WellthyWELLTHYOnline store
Back to Wellthy Store

Website Policy

Privacy Policy

Wellthy Healthcare Website — Malaysia and Singapore

Wellthy Healthcare Sdn Bhd · Company No. 202301016274 (1510196-H)

Effective Date: 7 September 2026

Wellthy Healthcare Sdn Bhd (Company No. 202301016274 (1510196-H)) ("Wellthy Healthcare", "we", "us" or "our") is committed to protecting the personal data of users of the Wellthy Healthcare website (the "Website"). This Privacy Policy is issued in accordance with the Personal Data Protection Act 2010 ("PDPA") of Malaysia and explains how we collect, use, disclose, store and protect your personal data.

By accessing or using the Website, you consent to the practices described in this Privacy Policy. A separate Privacy Policy (Mobile App) applies where you use our mobile app.

1. Personal Data We Collect

We may collect the following categories of personal data from you:

  • Identification and contact data: full name, NRIC/passport number, date of birth, gender, email address, mailing address and phone number.
  • Account data: username, password (encrypted), account preferences and profile information.
  • Payment and financial data: billing address, bank account details, e-wallet details and transaction records processed through our payment partners (Stripe, Atome, PrestoPay). We do not store full payment card numbers ourselves; these are processed and stored by our payment processors.
  • Rewards programme data: WE Reward point balances, earning history and expiry dates arising from your Website orders, and records of orders placed through a store link (including the sharer's reward). Base WE Reward points are earned on Website orders by all customers, though they may only be redeemed through our mobile app. Where you hold VIP status obtained via the app, we also process your VIP status and spend records in order to credit your Website orders toward your VIP threshold and to attribute store link sales correctly. VIP self-purchase discounts are not applied to Website orders. The StarWell Programme is offered exclusively through the mobile app and no StarWell data is processed in connection with Website use.
  • we process your VIP status and spend records in order to credit your Website orders toward your VIP threshold and to attribute store link sales correctly. VIP self-purchase discounts are not applied to Website orders
  • Location data: the delivery address you provide, and — where you grant permission via your browser's location prompt — your precise geolocation, used for store locator features, delivery address suggestions, and fraud-prevention purposes. If location permission is not granted, we may still infer your approximate location from your IP address or manually entered postcode.
  • Health-related preference data: information you voluntarily provide about skin type, health concerns or product preferences to help us recommend healthcare or skincare products.
  • Usage and device data: IP address, device/browser identifiers, browser type, operating system, pages viewed, referral URLs, and website interaction data collected via analytics and cookies.
  • Communications: records of correspondence when you contact our customer support.

2. Browser Location Permission

The Website may ask your browser to request permission to access your device's precise location (geolocation), for example to suggest a delivery address or show nearby store locations. Your browser will prompt you separately for this permission; you may allow or deny it, and may change your choice at any time in your browser settings. Declining this permission will not prevent you from using the Website, though some location-based features may be limited.

3. How We Collect Personal Data

  • Directly from you, when you register an account, place an order, or contact customer service.
  • Automatically, through cookies, SDKs and analytics tools when you use the Website.
  • From third parties, such as our payment processors (Stripe, Atome, PrestoPay) and delivery partners, to the extent necessary to fulfil your orders and transactions.

4. Purposes of Processing

We use your personal data to:

  • Create and manage your account and verify your identity.
  • Process orders, payments, deliveries, refunds and exchanges, and calculate and credit WE Reward points earned on your Website orders in accordance with the WE Rewards Programme Terms and Conditions.
  • Provide customer support and respond to enquiries or complaints.
  • Send transactional communications (order confirmations, delivery updates, account notices).
  • With your consent, send marketing communications and promotional offers, which you may opt out of at any time.
  • Improve the Website through analytics, and detect, investigate and prevent fraud, abuse or security incidents.
  • Comply with legal, regulatory and tax obligations applicable to online retail and e-money/payment services in Malaysia.

5. Disclosure of Personal Data

We may disclose your personal data to:

  • Payment processors and gateways (Stripe, Atome, PrestoPay) to process transactions.
  • Logistics and courier partners to fulfil deliveries.
  • Analytics and IT service providers who process data on our behalf under confidentiality obligations.
  • Professional advisers, auditors and regulators, where required by law.
  • A successor entity in the event of a merger, acquisition or sale of business assets.

We do not sell your personal data to third parties for their own marketing purposes.

6. Cookies and Analytics

The Website uses cookies, SDKs and similar technologies to recognise you, remember preferences, and understand how the Website is used. Third-party services currently integrated into the Website are our payment processors (Stripe, Atome, PrestoPay). We do not currently use any third-party analytics or advertising tracking tools; if this changes, we will update this Privacy Policy. You may disable non-essential cookies through your browser settings, but some features of the Website may not function properly as a result.

7. Sensitive Personal Data

Some of the information you may choose to provide — such as skin type, health concerns, or product preferences relevant to healthcare and skincare recommendations — may constitute sensitive personal data under the PDPA. We only collect and process this category of data with your explicit consent, obtained separately from your general consent to this Privacy Policy. You may withdraw this consent at any time, which may limit our ability to provide personalised product recommendations.

8. Data Security

We implement reasonable technical and organisational security measures — including encryption of payment data by our payment processors, access controls and secure storage — to protect your personal data against unauthorised access, loss, misuse or alteration. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in significant harm to you, we will notify the Personal Data Protection Commissioner and affected users without undue delay, in accordance with the PDPA and its relevant regulations, and will take reasonable steps to contain and remediate the breach.

10. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, including to satisfy legal, accounting, tax or regulatory requirements. We will delete or anonymise personal data when it is no longer required.

11. Your Rights

Under the PDPA, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate or incomplete data.
  • Withdraw consent to processing, which may affect our ability to provide certain services.
  • Request that we limit or stop processing your data for direct marketing purposes.

To exercise these rights, please contact us using the details in Section 15. We may require proof of identity before processing your request, and we may charge a nominal processing fee as permitted under the PDPA.

12. Account and Data Deletion

You may request deletion of your account and associated personal data at any time via your Account Settings page, or by contacting us using the details in Section 15. We will action deletion requests within 5 business days, except where we are required to retain certain records (such as transaction or tax records) to comply with legal or regulatory obligations, in which case such data will be retained only for as long as necessary and in accordance with Section 10 above.

13. Children's Privacy

The Website is not directed at, and is not intended for use by, children under the age of 13, and making a purchase requires you to be at least 18 years old. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us so we can delete it.

14. Cross-Border Transfer

The Website serves customers in both Malaysia and Singapore, and your personal data may be processed or stored on servers located outside your country of residence, including by our payment and analytics service providers. Where this occurs, we take reasonable steps to ensure such transfers comply with the PDPA and that comparable data protection standards are maintained.

15. Contact Us

If you have questions, requests or complaints about this Privacy Policy or how we handle your personal data, please contact:

Wellthy Healthcare Sdn Bhd (Company Registration No. 202301016274 (1510196-H))

C-2-01, Level 2, Capital 3, Oasis Square L, No. 2, Jalan PJU 1A/7A, Ara Damansara, 47301 Petaling Jaya, Selangor, Malaysia

Email: info@wellthy.com.my

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on the Website with a revised effective date. Continued use of the Website after such changes constitutes acceptance of the updated Privacy Policy.