Healthway Medical Group Mobile App Privacy Policy

Effective date: 30 July 2026
Last updated: 30 July 2026

1. About This Privacy Policy

Healthway Medical Group Pte Ltd (“Healthway Medical Group”, “Healthway”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, store, protect, retain and delete personal data when you use the Healthway Medical Group mobile application on Android or iOS (the “App”) and the healthcare and related services available through it.

This Privacy Policy applies specifically to the App. It should be read together with any applicable terms of service, consent forms, clinical notices and other notices presented when you use a particular Healthway service.

The organisation responsible for the App is:

Healthway Medical Group Pte Ltd
6 Shenton Way
#10-09 OUE Downtown 2
Singapore 068809

For privacy enquiries, contact our Data Protection Officer at dpo@healthwaymedical.com.

2. Personal Data We Collect

The personal data we collect depends on the features and services you use.

2.1 Account and contact information

We may collect:

Full name
Email address
Mobile or telephone number
Date of birth
Sex
Residential or delivery address
Account credentials and authentication information
Communication preferences
Profile photograph

2.2 Identity and verification information

Where required to verify your identity, create an account, provide healthcare services or comply with legal requirements, we may collect or process:

NRIC, FIN or passport information
Singpass information
Identity-document images
Other information required to authenticate or verify you

When you use Singpass, information is processed in accordance with the applicable Singpass terms and privacy notices. We only receive information made available through the authorised authentication or identity-verification process.

2.3 Information about dependants

An adult account holder may add a child or another eligible person as a dependant.

We may collect the dependant’s:

Name
Date of birth
Sex
Relationship to the account holder
Identification information
Contact information, where applicable
Medical and appointment information
Other information needed to provide healthcare services

The adult account holder is responsible for having the necessary authority to provide a dependant’s information and to manage healthcare services on the dependant’s behalf.

2.4 Medical and health information

When you use healthcare services through the App, we may collect and process sensitive medical and health information, including:

Medical history
Symptoms and reasons for seeking care
Allergies
Current and previous medications
Appointment and consultation information
Diagnoses and clinical observations
Prescriptions and medication information
Test results and medical documents
Treatment and referral information
Information about healthcare professionals and clinics involved in your care
Photographs, documents or other information you choose to upload
Information generated during or in connection with a consultation

Medical information is processed only where necessary to provide healthcare services, maintain medical records, support continuity of care, protect patient safety, and comply with applicable healthcare requirements.

2.5 Location information

With your permission, the App may access precise or approximate device location to provide location-related features, such as identifying nearby healthcare services, supporting appointments or visits, and enabling other location-based functionality requested by you.

You may disable location permission through your device settings. Some location-dependent features may then be unavailable.

2.6 Camera, photographs and microphone

With your permission, the App may access your camera, photographs, files or microphone to:

Participate in video or audio consultations
Capture or upload profile photographs
Upload identity documents
Upload medical documents, images or supporting information
Access other App features that require these permissions

Video consultations are facilitated using Agora. Healthway does not record the audio or video content of consultations conducted through the App. Medical notes or other clinical records created separately by the healthcare professional may still be retained as part of the patient’s medical record.

You may disable camera, photograph or microphone permissions through your device settings, but features requiring those permissions may no longer function.

2.7 Payment and transaction information

When you make a payment or save a payment method, we may collect or process:

Payment status
Transaction amount
Transaction date and time
Billing information
Payment-method identifiers or tokens
Refund and payment history
Information needed to investigate unsuccessful or disputed transactions

Payment-card processing is provided through Stripe. Payment information submitted through Stripe may be processed directly by Stripe in accordance with its privacy policy and security requirements.

2.8 Device, technical and usage information

When you use the App, we may automatically collect or receive:

Device identifiers
Device type, model and operating-system version
Internet Protocol address
App version
Push-notification token
Login dates and times
App screens viewed and features used
Interaction and event information
Network and connection information
Diagnostic information
Crash and error information
App performance and security logs

We use this information to operate, secure, troubleshoot, analyse and improve the App.

2.9 Information from authentication providers

If you sign in using Google Sign-In or Singpass, we may receive information authorised through that provider, such as your name, email address, account identifier or verified identity information.

The information available to us depends on the provider, the permissions requested and the choices you make.

2.10 Communications

If you contact us, submit an enquiry or request support, we may collect:

Your contact details
The content of your enquiry
Information needed to verify your identity
Support correspondence
Records of actions taken in response to your request

Please do not send passwords, complete payment-card numbers, unnecessary medical documents or government identification documents through ordinary email.

3. How We Use Personal Data

We may use personal data to:

Create, authenticate and manage App accounts
Verify identities and prevent unauthorised access
Manage dependant profiles
Arrange, manage, reschedule and cancel appointments
Facilitate in-person and remote consultations
Provide healthcare, prescription, referral and related services
Maintain accurate medical and treatment records
Enable communication between patients, clinics and healthcare professionals
Process payments, refunds and transaction enquiries
Provide notifications about appointments, consultations, medications, services and account activity
Respond to questions, complaints, support enquiries and privacy requests
Personalise relevant App content and functionality
Monitor App performance and resolve technical problems
Conduct analytics and understand how the App is used
Detect, investigate and prevent fraud, abuse, security incidents and unlawful activity
Protect patients, users, healthcare professionals and Healthway
Establish, exercise or defend legal claims
Comply with applicable healthcare, accounting, tax, regulatory and legal requirements
Send marketing communications where permitted by law and according to your communication preferences

We will not use medical or other sensitive personal data for targeted advertising.

4. Marketing Communications

Where permitted by law, we may send promotional information about Healthway services through email, SMS or push notification.

You may opt out of marketing communications by:

Using an unsubscribe link provided in an email
Following the opt-out instructions in an SMS
Changing the relevant notification or communication settings
Disabling promotional push notifications through your device settings
Contacting us at dpo@healthwaymedical.com

Opting out of marketing does not prevent us from sending necessary service communications, such as appointment reminders, account-security notices, payment information, clinical messages or changes affecting your use of the App.

The App does not display third-party advertising and we do not use your personal data for targeted advertising.

5. When We Share Personal Data

We do not sell or rent personal data to third parties for their marketing purposes.

We may disclose personal data where reasonably necessary to the following recipients.

5.1 Healthcare providers

Personal data may be disclosed to:

Healthway clinics and related healthcare entities
Doctors, nurses, allied health professionals and other persons involved in your care
Laboratories, pharmacies, referral providers and other healthcare service providers
Persons authorised by you or legally permitted to act on your behalf

5.2 Related companies

We may share personal data with Healthway-related entities where necessary to provide services, manage operations, protect users, respond to enquiries or comply with applicable requirements.

5.3 Technology and service providers

We use service providers to support App functions. Depending on the feature used, information may be processed by:

Google Firebase Analytics, for App usage and analytics
Firebase Cloud Messaging, for push-notification delivery
Google Sign-In, for authentication
Singpass, for identity authentication and authorised identity information
Stripe, for payment processing
Agora, for real-time audio and video consultation functionality

We may also use providers supporting security, communications, infrastructure, professional advice and other operational services.

Service providers are permitted to process information only for the relevant services and subject to applicable contractual, confidentiality, security and legal requirements. Each provider may also process information under its own applicable privacy policy.

5.4 Legal and regulatory disclosures

We may disclose personal data:

When required or authorised by law
To healthcare, data-protection, law-enforcement, judicial or regulatory authorities
To respond to a court order, legal process, investigation or lawful request
To protect a person’s health, safety or vital interests
To investigate fraud, security incidents or unlawful activity
To establish, exercise or defend legal rights

5.5 Business changes

If Healthway undergoes a merger, acquisition, restructuring, financing, transfer or sale of part of its business or assets, relevant personal data may be disclosed to professional advisers and involved parties, subject to appropriate confidentiality and data-protection requirements.

6. International Processing and Transfers

Some of our technology and service providers operate in multiple countries. Personal data processed through services such as Google, Stripe or Agora may therefore be transferred to or processed outside Singapore.

Where personal data is transferred outside Singapore, we take reasonable steps to ensure that the recipient is subject to legally enforceable obligations or other safeguards providing a standard of protection comparable to that required under Singapore’s Personal Data Protection Act 2012.

The locations used by individual providers may change according to their infrastructure, service configuration and contractual arrangements.

7. Data Security

We maintain reasonable administrative, physical and technical safeguards designed to protect personal data against:

Unauthorised access
Improper collection, use or disclosure
Loss or theft
Unauthorised copying or modification
Accidental or unlawful destruction
Other similar risks

Measures may include access controls, authentication, encryption where appropriate, security monitoring, staff confidentiality obligations and restrictions limiting access to persons who require the information for authorised purposes.

No electronic system or transmission method is completely secure. Users should protect their account credentials, use a secure device and notify us if they suspect unauthorised access.

8. Data Retention

We retain personal data only for as long as reasonably necessary to:

Provide the App and healthcare services
Fulfil the purposes described in this Privacy Policy
Maintain continuity and safety of care
Comply with healthcare, regulatory, accounting, tax and legal requirements
Resolve complaints and disputes
Detect or prevent fraud and security incidents
Establish, exercise or defend legal claims

Retention periods vary according to the type of information and the reason it was collected.

8.1 Active accounts

While an account remains active, we retain the information needed to operate the account, provide requested services, maintain records, process transactions and comply with applicable requirements.

8.2 Deleted accounts

Once a verified account-deletion request is completed:

The user’s mobile-app account is permanently deleted and can no longer be accessed.
App-specific information that is no longer needed is deleted or irreversibly anonymised from active App systems within seven days.
Limited account details and deletion-request records may be retained for up to one year where necessary to document and verify the deletion, prevent fraud, maintain security, resolve disputes or comply with legal and legitimate business requirements.
Retained information is not used to maintain an active App account or send marketing communications.
Unless a longer period is legally required, information retained for these limited purposes is deleted or irreversibly anonymised after the one-year period.

8.3 Medical records

Deleting the App account does not require Healthway to delete medical records that must be retained for patient safety, continuity of care or legal and regulatory compliance.

Medical records and personal data forming part of those records are retained according to applicable Singapore laws, licence conditions and Ministry of Health requirements and guidelines.

Access to retained medical information is restricted to authorised purposes. When retention is no longer required, the information is securely deleted or anonymised.

8.4 Transaction and legal records

Payment, transaction, accounting, fraud-prevention, security, complaint and legal records may be retained after account deletion for the periods required by applicable law or reasonably necessary for the relevant legal or business purpose.[Text Wrapping Break][Text Wrapping Break]

8.5 Anonymised information

We may retain aggregated or irreversibly anonymised information that can no longer reasonably identify an individual. Such information may be used for statistics, service planning, security, analytics and App improvement.

9. Account and Data Deletion

Users may request permanent deletion of their Healthway Medical Group App account and associated App data through the App or without using the App.

9.1 Requesting deletion from within the App

Sign in to the Healthway Medical Group App.
Open Account.
Select Support.
Select Delete Mobile Account.
Review the deletion information.
Confirm Yes, delete my account.

9.2 Requesting deletion without the App

Email dpo@healthwaymedical.com with the subject:

Healthway Medical Group App Account Deletion Request

Include:

The name registered to the account
The registered email address
The registered mobile number

Do not include passwords, complete payment-card numbers, medical documents or identity-document images in the initial email.

This external method can be used if the App has been uninstalled, the user cannot sign in or the user does not wish to reinstall the App.

9.3 Verification and processing

To protect accounts against unauthorised deletion, we may contact the requester and ask for reasonable information to verify their identity.

Verified deletion requests are normally completed within seven days. We will notify the requester if additional information is required or if a legal requirement prevents the deletion of particular information.

Deleting an account is permanent account deletion, not temporary deactivation or freezing.

9.4 Information deleted and retained

Following deletion:

The mobile-app account can no longer be accessed.
App-specific information is deleted or anonymised as described in Section 8.
Medical records and related personal data may be retained according to applicable healthcare requirements.
Transaction, security, fraud-prevention, accounting and legal records may be retained where required.

After deletion is completed, the user may create a new account using the same email address. Medical records lawfully retained from previous healthcare services may still remain within Healthway’s clinical record systems.

10. Children and Dependants

A person must be at least 18 years old to create and manage an App account.

Minors are not permitted to create their own accounts. A parent, legal guardian or another authorised adult may add a minor as a dependant and use the App to arrange or manage healthcare services for the minor.

The adult must have the legal authority to provide the minor’s information and make decisions through the App on the minor’s behalf.

If we become aware that a minor has created an account without appropriate adult involvement, we may suspend or delete the account and take reasonable steps to address the information, subject to healthcare record-retention requirements.

Parents and legal guardians may contact dpo@healthwaymedical.com regarding a dependant’s personal data.

11. Your Choices and Privacy Requests

Subject to applicable law and relevant exceptions, you may contact us to:

Request access to personal data held about you
Request correction of inaccurate or incomplete personal data
Withdraw consent for particular uses of personal data
Change marketing preferences
Ask questions about how personal data has been used or disclosed
Request deletion of the App account and associated App data
Raise a privacy concern or complaint

Withdrawing consent may affect our ability to provide features or healthcare services that require the relevant information.

We may need to verify your identity before responding to a request. Medical-record access and correction requests may also be subject to clinical, legal and regulatory requirements.

12. Device Permissions

You can manage permissions such as location, camera, photographs, microphone and notifications through your mobile-device settings.

Disabling a permission does not delete information already provided or lawfully retained. It may prevent the corresponding App feature from working.

13. Third-Party Websites and Services

The App may contain links to websites, payment services, identity providers or other services operated by third parties.

Their privacy practices are governed by their own notices and are not controlled by this Privacy Policy. We encourage users to review the applicable third-party privacy policies before providing information.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to:

The App or its features
Our data-handling practices
Service providers
Legal or regulatory requirements
Security or operational needs

The revised policy will be published with an updated “Last updated” date. Where appropriate, we may provide additional notice through the App or another communication channel.

Continued use of the App after an update is subject to the revised Privacy Policy, except where additional consent is required by law.

15. Contact Us

For privacy questions, requests, complaints or App account deletion, contact:

Data Protection Officer
Healthway Medical Group Pte Ltd
6 Shenton Way
#10-09 OUE Downtown 2
Singapore 068809

Email: dpo@healthwaymedical.com

When contacting us, provide sufficient information for us to understand and respond to your request, but do not send passwords, complete payment-card numbers or unnecessary medical or identity documents through ordinary email.