Privacy Policy

Privacy Policy

Last updated: 5 June 2026

This Privacy Policy explains how ScolioLife Pte Ltd ("ScolioLife", "we", "us" or "our") collects, uses, discloses, protects and retains your personal data. ScolioLife is based in Singapore and processes personal data under Singapore's Personal Data Protection Act 2012. For individuals in the United Kingdom, we handle your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Health data is "special category data" requiring additional protection.

1. Personal Data We Collect

We collect personal data you provide directly, data generated when you use our website, and health data created during your clinical care. This may include:

  • verifiedIdentity and contact data — name, date of birth, postal address, email, telephone and WhatsApp number, and emergency contact details.
  • verifiedSpecial category data (health data) — medical history, symptoms, posture and spinal assessments, Cobb-angle measurements, X-rays and imaging, photographs, ScolioAlign™ brace fitting data, and clinician notes, processed for the provision of health care and with your explicit consent where required.
  • verifiedTransaction and payment data — products and services purchased and billing details. Card details are handled by our payment providers and not stored by ScolioLife.
  • verifiedTechnical data — IP address, browser type, device identifiers, pages visited, and other diagnostic data collected through cookies.

2. How We Use Your Data and Our Lawful Bases

We process your personal data only where we have a lawful basis under the UK GDPR. Our bases include consent, performance of a contract, our legitimate interests, and compliance with legal obligations; for health data we rely on the provision of health care or your explicit consent. Purposes include providing clinical care (assessment, scoliosis correction programmes, ScolioAlign™ brace fitting and progress monitoring), managing appointments and accounts, processing orders and payments, improving our services, marketing with your consent (you may opt out at any time), and meeting our legal obligations.

3. Your Rights

Under the UK GDPR you have the right to be informed, and to access, rectification, erasure, restriction of processing, data portability, and to object to processing, as well as the right to withdraw consent. Email our Data Protection Officer at support@scoliolife.com. We will respond within one month. Some rights are qualified (for example, erasure does not apply where we must retain medical records by law).

4. Consent and Withdrawal

Where we rely on your consent, you may withdraw it at any time by contacting our Data Protection Officer. Withdrawal does not affect processing carried out before withdrawal, and withdrawing consent essential to your care may affect the services we can provide.

5. Security of Your Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include access controls, need-to-know restrictions, secure storage, and encryption of payment transactions through our providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Retention of Your Data

We retain personal data only for as long as necessary for the purposes described, or as required by law. As a healthcare provider we are required to retain medical records for a minimum period set by Singapore law (at least 6 years from the last clinical entry, and longer for the records of minors). When data is no longer needed we securely erase or anonymise it.

7. Disclosure and International Transfer

We do not sell your personal data. We disclose it to processors acting on our behalf (IT and website hosting, analytics such as Google Analytics, payment processing such as Stripe, and email delivery such as Mailchimp) under contracts limiting their use of the data, and where required by law. As ScolioLife operates from Singapore, your personal data is transferred to and processed in Singapore and, where your care is coordinated, at our clinics in Kuala Lumpur (Malaysia) and Surabaya (Indonesia). Such international transfers are protected by appropriate safeguards such as standard contractual clauses.

8. Personal Data Breaches

We maintain procedures to detect, assess and respond to personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours, and will inform affected individuals where the risk is high.

9. Cookies and Tracking

We use cookies and similar technologies to operate the website, remember your preferences, and analyse traffic. You can refuse some or all cookies through your browser. The main cookies we use are essential cookies (e.g. WordPress, WooCommerce), analytics cookies (e.g. Google Analytics), and preference cookies (e.g. WPML, Mailchimp).

10. Children and Young People

Scoliosis often develops during adolescence, so many of our patients are minors. Where we process a patient's data under the age of 18, we do so to provide care and with the consent of a parent or legal guardian. We do not knowingly collect data directly from a child through our website without parental or guardian involvement.

11. Data Protection Officer and How to Contact Us

ScolioLife has appointed a Data Protection Officer (DPO) responsible for data protection compliance. For any question, to exercise your rights, or to make a complaint, contact:

  • verifiedData Protection Officer, ScolioLife Pte Ltd
  • verifiedEmail: support@scoliolife.com
  • verifiedAddress: Tong Building, 302 Orchard Road #10-02, Singapore 238862
  • verifiedOnline: scoliolife.com/en_UK/contact-us

If we cannot resolve your concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy here and revise the "Last updated" date above. We encourage you to review this page periodically.

Frequently Asked Questions

Does ScolioLife comply with the UK GDPR?

Yes. We handle personal data in accordance with the UK GDPR and the Data Protection Act 2018, and treat health data as special category data.

How do I exercise my data rights?

Email support@scoliolife.com. We respond within one month. Some rights are qualified, such as erasure where we must retain medical records by law.

How long does ScolioLife keep my medical records?

At least the minimum required by Singapore law (a minimum of 6 years from the last clinical entry, and longer for minors), after which records are securely erased or anonymised.

Is my data transferred internationally?

Yes. As ScolioLife is based in Singapore, your data is transferred to and processed in Singapore, protected by appropriate safeguards such as standard contractual clauses.

Who do I contact about privacy?

Our Data Protection Officer at support@scoliolife.com. You can also complain to the ICO at www.ico.org.uk.