PDPA Notice

This notice is issued by Axtra Health Sdn Bhd (Company Registration No. 1646544-K), of No. 26, Jalan Eko Botani 2E, Persiaran Eko Botani 2, Taman Eko Botani 2, Iskandar Puteri, 79100 Johor Bahru, Johor Darul Ta'zim, Malaysia ("Axtra Health"), in accordance with the Notice and Choice Principle under section 7 of the Personal Data Protection Act 2010 ("PDPA"). It applies to personal data processed when you create an account, complete a health assessment, or use a consultation, protocol, or fulfilment pathway on the Theo & Thea platform.

This notice sets out what the PDPA requires us to tell you. For a fuller, plain-language explanation of our data practices, see our Privacy Policy.

1. Classes of personal data processed

• Personal and contact data: name, date of birth, sex, email address, phone number.
• Sensitive personal data: health assessment answers, medical history, current medications and allergies, consultation notes, prescription and protocol records, and any health documents you upload.
• Delivery data: pickup or delivery choice, recipient name, phone number, and address where delivery is chosen.
• Payment-related data: bank transfer/DuitNow reference details and proof-of-payment files, for manual payment verification only. We do not collect card or online banking login credentials.
• Technical data: IP address and basic access logs collected automatically by our hosting and authentication infrastructure.

2. Purposes of processing

• Creating and administering your account.
• Routing your assessment to a licensed pharmacist and, where clinically appropriate, a licensed doctor, for independent professional review.
• Enabling compounding, dispensing, and delivery or pickup of your order by our licensed pharmacy partners.
• Verifying and reconciling manual payments.
• Sending operational communications about your account, orders, consultations, and refills.
• Maintaining the security and audit trail of the platform, and meeting our legal and regulatory record-keeping obligations as a healthcare platform.

3. Source of your personal data

We collect personal data directly from you when you register, fill in an assessment, book a consultation, place an order, or contact us. We do not purchase personal data from third parties.

4. Classes of third parties data may be disclosed to

• The pharmacist and, where applicable, the doctor assigned to review your case, and the licensed pharmacy that compounds or dispenses your order — currently Amber Pharmacy Sdn Bhd (see Professional partners for the current list, which may grow over time).
• Courier partners, where you choose delivery rather than self-pickup.
• Our cloud infrastructure and email service providers, who process data on our behalf as data processors and are contractually restricted from using it for their own purposes.
• Malaysian regulators or courts, where required by law.

We do not disclose your personal data to any other third party, including for marketing purposes, without your separate explicit consent.

5. Cross-border transfer

Some of our infrastructure providers may process or store data on servers located outside Malaysia. Where this occurs, we take reasonable steps consistent with section 129 of the PDPA to ensure your data continues to receive comparable protection.

6. Your rights and choices

You have the right to:

• Request access to the personal data we hold about you.
• Request correction of any inaccurate or incomplete personal data.
• Withdraw your consent to our processing of your personal data at any time.
• Limit the processing of your personal data.

To exercise any of these rights, contact admin@axtrahealth.com. We will respond within 21 days as required by the PDPA and may need to verify your identity first.

7. Consequence of not providing your data

Providing your personal and health data is necessary for us to create your account and for a pharmacist or doctor to review your assessment. If you do not provide the data requested, we may be unable to create your account, process your assessment, or fulfil your order.

8. Marketing

We do not use your health data for marketing. Where we send you product or service updates unrelated to your active care, this is only with your separate, explicit opt-in, and you may withdraw that consent at any time by emailing admin@axtrahealth.com.

9. Versioned consent

Your acceptance of this notice is recorded against its version and the date you agreed to it. If we make a material change to this notice, we will ask you to review and re-confirm your consent to the updated version.

10. Contact

Questions about this notice, or requests relating to your personal data, can be sent to admin@axtrahealth.com.