Who handles your data
iLIV is operated by IFIT GLOBAL SDN BHD (Business Registration No. 202401019880), with clinics in Damansara Perdana, Petaling Jaya and at I-City, Shah Alam. For the purposes of the Personal Data Protection Act 2010, the company is the data controller for the information set out below. Questions about personal data can be sent to info@iliv.my.
What we collect through this website
When you fill in the form on this site before continuing to WhatsApp, we store your name, phone number, email address, the health goal you selected, and the readiness level you indicated. We also record the page you came from and the relevant branch, so that whoever answers knows the context of your enquiry. We do not ask for an identity card number on any form on this site.
What we collect as a patient
When you come in for a consultation, we collect what is needed for medical care: health history, current medication and supplements, symptoms, physical measurements, and the results of tests you agreed to have done. This becomes part of your medical record.
Health information is sensitive personal data
Under the Personal Data Protection Act 2010, information about physical or mental health is sensitive personal data and requires your explicit consent. That is why the health goal on the website form is your own selection and not a field filled in for you, and why the scope of every test is explained before you agree to it.
What the data is used for
Data is used to answer your enquiry, manage appointments, run the tests you agreed to, provide medical care and follow-up, and keep the records required by law for a private healthcare facility. Your phone number and email are used for follow-up about your care. If we want to send you anything promotional, we will ask for separate consent for that, and you can withdraw it at any time.
Who the data is shared with
Test samples are processed by partner laboratories. Some are in Malaysia, and a small number of specialised panels are processed by laboratories in Australia and Thailand because those tests are not available locally. The laboratories we use are listed on our lab partners page. Only the information needed to run the test is sent, and this is explained to you before you agree.
Besides the laboratories, enquiry details from this website are sent to the enquiry management system we use for follow-up, and this site is hosted by our hosting provider. These providers act as data processors, meaning they process the information on our instructions and only for the purposes set out in this policy.
This site also uses Google Analytics, so the site visit data described in the cookies section below is processed by Google as the provider of that tool.
If you choose to continue the conversation on WhatsApp, messages inside that app are handled under the WhatsApp provider’s own privacy policy and not this one.
We also make referrals to specialists when a case falls outside the clinic’s scope. A referral includes a clinical summary and a copy of your test results, and it is discussed with you first.
Your data is not sold and is not shared for third party marketing.
Transfers outside Malaysia
As stated above, a small number of test panels are processed in Australia and Thailand. For these panels, the purpose and destination of the transfer are explained to you before the test is run, and the transfer is made only with your consent and only as far as is needed to run the test you asked for. The technology providers we use may also process information outside Malaysia, including Google Analytics, which processes site visit data on Google servers outside Malaysia. In that case we rely on your consent and on the protections binding those providers.
How long data is kept
Medical records are kept for the period set by Malaysian law and by Ministry of Health Malaysia guidance for private healthcare facilities. Enquiry details from someone who does not become a patient are kept only for as long as needed to deal with that enquiry, which is ninety days. After that period, personal details such as name, phone number and email address are cleared on a schedule, and what remains is a record with no personal identifier that we use to count enquiry volume.
Your rights
Under the Personal Data Protection Act 2010 you have the right to request access to your personal data, to request correction if it is inaccurate, to withdraw consent for marketing communication, and to ask us to limit the processing of your data for particular purposes. You may also ask for a copy of the information you provided to be transmitted to another party, to the extent the law allows.
For medical records, you have the right to request a copy of your record, and a reasonable copying charge may apply. In certain situations access can be limited, for example where the record contains information that could identify another person.
How to make a request
Send your request to info@iliv.my and say what you want. We will contact you to confirm the request really came from you before any data is released. That verification step exists to protect you.
Cookies and tracking
This site uses Google Analytics 4 to understand which pages are read and where visitors come from. It sets a cookie in your browser to tell one visitor apart from another, and it sends Google the address of the page you opened, your device type and an approximate city level location. The identifier used is a number generated in your browser, not your name or phone number, and we do not join it to your patient record.
There is one more thing you should know. Some pages on this site are titled after a health condition or symptom, so the page address sent to Google can indicate the health topic you were reading. If you would rather that did not happen, you can block cookies in your browser settings, use a private window, or install the Google Analytics Opt-out Browser Add-on. Refusing cookies does not affect your ability to read this site or to book a consultation.
Users who are logged in to this site are not tracked.
The opening screen you see once at the start of a visit uses your browser’s session storage so that it does not repeat, and that storage is cleared when you close the tab. Our hosting provider may set technical cookies needed for the site to work. WhatsApp button clicks are counted in aggregate by day in our own database, with no personal identifier, IP address or visitor profile.
We do not run any third party advertising pixel.
If there is a data breach
If a personal data breach occurs that could cause significant harm, we will notify the Personal Data Protection Commissioner within 72 hours of the breach occurring, and notify those affected without undue delay after that, as the law requires.
Children
The forms on this site are not directed at children. For patients under eighteen, consent is obtained from a parent or guardian.
If you are not satisfied
Tell us first at info@iliv.my so we have a chance to put it right. If you are still not satisfied, you can lodge a complaint with the Department of Personal Data Protection at pdp.gov.my.
Changes to this policy
This policy is updated when the way we handle data changes, for example when a new tool is installed or a lab partner changes. The date of the last update is shown below.
Last updated 18 September 2026.
