Novv For Woman Privacy Policy

NOVV Personal Data Protection Notice pursuant to the Personal Data Protection Act 2010 (Malaysia)

Last updated: 12th July 2026

1. Introduction

1.1 This Privacy Policy ("Notice") is issued by Mediaid Holdings Sdn. Bhd. (Company Registration No. 202601004736), a company incorporated in Malaysia with its registered office at Colony @ The MET, Mont Kiara, THE MET CLUB by Colony, A-10-02, Menara The Met, No. 20, Jalan Dutamas 2, 50480 Kuala Lumpur, operating the NOVV digital health platform ("the Company", "NOVV", "we", "us" or "our").

1.2 This Notice explains how we collect, use, disclose and protect your personal data — including sensitive personal data relating to your health — in connection with the NOVV website and application at [URL] (the "Platform") and the services provided through it (the "Services"), in accordance with the Personal Data Protection Act 2010 ("PDPA").

1.3 This Notice is issued in in English.

1.4 By using the Platform and providing your personal data, you acknowledge that you have read and understood this Notice. Where required by law, we will obtain your explicit consent to process sensitive personal data.

2. Personal Data We Collect

2.1 Identity and contact data — name, gender, date of birth, email address, telephone number, delivery and billing address.

2.2 Account data — login credentials and account settings.

2.3 Health and clinical data (sensitive personal data) — the information you provide in clinical assessments; medical, medication, family and lifestyle history; symptoms; measurements; images or photographs you submit; laboratory and blood-test results; consultation records; prescriptions issued; and other information generated in the course of the Services.

2.4 Transaction data — Services and memberships purchased, payment confirmations and history (complete payment card details are handled by third-party payment providers and not stored by us).

2.5 Communications data — your correspondence with us and, as part of the clinical record, with treating practitioners through the Platform.

2.6 Technical and usage data — IP address, device and browser information, and usage of the Platform collected through cookies and similar technologies.

3. Purposes for Which Data Is Processed

3.1 We process your personal data to:

(a) create and administer your account; (b) provide the Services, including facilitating your assessment, connecting you with registered medical practitioners and licensed providers, and enabling consultations, prescriptions, dispensing, laboratory testing and delivery; (c) maintain your clinical record and make it available to you and your treating practitioners; (d) administer memberships, billing and payments; (e) provide customer support and respond to your enquiries; (f) send service and clinical communications relating to your care (including appointment, result, and screening or review reminders); (g) send marketing communications, where you have consented, with an option to opt out at any time; (h) improve and secure the Platform, and prevent fraud and misuse; and (i) comply with legal, regulatory and professional record-keeping obligations.

3.2 Health data is processed for the purpose of providing the Services and is made available to the independent registered medical practitioners and licensed providers involved in your care. Processing of sensitive personal data is carried out with your explicit consent and/or as otherwise permitted under the PDPA.

4. Disclosure of Personal Data

4.1 We disclose personal data only as necessary to provide the Services and as permitted by law, to:

(a) the independent registered medical practitioners who assess, consult with and treat you; (b) licensed pharmacies that dispense prescribed medicines, and delivery providers that fulfil them; (c) accredited laboratories and phlebotomy providers that perform testing; (d) specialists and external providers to whom you are referred, with the relevant information for your care; (e) technology and service providers that support the Platform (hosting, communications, customer support, payment processing) under confidentiality obligations; (f) professional advisers and regulators, and law enforcement or courts, where required by law; and (g) a successor entity in the event of a reorganisation or transfer of the business, subject to this Notice.

4.2 We do not sell, rent or trade your personal data. We do not share your health data with employers or insurers except with your explicit consent or where required by law.

4.3 Some service providers may store or process data outside Malaysia. Where personal data is transferred outside Malaysia, we take reasonable steps to ensure the transfer complies with the PDPA (as amended) and that the recipient affords an adequate level of protection.

5. Retention

5.1 We retain personal data only for as long as necessary for the purposes described, or as required by law and professional record-keeping obligations.

5.2 Clinical and medical records are retained for the minimum periods required under applicable Malaysian law and professional guidance (which may require retention for a number of years after the last consultation). Transaction records are retained for the period required for tax and accounting purposes. Marketing data is retained until you withdraw consent. When data is no longer required, it is deleted or irreversibly anonymised.

6. Your Rights

6.1 Subject to the PDPA and to any overriding legal or clinical record-keeping obligations, you have the right to:

(a) request access to the personal data we hold about you; (b) request correction of inaccurate, incomplete or out-of-date data; (c) withdraw consent to processing, including for marketing, at any time; (d) limit the processing of your personal data, including for direct marketing under section 43 of the PDPA; and (e) exercise such other rights as are available under the PDPA as amended.

6.2 Requests may be made to the contact details in Clause 10. We may verify your identity before responding, and may charge a prescribed fee where permitted. We will respond within the timeframes prescribed by the PDPA.

6.3 Withdrawing consent to certain processing may mean we are unable to continue providing some or all of the Services safely. Withdrawing consent to marketing does not affect the provision of your care.

6.4 If you are dissatisfied with our handling of your personal data, you may complain to the Personal Data Protection Commissioner, Jabatan Perlindungan Data Peribadi (JPDP).

7. Security

7.1 We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls restricting access to health data to authorised personnel and your treating practitioners, and the use of reputable, PCI-DSS-compliant payment providers.

7.2 In the event of a personal data breach likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected individuals in accordance with the PDPA (as amended).

8. Cookies

8.1 The Platform uses essential cookies (necessary for the Platform to function, including secure login), analytics cookies, and — with your consent — marketing cookies. You can manage non-essential cookies through the cookie banner or your browser settings; disabling essential cookies may impair the Platform.

9. Minors

9.1 The Platform is intended for adults aged eighteen (18) and over. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data, please contact us and it will be deleted.

10. Contact

Enquiries and requests relating to this Notice or to personal data may be directed to:

Mediaid Holdings Sdn. Bhd. (operating as NOVV Health) Email: [contact@novvhealth.com] Telephone: [+601154379892]

11. Amendments

11.1 We may amend this Notice from time to time. The current version, with the date of last revision, is published on the Platform. Material changes will be notified through the Platform or by email.