Legal & Privacy Center

Privacy Policy

This Privacy Policy explains how Elab Pathology Sdn. Bhd. (Company Reg. No. 202301037340) (“Medora Health”, “we”, “us”, or “our”), operating the Medora Health digital health testing platform in Malaysia, collects, uses, discloses, and protects personal data.

We process personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and other applicable Malaysian laws. This policy is written for users of our website, mobile apps, clinic and partner portals, and related services in Malaysia. We do not claim compliance with GDPR, CCPA, or other foreign privacy regimes unless we specifically state otherwise for a product feature.

1. Who is the data controller

Elab Pathology Sdn. Bhd. is the organisation responsible for deciding how and why personal data is processed on the Medora Health platform. Partner clinics, laboratories, payment providers, and messaging providers may process certain data as independent controllers or as processors acting on our instructions, depending on the service.

Registered / operating address (as published on our site): No. 26A, Jalan BP 7/11, Bandar Bukit Puchong, 47120 Puchong, Selangor, Malaysia.

2. Personal data we collect

Depending on how you use Medora Health, we may collect:

• Identity & contact data — name, IC / passport or other ID details you provide, date of birth, gender, email, phone number, and address.
• Account & profile data — login credentials, preferred language, family / dependent profiles you add, and app preferences.
• Health & medical data — booking details, test panels ordered, clinical notes you share, vaccination records where applicable, laboratory results, reports, and related health information. Health data is sensitive and treated with heightened care.
• Booking & service data — clinic selection, appointment date/time, sample collection status, logistics / courier handoff status, and support tickets.
• Payment & wallet data — payment method metadata, transaction references, wallet balances and top-ups, invoices, and refund records. Card numbers are handled by our payment partners; we do not store full card PAN data on Medora Health systems.
• Device & usage data — IP address, browser / app type, device identifiers used for push notifications (for example FCM tokens), approximate location when you choose clinic-finder features, crash / diagnostic logs, and site analytics events.
• Communications — emails, WhatsApp messages, in-app chat, call-related metadata for teleconsultation (for example session timing), and customer-support correspondence.

3. How we collect data

• Directly from you when you register, book, pay, upload information, or contact support.
• From clinics, doctors, phlebotomists, laboratories, and corporate HR / wellness programmes when they use Medora Health to serve you (with appropriate authority).
• Automatically from your browser or app (cookies / local storage, analytics, and security logs).
• From payment gateways and delivery partners when confirming transactions or deliveries.

4. Purposes of processing

We use personal data to:

• Create and manage accounts, authenticate users, and provide the Medora Health website, apps, and portals.
• Process bookings, specimen collection coordination, laboratory testing, report delivery, vaccines, shop / OTC fulfilment (where available), and teleconsultation.
• Process payments, wallet top-ups, invoices, settlements with clinics, and refunds / cancellations.
• Send operational messages (booking confirmations, reminders, results-ready notices, delivery updates) by push notification, SMS, email, or WhatsApp.
• Provide customer support and investigate complaints or disputes.
• Improve platform reliability, security, fraud prevention, and product experience (including aggregated analytics).
• Comply with Malaysian legal, tax, audit, and healthcare-related record-keeping obligations.
• With your consent where required, send marketing or promotional communications (you may withdraw consent for marketing at any time).

5. Lawful basis / consent (PDPA context)

Under the PDPA, we generally process personal data based on your consent when you register, book, or otherwise use our services, and where necessary to perform the contract for health-testing and related services you request. Where Malaysian law requires or permits processing without consent (for example legal compliance or to protect vital interests in limited circumstances), we rely on those grounds. Sensitive personal data relating to health is collected and processed only as needed to deliver the healthcare / laboratory services you request, or as otherwise permitted by law.

You may withdraw consent for optional processing (such as marketing) by contacting us or using in-product controls where available. Withdrawal does not affect processing already completed, and we may still retain or process data where Malaysian law requires retention (for example clinical or financial records).

6. Sharing with service partners

We share personal data only as needed to operate the platform, including with:

• Partner clinics and healthcare professionals involved in your booking, sample collection, vaccination, or consultation.
• Pathology laboratories that perform testing and generate reports.
• Payment providers (for example Fiuu / online banking & card gateways used on our checkout) to process payments and refunds.
• Messaging and notification providers — WhatsApp Business / related messaging channels for booking and support notices, and push notification infrastructure (for example Firebase Cloud Messaging) for app alerts.
• Logistics / delivery partners (for example Lalamove or similar) when specimen pickup or product delivery is arranged.
• Hosting, email, storage, and security vendors that help us run the platform securely.
• Corporate clients (employers or wellness programme sponsors) when your testing is arranged under a corporate programme and sharing is required to administer that programme.
• Regulators or authorities when disclosure is required by Malaysian law.

We do not sell your personal data. Partners are expected to use shared data only for the purposes of providing their services to Medora Health or to you, subject to contractual and legal duties.

7. Cross-border transfers

Medora Health primarily operates in Malaysia. Some infrastructure or vendors (for example cloud hosting, push notification, or payment processors) may process or store data on servers outside Malaysia. Where personal data is transferred outside Malaysia, we take steps consistent with the PDPA to ensure appropriate safeguards and that the transfer is necessary for the services you request or otherwise permitted.

8. Retention

We keep personal and health-related data for as long as your account is active and as needed to provide services, resolve disputes, enforce agreements, and meet legal obligations. Certain medical / laboratory records and financial records may be retained for at least seven (7) years, or longer where Malaysian healthcare, tax, or other laws require. When retention is no longer required, we delete or irreversibly anonymise data where practicable.

9. Security

We apply administrative, technical, and organisational measures appropriate to the sensitivity of health data, including access controls, encrypted transit where supported, staff access limitation, and monitoring for abuse. No method of transmission or storage is completely secure; please protect your login credentials and device. Notify us promptly if you suspect unauthorised account access.

10. Your rights

Subject to the PDPA and applicable exceptions, you may request to:

• Access personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Limit or withdraw consent for processing that is based on consent (including marketing).
• Ask about our policies and practices relating to personal data.

To exercise these rights, contact us using the details below. We may need to verify your identity before acting on a request. We may refuse or limit a request where Malaysian law requires us to retain data (for example clinical records) or where another legal exception applies; if so, we will explain the reason where we are permitted to do so.

11. Cookies, local storage & analytics

Our website and apps use cookies, local storage, and similar technologies for essential functions (session / login, language preference, security) and for limited analytics. For example, the public site may store a visitor identifier in local storage and send page-view / click events to our own traffic endpoint so we can understand site usage. Some pages on the classic site template also load Google advertising / conversion tags (Google Ads / gtag) for measurement of marketing performance. You can control cookies through your browser settings; disabling essential cookies may affect site functionality.

12. Minors

Medora Health services are intended for adults, or for minors only where a parent / guardian creates a dependent profile or books on their behalf and provides the necessary consent and accurate information. If you believe we have collected a child’s data without appropriate adult authority, please contact us so we can investigate and take appropriate action.

13. International users

Medora Health is designed for users and healthcare partners in Malaysia. If you access the platform from outside Malaysia, you understand that your data may be processed in Malaysia (and by vendors as described above) under Malaysian law. Local consumer or privacy rights in your country may differ; please contact us if you have questions before using the service.

14. Changes to this policy

We may update this Privacy Policy from time to time. The “Last revised” date at the top of this page will be updated when changes are published. Material changes may also be communicated in-app, by email, or by notice on the website.

15. Privacy contact

For privacy questions, access / correction requests, or complaints about personal data handling, contact:

• Email: elab@elab-care.com
• Phone: +60 11-2622 2302
• WhatsApp support: +60 11-2622 2302

Terms of Service

These Terms of Service (“Terms”) govern your use of the Medora Health website, mobile applications, and related services operated by Elab Pathology Sdn. Bhd. By creating an account or using Medora Health, you agree to these Terms and our Privacy Policy.

1. The Medora Health platform

Medora Health is a digital health coordination platform. We help patients book laboratory tests, health screening packages, vaccines (where offered), selected shop products, and teleconsultation services, and we coordinate with partner clinics, laboratories, doctors, and logistics providers. Medora Health is not a hospital emergency service and does not replace in-person emergency care.

2. Eligibility & accounts

• You must provide accurate, complete registration and booking information and keep it updated.
• You are responsible for safeguarding login credentials and for activity under your account.
• Dependent / family bookings must be made by a person with legal authority to provide the dependent’s information and consent.
• Clinic, doctor, corporate, and other partner accounts are also subject to separate partnership or portal terms where applicable.

3. Bookings, clinics & laboratories

• Appointment availability depends on partner clinic schedules and operational capacity.
• Sample collection, clinical procedures, and vaccination administration are performed by qualified professionals at partner clinics (or other arranged settings), not by Medora Health staff as a substitute for those professionals.
• Laboratories process specimens according to their clinical protocols; turnaround times are estimates and may vary.
• You agree to follow pre-test instructions (for example fasting) communicated at booking or by the clinic.

4. Medical reports & disclaimers

• Reports and results are provided for informational and clinical follow-up purposes. They are not a diagnosis by Medora Health itself.
• Always consult a licensed healthcare professional for interpretation and treatment decisions.
• Do not use Medora Health for medical emergencies. Call local emergency services if you need urgent care.
• While we and our partners aim for accuracy, additional verification or repeat testing may occasionally be required.

5. Payments

Prices shown at checkout apply to the selected services. Online payments are processed by third-party payment gateways. Pay-at-clinic bookings must be settled as indicated in the booking summary. Wallet balances, promotions, corporate allocations, and loyalty benefits (if any) are subject to the rules shown in-product at the time of use.

6. Acceptable use

You agree not to misuse the platform, including by providing false identity or clinical information, attempting unauthorised access, scraping, interfering with security, or using Medora Health for unlawful purposes.

7. Intellectual property

Medora Health branding, software, content, and materials are owned by Medora Health or its licensors. You may not copy, reverse engineer, or exploit them except as allowed by these Terms or applicable law.

8. Limitation of liability

To the fullest extent permitted by Malaysian law, Medora Health is not liable for clinical outcomes arising from procedures performed by independent clinics or laboratories, for delays caused by partners or force majeure, or for indirect / consequential losses. Nothing in these Terms excludes liability that cannot be excluded under Malaysian law.

9. Governing law & disputes

These Terms are governed by the laws of Malaysia. Courts in Malaysia have jurisdiction over disputes, without prejudice to any mandatory consumer protections that apply. Please contact us first so we can try to resolve concerns amicably.

10. Changes

We may update these Terms periodically. Continued use after the revised date constitutes acceptance of the updated Terms, except where Malaysian law requires a different process.

Returns & Refunds

This section summarises Medora Health’s cancellation and refund practices for patient bookings on the platform. Specific in-app flows (for example wallet credit vs original payment rail) may apply depending on how you paid.

1. Customer cancellations

• Customer-initiated cancellations may incur a 10% transaction charge on the cancellable amount, consistent with Medora Health’s documented historical business rule.
• Cancellations after laboratory processing of your specimen has begun are generally not refundable.
• Some booking types (for example family bookings, points-based payments, or unmatched receipts) may require support assistance to cancel or refund.

2. When refunds are processed

• Approved refunds are typically processed within seven (7) working days.
• Refund timing to your bank, card, e-wallet, or Medora Health wallet depends on the original payment method and the payment partner’s timelines.

3. Reports, defects & service issues

• If you believe a delivered report or service outcome is defective or incomplete, contact support promptly with your order / booking reference and a clear description of the issue.
• We will investigate with the relevant clinic or laboratory. Remedies may include clarification, re-testing where clinically appropriate, or a refund / partial refund where warranted under our policies.
• Special conditions may apply to certain diagnostic tests or packages; those conditions are disclosed at booking where applicable.

4. Shop / product returns

Where Medora Health Shop products are available, returns of unopened, eligible non-perishable items may be considered according to the product listing and support guidance at the time of purchase. Opened consumables, temperature-sensitive goods, and items that cannot be resold for safety reasons are generally not returnable.

5. How to request help

For cancellations, refunds, or billing disputes, contact elab@elab-care.com or call / WhatsApp +60 11-2622 2302 (wa.me/601126222302) with your booking reference. We aim to respond during Malaysian business hours.