Privacy Policy

Privacy Policy

Last updated: 21 September 2026

This Privacy Policy explains how ScolioLife® collects, uses, shares, protects and keeps your personal data, including your health data. It applies to our clinics in Singapore, Kuala Lumpur and Surabaya, our websites, our teleconsultations, our Scoliometer and ScolioTrack apps and our online store. It is written to meet the Personal Data Protection Act 2012 of Singapore (PDPA), the Personal Data Protection Act 2010 of Malaysia as amended in 2024, Indonesia's Personal Data Protection Law No. 27 of 2022 (UU PDP), and the UK and EU GDPR for patients who consult us from those countries.

Sections 1 to 10 apply to everyone. Sections 11 to 14 add the rules of the country you are in. Section 15 covers our apps. If a country section says something different from a general section, the country section applies to you.

1. Who we are and who is responsible for your data

ScolioLife® is a group of scoliosis and spine clinics founded by Dr Kevin Lau. The company you deal with depends on where you receive care. That company is the data controller (the "organisation" under Singapore law, the "data user" under Malaysian law and the "pengendali data pribadi" under Indonesian law) for your personal data.

When you are seen at more than one ScolioLife clinic, or a clinician at another ScolioLife clinic reviews your case, the clinics share your clinical record with each other under a written data sharing agreement. Each clinic remains responsible for the data it holds. If you are not sure which entity is responsible for your data, email accounts@scoliolife.com and we will tell you.

2. What this policy covers

• Our clinics in Singapore, Kuala Lumpur and Surabaya, including walk-in enquiries, consultations, care programmes, bracing and follow-up.
• Teleconsultations and remote case reviews, including patients who send us X-rays or photos from another country.
• Our websites, scoliolife.com in all languages and scoliotrack.com, including enquiry forms, booking forms, live chat and WhatsApp links.
• The Scoliometer app and the ScolioTrack app on iOS and Android.
• Our online store, including orders placed through Google Shopping or our own checkout.
• School and community screening events we run, where a separate consent form is also used.
• Our social media pages and the messages you send us on Facebook, Instagram or WhatsApp.

It does not cover websites or apps we link to but do not run, such as Apple, Google, Meta or a payment provider. Their own privacy policies apply there.

3. The personal data we collect

We collect only what we need to assess you, care for you and stay in contact with you. Health data is treated as sensitive data in every country we operate in, and we handle it under the stricter rules in the country sections below.

If a form asks for something not listed here, please tell us at accounts@scoliolife.com. If you send us someone else's data, for example a child's X-ray or a spouse's medical report, you confirm you have the right to do so.

4. Why we use your data and the legal basis

In Singapore, Malaysia and Indonesia our main basis for using your clinical data is your consent (or your parent's consent), given when you register with us. Consent for health data is collected separately and explicitly, and can be withdrawn (see section 9). The GDPR column applies only to UK and EU patients.

We do not sell your personal data, and we do not use your clinical data for advertising.

5. Children and young people

Most of our patients are between 10 and 18. A parent or legal guardian gives consent for anyone under 18 to register, be cared for, have photos or scans taken, or open a ScolioTrack account. We ask for the parent's name, relationship and contact details and may ask for proof. The legal age rules differ slightly by country, and we apply the stricter of our own rule and the local one:

• Singapore — parental consent for under-18s for all clinical data. The PDPC allows a child of 13 to 17 to consent to some digital services alone; we still ask a parent for anything involving health data.
• Malaysia — parental consent for under-18s. Health data is sensitive personal data and needs explicit consent.
• Indonesia — parental or guardian consent for anyone under 18, verified where possible, as required by the PDP Law and its implementing regulation.
• UK and EU — parental consent for under-18s for health data. For the ScolioTrack account itself, a child of 13 (UK) or 16 (most EU countries) may consent alone, but a parent still consents to any health data in it.

A young person can ask to see their own record, and we involve them in decisions about their care in a way that suits their age. When a patient turns 18 they take over the rights their parent held, and we will ask them to confirm their consent at their next visit. The Scoliometer app is designed so it does not need to collect any personal data from anyone, including children. It has no account, no advertising and no tracking.

6. Who we share data with and transfers out of your country

We share personal data only with the people and companies below, only for the purpose stated, and under contracts that require them to protect it. We never give your clinical data to advertisers.

Transfers out of your country

Because our clinics review cases together and our systems are hosted in the cloud, your data may leave the country where you were seen. We do this only where the law allows:

• Singapore — the recipient is bound by contract to a standard of protection comparable to the PDPA, or we have your consent after telling you the risks.
• Malaysia — we transfer only to countries with laws substantially similar to the PDPA, or where the recipient is contractually bound to equivalent protection, or with your consent, following the Commissioner's cross-border transfer guidelines.
• Indonesia — we transfer only to countries the PDP authority recognises as adequate, or under binding safeguards such as standard contractual clauses, or with your consent for a specific transfer.
• UK and EU — see section 14.

You can ask us for a list of the countries your data has been transferred to and the safeguard used.

7. How long we keep your data

We keep data only as long as we need it for the purpose we collected it, or as long as the law requires. Clinical records are kept longer than other data because scoliosis is managed over years and because healthcare record laws set minimum periods.

When a retention period ends we delete the data or anonymise it so it can no longer identify you. Anonymised results may be kept for clinical audit and research.

8. How we protect your data and what happens if there is a breach

We protect your data with encryption in transit and at rest, role-based access so staff see only what their job needs, two-factor login on clinical systems, audit logs on patient records, regular backups, and staff training on confidentiality. Imaging and scans are stored in systems built for medical data, not in general chat or messaging apps.

If a breach happens that is likely to cause you significant harm, we will tell the regulator and you within the time each law sets:

We will tell you what happened, what data was involved, what we have done about it and what you can do to protect yourself. Where the patient is a child we also tell the parent or guardian.

9. Your rights and how to exercise them

You can exercise any of these rights by emailing accounts@scoliolife.com or asking at any clinic. We reply within 30 days (or sooner where the local law requires) and we may ask you to prove your identity first. Requests are free unless they are repetitive or excessive, in which case we will tell you the cost before doing anything.

A parent or guardian can exercise these rights for a child under 18. Once the patient is 18 the request must come from them. To delete a ScolioTrack account, open Settings in the app and choose Delete account, or email us. Deleting the account removes your profile, entries and photos from our servers within 30 days. Subscriptions are managed and cancelled through Apple or Google.

10. Cookies, analytics and marketing

Our websites use cookies and similar technologies. Essential cookies (login, booking session, security) always run. Analytics and advertising cookies run only after you accept them in the cookie banner if you are visiting from the UK or EU, and you can change your choice at any time from the Cookie settings link in the footer. Visitors from other countries can opt out the same way.

Advertising and analytics tags are not loaded on booking confirmation pages, the patient portal, teleconsultation pages or any page you reach after submitting a health enquiry. We do not pass health information, diagnoses or enquiry contents to Meta or Google.

Marketing messages

We send newsletters, offers and educational content only if you opted in. Every email has an unsubscribe link, and every SMS or WhatsApp marketing message tells you how to stop. Appointment reminders, brace review notices and care instructions are part of your care and are not marketing; you will still receive them after unsubscribing.

• Singapore — we follow the Spam Control Act and check the Do Not Call Registry before sending marketing SMS or making marketing calls, unless you have given us clear consent.
• Malaysia — we send marketing only with your consent under section 43 of the PDPA and stop within a reasonable time when you ask.
• Indonesia — we send marketing only with your consent and stop when you withdraw it.
• UK and EU — we follow PECR and the ePrivacy rules; marketing to you needs your opt-in consent.

11. Singapore: Personal Data Protection Act 2012

This section applies if you are a patient of our Singapore clinic, or you use scoliolife.com, scoliotrack.com, our apps or our online store and you are in Singapore.

Organisation. ScolioLife Pte. Ltd., UEN 201531966E, 302 Orchard Road, #10-02 Tong Building, Singapore 238862.

Data Protection Officer. Ratha Ramachandran, accounts@scoliolife.com, +65 8907 8900. The DPO handles all access, correction, withdrawal and complaint requests.

Consent. We collect, use and disclose your personal data with your consent, or with deemed consent where you voluntarily give us data for an obvious purpose such as your care, or under an exception in the PDPA (for example where necessary to respond to an emergency that threatens life or health). We will not require you to consent to more than is reasonable to provide the service. You may withdraw consent by giving us reasonable notice; we will tell you the likely consequences within a reasonable time.

NRIC and FIN. We collect your NRIC or FIN number only where required by law or where it is needed to identify you accurately for medical records and insurance, as permitted by the PDPC's advisory guidelines on NRIC numbers. We do not use it as a general customer ID or store physical copies of your IC.

Access and correction. You have the right to access your personal data and information about how it has been used or disclosed in the past year, and to correct errors. We respond within 30 days; if we cannot, we will tell you when we can. A reasonable fee may apply for access requests and we will tell you first.

Accuracy, protection, retention. We take reasonable steps to keep your data accurate and complete, protect it with reasonable security arrangements, and stop retaining it once the purpose is no longer served and there is no legal or business need (section 7).

Transfer limitation. Data transferred out of Singapore is protected to a standard comparable to the PDPA by contract, binding corporate rules or your informed consent.

Data breach. We assess every suspected breach and notify the PDPC within 3 calendar days if it is likely to result in significant harm or affects 500 or more people, and notify you as well where the harm is significant.

Complaints. Contact our DPO first. If you are not satisfied you may complain to the Personal Data Protection Commission at pdpc.gov.sg.

12. Malaysia: Personal Data Protection Act 2010, as amended in 2024

This section applies if you are a patient of our Kuala Lumpur clinic or you use our websites, apps or store from Malaysia. This notice is provided in English and in Bahasa Malaysia as section 7(3) of the PDPA requires. If the two versions differ, the Bahasa Malaysia version prevails for Malaysian patients.

Data controller. ScolioLife Sdn. Bhd., company no. 202401023193 (1569042-X), Unit 7-6, Level 6, Boulevard Office, Mid Valley City, Lingkaran Syed Putra, 58000 Kuala Lumpur.

Data Protection Officer. Ratha Ramachandran, accounts@scoliolife.com, +60 12-225 5039. Our DPO is registered with the Personal Data Protection Commissioner and is proficient in Bahasa Malaysia and English.

Notice and choice. This notice tells you, as section 7 requires: that your data is being processed and a description of it; the purposes (section 4); your sources (section 3); your rights of access and correction and how to contact us; the classes of third parties we disclose to (section 6); the choices you have to limit processing, including for marketing; and whether supplying the data is obligatory. Identity, contact and clinical data are obligatory for us to care for you. Marketing data is voluntary.

Sensitive personal data. Your physical and mental health data is sensitive personal data under section 40. We process it only with your explicit consent, or where processing is necessary for medical purposes and carried out by a healthcare professional or someone under an equivalent duty of confidentiality, or in another circumstance section 40 allows. Explicit consent is collected on a separate signed or ticked statement at registration.

Your rights. Access (section 30), correction (section 34), withdrawal of consent (section 38), stopping processing likely to cause damage or distress (section 42), stopping direct marketing (section 43), and data portability (section 43A: transfer of your data in a structured, commonly used format to another data controller where technically feasible). We respond to access and correction requests within 21 days. A fee not exceeding the prescribed amount may apply to access requests.

Cross-border transfer. We transfer your data outside Malaysia only under section 129 as amended: to a place with laws substantially similar to the PDPA, or where the recipient is bound to an equivalent level of protection, or with your consent, following the Commissioner's Cross-Border Personal Data Transfer Guidelines.

Data breach. We notify the Commissioner as soon as practicable and within 72 hours of a breach that causes or is likely to cause significant harm, and notify you without unnecessary delay and within 7 days of notifying the Commissioner.

Data processors. Companies that process data for us (section 6) are bound by contract to the same security obligations that apply to us.

Complaints. Contact our DPO first. You may also complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) at pdp.gov.my.

13. Indonesia: Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi

This section applies if you are a patient of our Surabaya clinic or you use our websites, apps or store from Indonesia. This notice is also provided in Bahasa Indonesia; the Bahasa Indonesia version prevails for Indonesian patients.

Pengendali Data Pribadi (controller). PT Prima Postur Solution, Jalan Graha Natura No. 33 Blok DS, Lontar, Sambikerep, Surabaya 60216. Where a clinician from another ScolioLife clinic reviews your case, that clinic's entity acts as a joint controller under a written agreement.

Data Protection Officer. Ratha Ramachandran, accounts@scoliolife.com, +62 812 177 797 78. Because we process health data as a core activity, we have appointed a DPO as Article 53 requires.

Specific personal data. Your health data, biometric data (3D body scans, posture images) and any data about a child are "data pribadi yang bersifat spesifik" under Article 4. We process it only on a lawful basis under Article 20, mainly your explicit, informed consent given in writing or by a recorded electronic act, or where necessary to fulfil our contract to care for you, or to protect your vital interests. Consent for specific data is requested separately from other consents and is not bundled into general terms.

What you are told. As Article 21 requires, before consent we tell you the legality of the processing, its purpose, the types of data, the retention period, details of the data we collect, the period of processing, and your rights.

Children. For anyone under 18, consent is given by the parent or guardian (Article 25 and the implementing regulation). We verify the parent's identity and relationship with the means available to us.

Your rights (Articles 5 to 13). To be told who is processing your data and why; to access and obtain a copy; to correct or update; to end processing, delete or destroy your data; to withdraw consent; to object to automated decisions; to restrict processing; to sue for damages; and to receive your data in a format that can be transferred to another controller. We respond to access and correction requests within 3 x 24 hours of receiving a valid request, and to other requests within the period the implementing regulation sets. Deletion requests for clinical records are honoured once the medical record retention period ends; we will tell you the date.

Cross-border transfer (Article 56). We transfer your data outside Indonesia only where the destination country has a level of protection equal to or higher than Indonesia's, or under binding safeguards such as standard contractual clauses approved for use, or with your consent for a specific transfer.

Data breach (Article 46). We notify you and the PDP authority in writing within 3 x 24 hours of a failure of personal data protection, stating the data affected, when and how it happened, and what we are doing about it.

Implementing regulation. The Government Regulation implementing the PDP Law was issued on 16 July 2026 and takes effect on 16 January 2027. We will update this section when it is in force.

Complaints. Contact our DPO first. You may also complain to the Lembaga Pelindungan Data Pribadi once it is operating, or through the Ministry of Communication and Digital Affairs.

14. United Kingdom and European Union: UK GDPR and EU GDPR

This section applies if you are in the UK or the European Economic Area and you book a teleconsultation, send us imaging for review, travel to one of our clinics, buy from our store, or use ScolioTrack. It applies because we offer services to people in these countries, even though none of our clinics is located there.

Controller. The ScolioLife entity you book with (section 1). For scoliolife.com, scoliotrack.com and the apps, it is ScolioLife Pte. Ltd., Singapore.

Lawful bases. Set out in section 4. Health data is special category data. We rely on Article 9(2)(h) (provision of health care by a professional bound by confidentiality) for your care, and on your explicit consent under Article 9(2)(a) for teleconsultations across borders, case studies and anything outside direct care. You can withdraw explicit consent at any time.

International transfers. Your data is transferred to and stored in Singapore, Malaysia or Indonesia, none of which holds a UK or EU adequacy decision. For your care we rely on Article 49(1)(a), your explicit consent to the transfer after being told of the risks, and where our suppliers hold your data we use Standard Contractual Clauses (EU) or the International Data Transfer Agreement or Addendum (UK) with a transfer risk assessment. You can request a copy of the safeguards from accounts@scoliolife.com.

Your rights. Access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal or similarly significant effect (we make none). We respond within one month, extendable by two months for complex requests. Requests are free.

Retention. As section 7, using the retention period of the clinic that cared for you.

Cookies. Analytics and advertising cookies are set only after you accept them in the banner (section 10).

Breach. We notify the ICO or your national supervisory authority within 72 hours of becoming aware of a breach that risks your rights, and you without undue delay where the risk is high.

Complaints. UK: Information Commissioner's Office, ico.org.uk. EU: your national data protection authority; a list is at edpb.europa.eu. We would appreciate the chance to resolve any concern first at accounts@scoliolife.com.

15. Mobile apps: Scoliometer and ScolioTrack

Scoliometer measures trunk rotation using your phone's motion sensors. It is a screening aid and does not diagnose scoliosis; a reading does not replace a clinical examination or X-ray. The app does not require an account and does not collect your name, email, location or contacts. Readings are stored on your device only. If you choose Share, the reading leaves the device through the sharing option you pick (email, messaging, and so on) and we do not receive it unless you send it to us. Anonymous crash reports are sent to our crash-reporting provider so we can fix bugs; they contain no reading data.

ScolioTrack needs an account so your progress can be saved and restored on a new device. We collect what section 3 lists. Photos you add stay in your account and are not used for anything else. Subscriptions are billed by Apple or Google; we receive only a subscription status, never your card details. You can delete your account from Settings inside the app, and everything is removed from our servers within 30 days.

Permissions. Scoliometer asks for motion sensor access. ScolioTrack asks for camera and photo library access when you add a photo, and for notifications if you want reminders. Neither app asks for location, contacts or microphone.

App store disclosures

Our App Store privacy labels and Google Play Data Safety form say the following, and we keep them in line with the apps' actual behaviour:

16. Contact, complaints and changes to this policy

Data Protection Officer: Ratha Ramachandran, ScolioLife®
Email: accounts@scoliolife.com
Singapore: +65 8907 8900, 302 Orchard Road, #10-02 Tong Building, Singapore 238862
Kuala Lumpur: +60 12-225 5039, Unit 7-6, Level 6, Boulevard Office, Mid Valley City, 58000 Kuala Lumpur
Surabaya: +62 812 177 797 78, Jalan Graha Natura No. 33 Blok DS, Sambikerep, Surabaya 60216

If you are unhappy with how we handled a request, tell the DPO and we will escalate it to Dr Kevin Lau, Founder and Director. You can also contact your regulator, listed in the country sections, at any time.

We review this policy at least once a year and whenever the law or our services change. The date at the top is the date of the current version. If a change affects how we use your clinical data or reduces your rights, we will tell you by email or in the app before it takes effect, and where the law requires it we will ask for your consent again. Earlier versions are available on request.

This policy is published in English and in the other languages of scoliolife.com. For patients in Malaysia and Indonesia the Bahasa Malaysia and Bahasa Indonesia versions prevail; for everyone else the English version prevails.

Frequently Asked Questions

Do I have to give you my NRIC, MyKad or KTP number?

Only when it is needed for your medical record, an insurance claim or an invoice that requires it. For a general enquiry or a newsletter sign-up we never ask for it.

Can I ask you to delete my child's X-rays and photos?

You can withdraw consent at any time. Clinical records, including imaging, have to be kept for the minimum period set by healthcare law in the country where your child was seen (section 7). Photos taken only for marketing or case studies are deleted on request straight away.

Does the Scoliometer app send my readings to ScolioLife?

No. Readings stay on your phone. Nothing reaches us unless you use the Share button to send a reading to us yourself.

Will a clinician in another country see my file?

Only if a ScolioLife clinician at another clinic is asked to review your case, which we state in your registration consent, or if you move between our clinics. The transfer follows the cross-border rules in section 6 for your country.

How do I stop marketing emails but keep appointment reminders?

Click Unsubscribe in any newsletter. Reminders and care instructions are sent separately and continue until you tell us to stop those too.

How do I delete my ScolioTrack account?

In the app, open Settings and choose Delete account, or email accounts@scoliolife.com. Your data is removed from our servers within 30 days. Cancel any subscription through Apple or Google first, as deleting the account does not cancel billing.

Who do I complain to if I am not happy with your answer?

The PDPC in Singapore, the Personal Data Protection Commissioner in Malaysia, the Lembaga PDP in Indonesia, or the ICO or your national authority in the UK and EU. Contact details are in sections 11 to 14.