Privacy Policy

Last updated: 5 June 2026

This Privacy Policy explains how ScolioLife Pte Ltd ("ScolioLife", "we", "us" or "our") collects, uses, discloses, protects and retains your personal data. ScolioLife is based in Singapore and processes personal data under Singapore's Personal Data Protection Act 2012. For individuals in India, we handle your personal data in accordance with the Digital Personal Data Protection Act 2023 (DPDP Act) and the Digital Personal Data Protection Rules 2025. In this policy, ScolioLife acts as a Data Fiduciary and you are the Data Principal.

1. Personal Data We Collect

We collect personal data you provide directly, data generated when you use our website, and health data created during your clinical care. This may include:

Identity and contact data — name, date of birth, postal address, email, telephone and WhatsApp number, and emergency contact details.
Health data — medical history, symptoms, posture and spinal assessments, Cobb-angle measurements, X-rays and imaging, photographs, ScolioAlign™ brace fitting data, and clinician notes, collected with your consent for your care.
Transaction and payment data — products and services purchased and billing details. Card details are handled by our payment providers and not stored by ScolioLife.
Technical data — IP address, browser type, device identifiers, pages visited, and other diagnostic data collected through cookies.

2. How and Why We Use Your Data (Notice and Purpose)

We process your personal data only for the lawful purposes for which it was collected and for which you have been given notice. These include providing clinical care (assessment, scoliosis correction programmes, ScolioAlign™ brace fitting and progress monitoring), managing appointments and accounts, processing orders and payments, improving our services, marketing with your consent (you may opt out at any time), and meeting our legal obligations.

3. Consent and Its Withdrawal

We process your personal data on the basis of your free, specific, informed and unambiguous consent, or for legitimate uses permitted under the DPDP Act. You may withdraw your consent at any time with the same ease as giving it, by contacting our Data Protection Officer. On withdrawal we will cease processing for the relevant purpose unless required by law; withdrawing consent essential to your care may affect the services we can provide.

4. Your Rights as a Data Principal

Under the DPDP Act you have the right to access a summary of your personal data, to correct, complete, update and erase it, to grievance redressal, and to nominate another person to exercise your rights. Email our Data Protection Officer at support@scoliolife.com. We will respond within a reasonable period. Erasure is subject to legal exceptions, including medical record-retention requirements.

5. Security of Your Data

We implement reasonable security safeguards to protect your personal data and to prevent a personal data breach, including access controls, need-to-know restrictions, secure storage and encryption of payment transactions through our providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Retention of Your Data

We retain personal data only for as long as necessary for the stated purpose, or as required by law. As a healthcare provider we are required to retain medical records for a minimum period set by Singapore law (at least 6 years from the last clinical entry, and longer for the records of minors). When data is no longer needed we erase it.

7. Disclosure and Transfer of Your Data

We do not sell your personal data. We disclose it to Data Processors acting on our behalf (IT and website hosting, analytics such as Google Analytics, payment processing such as Stripe, and email delivery such as Mailchimp) under contracts limiting their use of the data, and where required by law. As ScolioLife operates from Singapore, your personal data is transferred to and stored in Singapore and, where your care is coordinated, at our clinics in Kuala Lumpur (Malaysia) and Surabaya (Indonesia), with safeguards in place.

8. Personal Data Breach

We maintain procedures to detect, assess and respond to personal data breaches. In line with the DPDP Act and Rules, in the event of a personal data breach we will notify the Data Protection Board of India and each affected Data Principal, with the prescribed details and within the prescribed time.

9. Cookies and Tracking

We use cookies and similar technologies to operate the website, remember your preferences, and analyse traffic. You can refuse some or all cookies through your browser. The main cookies we use are essential cookies (e.g. WordPress, WooCommerce), analytics cookies (e.g. Google Analytics), and preference cookies (e.g. WPML, Mailchimp).

10. Children and Young People

Scoliosis often develops during adolescence, so many of our patients are minors. Where we process the personal data of a child (under 18), we obtain verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. We do not knowingly collect data directly from a child through our website without parental or guardian involvement.

11. Data Protection Officer and How to Contact Us

ScolioLife has appointed a Data Protection Officer (DPO) responsible for privacy compliance and grievance redressal. For any question, to exercise your rights, or to raise a grievance, contact:

Data Protection Officer, ScolioLife Pte Ltd
Email: support@scoliolife.com
Address: Tong Building, 302 Orchard Road #10-02, Singapore 238862
Online: scoliolife.com/en_IN/contact-us

If your grievance is not resolved, you may approach the Data Protection Board of India.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy here and revise the "Last updated" date above. We encourage you to review this page periodically.

Frequently Asked Questions

Does ScolioLife comply with India's DPDP Act?

Yes. We process personal data in accordance with the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, acting as a Data Fiduciary.

What are my rights as a Data Principal?

Access to a summary of your data, correction and erasure, grievance redressal, and the right to nominate someone to exercise your rights. Email support@scoliolife.com.

How long does ScolioLife keep my medical records?

At least the minimum required by Singapore law (a minimum of 6 years from the last clinical entry, and longer for minors), after which records are erased.

Can I withdraw my consent?

Yes, at any time with the same ease as giving it, by contacting our Data Protection Officer, subject to legal retention requirements.

Who do I contact about privacy?

Our Data Protection Officer at support@scoliolife.com. Unresolved grievances can be raised with the Data Protection Board of India.