Privacy Policy

Personal data means any information relating to a person who is identified or identifiable from that information, or from other information in our possession. It includes your name, your contact details, and any health-related information you choose to share with us.

Sensitive personal data, such as information about your physical or mental health, is handled with additional care. We only collect it where you give your explicit consent and where it is needed to help with your enquiry.

The PDPA sets out seven principles that govern the way personal data is handled in Malaysia. This Policy is organised around them:

• General Principle: we do not process your personal data without your consent, unless the law permits processing without consent.
• Notice and Choice Principle: we tell you, in writing and in clear language, what we collect and why, and what choices you have.
• Disclosure Principle: we do not disclose your personal data for any purpose other than the purpose we told you about, or one directly related to it.
• Security Principle: we take practical steps to protect your personal data from loss, misuse, modification, unauthorised or accidental access, disclosure, alteration, or destruction.
• Retention Principle: we do not keep your personal data longer than is necessary for the purpose it was collected for.
• Data Integrity Principle: we take reasonable steps to keep your personal data accurate, complete, not misleading, and up to date.
• Access Principle: you may access the personal data we hold about you and correct it where it is inaccurate, incomplete, misleading, or out of date.

We collect only what is necessary for the purposes in this Policy. In practice, that is:

• identity and contact data, such as your name, email address, phone or WhatsApp number, and country;
• role data, such as whether you are a patient, a clinician, a researcher, part of a department, a clinical research organisation, or a sponsor;
• the content of your enquiry, including any cancer, mutation, or treatment details you choose to include;
• basic technical data, such as device and browser information collected to keep the Platform secure and working.

Please share only what is needed. We do not need your full medical records in order to answer your question.

We use your personal data to:

• respond to your enquiry and keep you informed about it;
• connect you with the relevant trial services, trial sites, or our oncology concierge team, where you have asked us to;
• support the searching, matching, and coordination of the trial information you request;
• maintain, secure, and improve the Platform;
• meet our legal, regulatory, and record-keeping obligations.

We will not use your personal data for a new purpose without telling you first and, where the law requires it, without asking for your consent again.

We do not sell your personal data, and we do not share it with anyone for their own marketing.

• The OncoTrials MY team: your enquiry and your details reach our own team only, so that we can reply to you.
• Trial services and sites: where you have asked us to refer you or connect you with a trial site, sponsor, or clinical team, we share only what is needed for that purpose, and we tell you before we do it.
• Service providers: trusted providers who process personal data on our behalf, for example secure hosting and email delivery, under contractual duties of confidentiality.
• Legal requirements: where we are required to disclose personal data by law, or to a lawful authority.

We take reasonable technical and organisational measures to protect personal data against loss, misuse, modification, unauthorised access, and disclosure. These include limiting access to the OncoTrials MY team, using encrypted connections, and holding as little data as we can.

If we have reason to believe that a personal data breach has occurred, we will act promptly to contain it and, where required, notify the Personal Data Protection Commissioner and any affected individuals without unnecessary delay.

No system is completely secure. Please keep your login details confidential, and take care with the information you send through the Platform.

We do not keep personal data longer than is necessary.

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires.

Enquiry details are deleted from our system once our team has received them and acted on them, as described in the notices on our contact form and chatbot.

When personal data is no longer needed, we destroy it or permanently anonymise it.

Under the PDPA you have the right to:

• access the personal data we hold about you, and be informed how it has been or may have been used and disclosed;
• correct personal data that is inaccurate, incomplete, misleading, or not up to date;
• withdraw your consent to the processing of your personal data, subject to legal and contractual restrictions and to reasonable notice;
• ask us to limit the processing of your personal data, or to stop using it for a particular purpose;
• request that your personal data be transmitted to another data controller, a right introduced by the 2024 amendment, where the law provides for it;
• make a query or a complaint about how we handle your personal data.

You can exercise any of these rights, or ask a question about this Policy, through the contact form on the Platform. We aim to respond within the period set by the PDPA. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner.

We keep personal data within Malaysia where we can. If personal data is transferred outside Malaysia, we will do so only in accordance with the PDPA and the guidelines issued by the Personal Data Protection Commissioner, ensuring that the place of destination provides a level of protection at least comparable to the protection under the PDPA, or where another exception under the law applies.

The Platform uses only the cookies, local storage, and similar technologies that it needs to work, for example to keep your session secure and to remember basic preferences. We do not use third-party advertising trackers on the Platform.

You can control or clear cookies through your browser settings. Some parts of the Platform may not work as intended if you do.

Malaysia updated its data protection law through the Personal Data Protection (Amendment) Act 2024 (Act A1727), which came into force in phases during 2025. The amendment strengthens the PDPA by, among other things, requiring organisations to notify the Personal Data Protection Commissioner and affected individuals of personal data breaches, introducing the appointment of a Data Protection Officer where the prescribed criteria apply, placing obligations directly on data processors, reinforcing the rules on transferring personal data outside Malaysia, and introducing a right to data portability.

We comply with the requirements of the amendment that are in force. Where a requirement under the amendment, its subsidiary legislation, or any guideline issued by the Commissioner is not yet mandated, or is still being prescribed in phases, we are preparing for it, and we will update this Policy so that the obligations that bind us, and the rights available to you, are always reflected here.

This Policy is a summary for your information. It does not limit your rights under the PDPA, the 2024 amendment, or any other law of Malaysia.

The date at the top of this Policy tells you which version you are reading.

When we change this Policy, the revised version is published here and takes effect from the date it is posted.

Where a change affects you materially, we will bring it to your attention, for example through a notice on the Platform.

Continued use of the Platform after a change means you accept the updated Policy.

Questions, requests to access or correct your personal data, or concerns about how we handle it, can be sent to our team through the contact form on the Platform.

If you are not satisfied with how we have handled your personal data, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi), whose contact details are published at www.pdp.gov.my.