WellthyWELLTHYOnline store
Back to Wellthy Store

Mobile App Policy

Privacy Policy

Wellthy Healthcare Mobile App — Malaysia and Singapore

Wellthy Healthcare Sdn Bhd · Company No. 202301016274 (1510196-H)

Effective Date: 7 September 2026

Wellthy Healthcare Sdn Bhd (Company No. 202301016274 (1510196-H)) ("Wellthy Healthcare", "we", "us" or "our") is committed to protecting the personal data of users of the Wellthy Healthcare mobile app (the "App"). This Privacy Policy is issued in accordance with the Personal Data Protection Act 2010 ("PDPA") of Malaysia and explains how we collect, use, disclose, store and protect your personal data.

By accessing or using the App, you consent to the practices described in this Privacy Policy. A separate Privacy Policy (Website) applies where you use our website.

1. Personal Data We Collect

We may collect the following categories of personal data from you:

  • Identification and contact data: full name, NRIC/passport number, date of birth, gender, email address, mailing address and phone number.
  • Account data: username, password (encrypted), account preferences and profile information.
  • Payment and financial data: billing address, bank account details, e-wallet details and transaction records processed through our payment partners (Stripe, Atome, PrestoPay). We do not store full payment card numbers ourselves; these are processed and stored by our payment processors.
  • Programme data: purchase/spend history, store link sharing and the sales generated through your store link, WE Reward point balances and expiry dates, StarWell Entry Deposit and stage progress, referral records, and withdrawal/refund/redemption requests. WE Reward points and store link data is collected for all customers who earn points, including non-members; VIP Membership and StarWell data applies only to enrolled Members.
  • Location data: precise or approximate location (e.g. for delivery, store locator or fraud-prevention purposes), where you have enabled location services.
  • Health-related preference data: information you voluntarily provide about skin type, health concerns or product preferences to help us recommend healthcare or skincare products.
  • Usage and device data: IP address, device identifiers, browser type, operating system, pages viewed, referral URLs, and app interaction data collected via analytics and cookies.
  • Communications: records of correspondence when you contact our customer support.

2. Device Permissions

To provide certain features, the App may request the following device-level permissions. You may grant or deny each permission through your device settings; declining a permission may limit related features but will not prevent you from using the App generally.

  • Camera: to scan barcodes/QR codes, upload photos for support requests (e.g. showing a damaged item), or take profile pictures.
  • Contacts: to enable referral invitations and friend-finding features, where you choose to use them.
  • Push notifications: to send order updates, promotional offers, and account or programme notifications. You may disable these at any time in your device settings.
  • Precise location (GPS): to support delivery address accuracy, store/outlet locator features, and fraud prevention.

The App does not request biometric data (such as Face ID) for authentication; any device-native biometric login is handled entirely by your device's operating system and is never transmitted to or stored by us.

3. How We Collect Personal Data

  • Directly from you, when you register an account, place an order, enrol in or participate in the VIP Membership or StarWell Programme, or contact customer service.
  • Automatically, through cookies, SDKs and analytics tools when you use the App.
  • From third parties, such as our payment processors (Stripe, Atome, PrestoPay) and delivery partners, to the extent necessary to fulfil your orders and transactions.

4. Purposes of Processing

We use your personal data to:

  • Create and manage your account and verify your identity.
  • Process orders, payments, deliveries, refunds and exchanges.
  • Operate the VIP Membership, the WE Rewards Programme and the StarWell Programme (including the Referral Cash Reward Programme), including calculating and crediting WE Reward points and cash rewards, applying point expiry, and processing Entry Deposit refund/redemption requests, in accordance with their terms and conditions.
  • Provide customer support and respond to enquiries or complaints.
  • Send transactional communications (order confirmations, delivery updates, account notices).
  • With your consent, send marketing communications and promotional offers, which you may opt out of at any time.
  • Improve the App through analytics, and detect, investigate and prevent fraud, abuse or security incidents.
  • Comply with legal, regulatory and tax obligations, including any applicable requirements under the Direct Sales and Anti-Pyramid Scheme Act 1993 or relating to e-money/payment services in Malaysia.

5. Disclosure of Personal Data

We may disclose your personal data to:

  • Payment processors and gateways (Stripe, Atome, PrestoPay) to process transactions.
  • Logistics and courier partners to fulfil deliveries.
  • Analytics and IT service providers who process data on our behalf under confidentiality obligations.
  • Professional advisers, auditors and regulators (including the Ministry of Domestic Trade and Cost of Living (KPDNHEP) or other relevant authorities), where required by law or to comply with regulatory obligations relating to the VIP Membership or StarWell Programme.
  • A successor entity in the event of a merger, acquisition or sale of business assets.

We do not sell your personal data to third parties for their own marketing purposes.

6. Cookies, Analytics and Advertising

The App uses cookies, SDKs and similar technologies to recognise you, remember preferences, and understand how the App is used. The third-party SDKs currently integrated into the App are our payment processors (Stripe, Atome, PrestoPay). We do not currently use any third-party analytics or advertising SDKs; if this changes, we will update this Privacy Policy and, where required, request your permission before doing so. You may disable non-essential cookies and tracking through your device settings, but some features of the App may not function properly as a result.

The App does not track you across other companies' apps or websites for advertising purposes, and we do not use any SDK for cross-app or cross-site ad tracking. If this changes in the future, we will request your permission via Apple's App Tracking Transparency (ATT) prompt before doing so on iOS devices, in accordance with Apple's requirements, and will update this Privacy Policy accordingly.

7. Sensitive Personal Data

Some of the information you may choose to provide — such as skin type, health concerns, or product preferences relevant to healthcare and skincare recommendations — may constitute sensitive personal data under the PDPA. We only collect and process this category of data with your explicit consent, obtained separately from your general consent to this Privacy Policy (for example, via a specific consent checkbox or prompt at the point of collection). You may withdraw this consent at any time, which may limit our ability to provide personalised product recommendations.

8. Data Security

We implement reasonable technical and organisational security measures — including encryption of payment data by our payment processors, access controls and secure storage — to protect your personal data against unauthorised access, loss, misuse or alteration. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in significant harm to you, we will notify the Personal Data Protection Commissioner and affected users without undue delay, in accordance with the PDPA and its relevant regulations, and will take reasonable steps to contain and remediate the breach.

10. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, including to satisfy legal, accounting, tax or regulatory requirements (for example, records relating to the VIP Membership or StarWell Programme may be retained for the statutory limitation period). We will delete or anonymise personal data when it is no longer required.

11. Your Rights

Under the PDPA, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate or incomplete data.
  • Withdraw consent to processing (which may affect our ability to provide certain services, including the VIP Membership or StarWell Programme).
  • Request that we limit or stop processing your data for direct marketing purposes.

To exercise these rights, please contact us using the details in Section 15. We may require proof of identity before processing your request, and we may charge a nominal processing fee as permitted under the PDPA.

12. Account and Data Deletion

Deleting your account will permanently remove your profile and personal data, except where we are required to retain certain records (such as transaction, tax, or VIP/WE Rewards/StarWell programme records) to comply with legal or regulatory obligations, in which case such data will be retained only for as long as necessary and in accordance with Section 10 above. Please note that deleting your account also forfeits all remaining WE Reward points immediately, with no cash or in-kind compensation and no possibility of reinstatement. You are advised to redeem any remaining points before deleting your account.

13. Children's Privacy

The App is not directed at, and is not intended for use by, children under the age of 13, and participation in purchases, the VIP Membership, or the StarWell Programme requires you to be at least 18 years old. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us so we can delete it.

14. Cross-Border Transfer

The App serves customers in both Malaysia and Singapore, and your personal data may be processed or stored on servers located outside your country of residence, including by our payment and analytics service providers. Where this occurs, we take reasonable steps to ensure such transfers comply with the PDPA and that comparable data protection standards are maintained.

15. Contact Us

If you have questions, requests or complaints about this Privacy Policy or how we handle your personal data, please contact:

Wellthy Healthcare Sdn Bhd (Company Registration No. 202301016274 (1510196-H))

C-2-01, Level 2, Capital 3, Oasis Square L, No. 2, Jalan PJU 1A/7A, Ara Damansara, 47301 Petaling Jaya, Selangor, Malaysia

Email: info@wellthy.com.my

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on the App with a revised effective date. Continued use of the App after such changes constitutes acceptance of the updated Privacy Policy.