Privacy policy

What we collect

We collect only what you choose to give us, plus the ordinary technical records any web server keeps.

• Details you submit in the brochure form: your name, email address and contact number. Your company or clinic and your enquiry are optional, and the form works without them.
• Messages you send us on WhatsApp: your number and whatever you decide to tell us. That conversation takes place on WhatsApp, so it is also subject to their terms.
• Technical records kept by our hosting provider: IP address, browser type, the pages requested and the time of the request.
• If a form submission cannot be delivered to us, the details you submitted are recorded in our server logs so that we can answer you by hand rather than losing your enquiry. Those log entries are retained for up to 2 weeks.
• One cookie, named brochure_access, set when you submit the brochure form. It is httpOnly, so no script on the page can read it, it expires after 30 minutes, and it exists only to authorise the download it unlocks.

What we do not collect

There is no analytics or advertising code on this site, no third-party trackers, and no advertising cookie. We do not create visitor profiles and we do not sell personal data.

We do not ask for, and do not want, payment card details or any health information about you or your patients through this site. Please do not send clinical or patient information through the enquiry form or by WhatsApp.

Why we use it

We use personal data for these purposes and no others.

• To send you the brochure you asked for, and to unlock the download.
• To answer your enquiry, including by WhatsApp if that is where you contacted us.
• To keep the site working and secure: diagnosing faults, understanding failed submissions, and preventing abuse of the form.
• To meet our legal and accounting obligations, where they apply.

Our basis for processing

When you submit the form or message us, you consent to us using those details to respond to you. You can withdraw that consent at any time, and withdrawing it means we stop, but it does not affect anything we did with your data before you withdrew it.

We also process the technical records described above because we have a legitimate interest in keeping the site available and secure, and because the law requires us to keep some records.

Who else sees it

We do not sell personal data, and we do not share it for anyone else to advertise to you. It reaches the following service providers, who process it on our instructions and only for the purposes above.

• Our hosting provider, which serves this site and keeps the request logs.
• Our workflow automation and database providers, which deliver a form submission to us and store it so that it can be answered.
• WhatsApp, when you choose to message us there. That message travels through their systems under their own terms before it reaches us.

Where it is processed

Our service providers operate internationally, so your data may be processed outside Malaysia. Where that happens, we rely on the providers we use to protect it to the standard this policy describes.

How long we keep it

Enquiry details are kept as long as we need them to answer you and any follow-up that comes from it, and are then deleted. If you ask us to delete them sooner, we will.

The log entry describing a failed submission is kept for up to 2 weeks and then discarded with the rest of our platform logs. The download cookie expires by itself after 30 minutes.

Keeping it secure

This site is served over HTTPS. The download cookie is httpOnly and cannot be read by page scripts. Access to a download requires a signed, expiring token, so the brochure cannot be fetched by guessing a web address. Credentials we use to deliver enquiries are held on the server and never in the browser.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your data, we will tell you and the relevant authority as the law requires.

Your rights

Under the Personal Data Protection Act 2010 you may ask to see the personal data we hold about you, ask us to correct it if it is wrong, ask us to stop using it, or withdraw your consent to our using it. You may also ask us to limit how it is used.

We may need to confirm who you are before we act on a request, so that we do not hand your data to someone else. We will answer within the period the law allows. Write to pdpa@centrate.my.

Children

This site is intended for businesses, clinics and healthcare professionals. It is not directed at children, and we do not knowingly collect their personal data. If you believe a child has sent us details, write to us and we will delete them.

Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top. Material changes will be described here rather than made quietly.

Contact

For anything to do with this policy or your personal data, write to pdpa@centrate.my. For product questions, the WhatsApp channel on the product pages reaches us fastest.