Personal Data Protection Policy

Health in Asia

Last updated: 12 August 2026

Health in Asia ("HiA", "we", "us", "our") is operated by Big Fundamental Pte Ltd, a company incorporated in Singapore. The privacy of your personal data matters to us. We are committed to handling it in accordance with the Personal Data Protection Act 2012 of Singapore (the "PDPA") and the Personal Data Protection Commission (“PDPC”)'s Advisory Guidelines for the Healthcare Sector.

This policy explains what personal data we collect, why we collect it, how we use and disclose it, and the choices you have about how we handle it. It applies to everyone who interacts with us: readers of our editorial content, patients using our Care Concierge service, vendors and partners, and visitors to our websites and channels.

By interacting with us, visiting our websites, subscribing to our newsletter, messaging our Care Concierge team, or otherwise engaging with our services, you agree to the collection, use, and disclosure of your personal data as set out in this policy.

This policy is read alongside our Terms of Use and Editorial Policy, and forms part of the framework that governs how we work.

1. What we mean by personal data

For the purposes of this policy, "personal data" means any data, whether true or not, about an individual who can be identified from that data, or from that data combined with other information we have or are likely to have access to.

Depending on how you interact with us, the personal data we collect may include one or more of the following:

• Identification and contact information, such as your name, email address, telephone number, country of residence, and nationality.
• Health and medical information, such as symptoms you describe, conditions you have been diagnosed with, test results you share, current medications, treatment history, the specialty of care you are seeking, and your preferences for care (language, gender of practitioner, hospital affiliation). This category of information is treated with particular care and is covered in Section 4 below.
• Family and proxy information, such as where you are arranging care on behalf of a family member or another person, in which case we collect information about that person as well as your relationship to them. 
• Information about minors, where you are a parent or legal guardian arranging care for a child. Section 5 below explains how we handle such information.
• Financial information, where relevant to a service we provide, such as insurance provider and policy details, or payment details where you transact with us directly.
• Account and profile information, where you create an account on any of our platforms, including username, password, preferences, and account history. 
• Communications, including emails, WhatsApp messages, chat transcripts, voice notes, and call recordings exchanged with our representatives.
• Device and technical information, such as IP address, device type, browser type and version, operating system, referring page, and other information collected automatically when you visit our websites or use our digital channels.

We may also collect anonymised data, which is data that cannot be used to identify to you, used for analytics and service improvement. We will take reasonable steps to prevent re-identification of all anonymised information and, if such information is re-identified, to protect it as we do your personal data.

If you provide us with personal data about a third party, for example a family member you are arranging care for, you confirm and warrant that you have obtained that person's consent to share their data with us for the purposes set out in this policy.

2. How we collect personal data

We collect personal data in three ways.

Directly from you, for instance when you:

• Subscribe to our newsletter or create an account on our platforms.
• Contact our Care Concierge team through WhatsApp, email, our websites, or any other channel.
• Complete an intake form, share a medical history, or send us test results.
• Provide feedback, leave comments, or respond to a survey.
• Apply for a role with us, or engage with us as a vendor or partner.
• Attend an event we host or participate in.

Automatically, such as when you visit our websites or use our digital channels, through cookies, web beacons, and similar technologies (described in Section 10 below).

Indirectly, from third parties, in limited circumstances, including:

• From specialists, clinics, or other parties within our care network, where you have been referred to us or where we are coordinating care on your behalf.
• From your authorised representative, for example a family member acting for you, provided they have your consent to share your information with us.
• From publicly available sources. 

Where you voluntarily provide your personal data to us e.g. directly or automatically, you may be deemed to have consented to our collection, use or disclosure of such data for the purposes set out at Section 3 below. 

Where we collect personal data about you indirectly from third parties, we will take steps to confirm that your consent has been obtained for that data to be shared with us, for the purposes set out at Section 3 below, where required by the PDPA. 

3. Why we collect personal data

We collect, use, and disclose personal data for the following purposes:

To provide and improve our editorial content, including delivering articles and newsletters, understanding what content is read and shared, and developing new content that benefits our readers.

To operate our Care Concierge service, including:

• Obtaining a broad understanding of your circumstances and concerns through intake conversations.
• Providing you with a list of suggested  specialists in our network for diagnosis and treatment based on our understanding of your condition, your preferences, and our knowledge of those specialists.
• Arranging appointments, coordinating between you and the specialist, clinic or any other relevant party in our care network, and handling related logistics.
• Following up on the status of and collecting feedback on a referral, booking and/or engagement.

To communicate with you, including responding to enquiries, sending service updates, and providing newsletters or marketing communications you have subscribed to.

To process feedback and complaints, including investigating concerns you raise about our service or about a specialist in our care network.

To handle administrative and operational matters, including billing (where applicable), vendor management, insurance claims, and internal record-keeping.

To comply with legal and regulatory obligations, including responding to lawful requests from regulators, courts, or law enforcement.

To analyse and improve our services, including understanding how our websites are used, identifying patterns in the questions readers and patients bring to us, and refining the editorial and concierge experience.

To detect, prevent, and address misuse, including security incidents, fraud, and breaches of our Terms of Use.

We will not use your personal data for any purpose materially different from those listed above without first seeking your consent, unless we are permitted or required to do so by law.

4. Health and medical information

The Care Concierge service involves collecting and sharing information about your health. We treat this information with particular care, and we collect, use, and disclose it on the basis of your express consent.

How we collect your express consent. When you first engage the Care Concierge team, we will ask you to confirm your consent to our collection, use and disclosure of your health information. This consent is captured through a short intake form on our websites that you will be required to complete before your communications with the Care Concierge team, with a follow-up confirmation in your first exchange with the Care Concierge team. We keep a record of your consent, including the version of the consent language you agreed to and the date you agreed. 

What we collect. Health information typically includes your symptoms, current or suspected conditions, treatment history, medications, and any test results or referral letters you choose to share with us. We also collect your preferences for care, such as language, gender of practitioner, or hospital affiliation.

What we use it for. We use health information to help you find appropriate care. This includes understanding your situation accurately, matching you to specialists who are suitable for your specific condition, and coordinating the referral. We may also use the information to improve our services so that we may better serve you in future referrals. 

Who we share it with, and when. When you proceed with a referral to a specific specialist, we will ask for your consent to share your health information with that specialist and their clinic or organisation. We share only what is reasonably necessary for the appointment to be useful.  

The specialist becomes an independent controller of your information. Once we share your health information with a specialist or clinic with your consent, that specialist or clinic becomes an independent controller of the information they receive. They will handle that information under their own privacy obligations, including the Singapore Medical Council Ethical Code and Ethical Guidelines, the Healthcare Services Act 2020 of Singapore, the PDPA and any other applicable laws and regulations. We are not responsible for how they handle your information after that point, though we will assist you in raising any concerns with them.

We are not your medical provider. The Care Concierge team helps you find appropriate care. We do not provide medical advice, diagnosis, or treatment. Health information you share with us is collected for the purpose of matching and coordination, not for any clinical decision-making by HiA.

Withdrawing consent. You can ask us to stop using your health information at any time, in line with Section 12 below. Withdrawal of consent may affect our ability to continue assisting you with a referral or follow-up.

5. Our policy on minors

The Care Concierge team may be approached on behalf of a minor, typically by a parent or legal guardian seeking a paediatric specialist or other care for the minor.

Where the patient is under 18, a parent or legal guardian must be the person engaging the Care Concierge team and providing consent on the minor's behalf. We rely on the parent or guardian's representation that they have the legal authority to consent to the collection, use, and disclosure of the minor's personal data.

We take particular care with health information about minors. Where the minor is under 13 years old, we apply additional safeguards in line with the PDPC's Advisory Guidelines on the PDPA for Children’s Personal Data in the Digital Environment. Records relating to minors are retained on a longer schedule than records relating to adults, as set out in our retention schedule (Section 13 below).

If you are a minor and have engaged with us directly, please ask a parent or legal guardian to contact us so we can ensure your data is handled appropriately.

6. Our commercial model and your data

HiA only earns a patient management fee from specialists in our network when a HiA user engages the Care Concierge team and proceeds with a booking through us. We are compensated for our work done in intake, matching, scheduling, communications and logistics support, and follow-up.

We emphasise that HiA is not remunerated in any way for the transfer of your data. Your data will only be shared with a specialist for the purpose of receiving care, and is not itself the subject of a commercial transaction between HiA and the specialist.

For more information on our commercial model, please refer to our Editorial Policy, where we explain our fee structure and how it does not influence who we recommend to you.

7. Who we share personal data with

We may share your personal data with the following categories of recipients, where necessary for the purposes set out in Section 3:

Specialists, clinics and other parties in our care network, where you have engaged the Care Concierge team and given your separate consent to a specific referral (see Section 4).

Service providers and processors we engage to operate our business, including hosting providers, email and messaging platforms, analytics providers, customer support tools, and payment processors. We require these providers to handle personal data in accordance with the PDPA and to use it only for the purposes we have engaged them for.

Professional advisers, such as our lawyers, accountants, and auditors, where necessary for the operation of our business or to meet legal obligations.

Regulators, law enforcement, and courts, where we are required by law to disclose personal data, or where disclosure is necessary to protect our rights, your safety, or the safety of others.

Successors in interest, in the event of a merger, acquisition, restructuring, or sale of all or part of our business, in which case personal data may be transferred as part of that transaction, subject to the recipient agreeing to handle it in a manner consistent with this policy. Where the transaction involves health information specifically, we will seek your continued consent or anonymise the information before transfer, except where transfer is required by law.

We do not sell, rent, or licence your personal data to third parties for their own marketing purposes.

8. Transfers of personal data outside Singapore

Your personal data may be transferred out of Singapore in situations such as where our service providers are based or travel out of Singapore, or where we use data intermediaries to store and process data on servers outside of Singapore. In such cases, we will take steps to protect your data as required by the PDPA. This includes imposing legally enforceable obligations on the recipient to safeguard your data or relying on recognised digital safety certifications to ensure your personal data continues to receive a standard of protection comparable to the PDPA.

A list of the jurisdictions in which our main service providers operate is available on request from our Data Protection Officer.

For patients based outside Singapore. The Care Concierge team serves patients based across the region, including expatriates and patients travelling to Singapore for care from countries such as Indonesia, Malaysia, and elsewhere. If you engage the Care Concierge team from outside Singapore, your personal data will be collected and processed in Singapore, and you consent to that processing by engaging us.

You may also have additional rights under the data protection laws of your home jurisdiction. We are happy to discuss those rights with you. Where required, we will work with you to honour them alongside your rights under the PDPA.

9. Marketing communications

If you have subscribed to our newsletter or otherwise opted in to receive marketing communications from us, we may contact you with content, updates, and information about our services. You can unsubscribe at any time using the link in any marketing email, or by writing to our Data Protection Officer (see Section 16).

A note on WhatsApp and SMS messages. The Care Concierge team communicates with you over WhatsApp and, where relevant, SMS. These messages are operational, sent in connection with the service you have engaged us for. They are not marketing communications. We will only send marketing or promotional messages over WhatsApp or SMS where you have consented to it.

We do not pass your contact details to third parties for their own marketing purposes. You may however provide consent to the specialist or clinic at the point of booking to collect or use your personal data for their marketing communications.

10. Cookies, analytics, and similar technologies

Our websites use cookies, web beacons, and similar technologies to:

• Make the site work and remember your preferences.
• Understand how the site is used, so we can improve it.
• Measure the performance of our content and our marketing.

You can disable cookies in your browser settings. Doing so may affect some functionality on our sites. When you first visit our sites, our cookie banners will offer you the option to accept or decline non-essential cookies. 

Where our third-party analytics providers collect information on our behalf, we will take steps to ensure that they will safeguard your personal data at a standard of protection comparable to the PDPA, whether based on their own privacy policies or our contractual arrangements with them (See Sections 7 and 8 above).

11. Reviewing the specialist's own privacy policy

When you proceed with a referral, the specialist or clinic you are referred to will handle your information under their own privacy policy. We encourage you to review that policy at the point of your booking with the specialist or clinic. If you would like help locating the policy, our Care Concierge team can assist you.

12. Withdrawing consent

You can withdraw your consent to our collection, use, or disclosure of your personal data at any time, by writing to our Data Protection Officer at the contact details set out in Section 16.

Once we receive your request, we will take reasonable steps to process it, typically within 10 business days. We will inform you about the likely consequences of withdrawal, such as where we can no longer continue to assist you with a Care Concierge team referral.

Withdrawal of consent does not affect the legality of our collection, use and disclosure of your personal data prior to the withdrawal. We may also continue with collection, use and disclosure of personal data where it is required or authorised under the PDPA or any other written law, including to comply with our data retention obligations under the PDPA (See Section 13 below).

13. Access, correction, and retention

Access and correction. You have the right to ask:

• For some or all of your personal data in our possession or control.
• About the ways in which your personal data has been or may have been used or disclosed by us within the year before the date of your request.
• That we correct personal data of yours that is inaccurate or incomplete.

Requests should be sent in writing to our Data Protection Officer. We will respond as soon as reasonably possible, and within 30 days where possible. If we cannot respond within 30 days, we will let you know when we expect to respond.

We may charge a reasonable fee for processing an access request, and we will tell you the fee before we process the request. There are limited circumstances in which we may be unable to provide access or make a correction, such as where an exception under the PDPA applies. We will inform you of our general grounds for refusing any access request. 

Retention. We will retain personal data for as long as one or more of the purposes for which it was collected remains valid, including where retention is necessary to handle an active complaint, regulatory enquiry, or legal claim.

When personal data is no longer needed, we securely delete it or anonymise it.

14. How we protect personal data

We take reasonable steps to protect personal data against unauthorised access, disclosure, modification, and loss. These include:

• Restricting access to personal data to staff or service providers on a need-to-know basis.
• Using encryption for data in transit and at rest where appropriate.
• Maintaining up-to-date security software, including firewalls and anti-virus tools.
• Securing physical and digital workspaces.
• Reviewing our security practices regularly.

We maintain a data protection management programme that includes a written breach response plan, vendor due diligence procedures, and a retention schedule, reviewed regularly.

15. Data breaches

Upon being alerted to a data breach, we will assess if the breach is a notifiable breach under the PDPA in an expeditious manner and generally within 30 calendar days. 

If the data breach is a notifiable breach, we will notify the PDPC and any affected individuals as soon as practicable, so that you can take steps to protect yourselves, unless an exception under the PDPA applies. We will notify the PDPC no later than 3 calendar days after we determine that the breach is notifiable, and will notify relevant affected individuals at the same time or after notifying the PDPC.

16. Our Data Protection Officer

You can contact our Data Protection Officer with any questions about this policy, any request relating to your personal data, or any concerns about how we have handled it.

Data Protection Officer Big Fundamental Pte Ltd (Health in Asia) 

Email: dpo@healthinasia.com  

Address: 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051 

We treat all complaints and enquiries about personal data seriously and will endeavour to respond to you within a reasonable time.

17. Changes to this policy

We may update this policy from time to time. Where changes are significant, we will inform you through our websites, email, or other appropriate means.

Where you have given consent in respect of a previous version of this policy, your continued use of our services after a change to this policy will constitute acceptance of the updated policy. Where a change of the policy materially affects how we collect, use, or disclose your personal data, we will seek your consent to the updated terms before relying on them.

18. Governing law

This policy is governed by the laws of Singapore. Any dispute arising in connection with this policy is subject to the exclusive jurisdiction of the Singapore courts, save that you may first contact our Data Protection Officer to seek a resolution.