 18, we collect information from and communicate with a parent or legal guardian. The same applies to adult patients who have a lawfully appointed representative. A child's record is kept confidential in the same way as any other patient record.
Changes to this policy
We update this policy when our practices, systems or legal duties change. The date at the top of the page shows the current version. Significant changes will also be displayed at our clinic counters.
Contact our data officer
For any question, access request or complaint about personal data, contact:
If you are not satisfied with our response, you may refer the matter to the Personal Data Protection Commissioner of Malaysia.
