Privacy Policy

HelloPhysio Pte. Ltd.
Last updated: June 2026

1. Introduction

HelloPhysio Pte. Ltd. (“HelloPhysio”, “we”, “us” or “our”) operates physiotherapy clinics in Singapore and the website at www.hellophysio.sg.

We are committed to protecting your personal data in accordance with the Personal Data Protection Act 2012 of Singapore (“PDPA”) and other applicable laws.

This Privacy Policy explains how we collect, use, disclose, store, protect, retain and transfer personal data when you interact with us. This includes when you visit our website, contact us by phone, email, WhatsApp or social media, book an appointment, attend treatment, use our AI-powered WhatsApp Assistant, make payment, submit forms, apply for a role, or otherwise communicate with HelloPhysio.

By using our website, services or communication channels, or by providing personal data to us, you acknowledge that you have read and understood this Privacy Policy.

2. What personal data means

“Personal data” means data about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.

Personal data may include health-related information if it identifies you or can reasonably be linked to you.

3. Personal data we collect

Depending on how you interact with us, we may collect the following types of personal data.

Identity and contact data

This may include your name, date of birth, gender, nationality, phone number, WhatsApp number, email address, residential address and emergency contact details.

Appointment and clinic data

This may include appointment dates and times, practitioner preferences, appointment history, attendance records, cancellation records, treatment package information, clinic location preferences and communication preferences.

Health and treatment-related data

This may include symptoms, injury descriptions, pain levels, medical history, medication information, surgical history, rehabilitation goals, physiotherapy assessments, treatment notes, consent forms, intake forms, referral information, medical reports, imaging summaries, exercise programmes and other information relevant to your care.

Communication data

This may include emails, WhatsApp messages, phone call notes, SMS messages, social media messages, website enquiry forms, images, documents, voice messages and other content you send to us.

Payment and transaction data

This may include invoice details, payment status, payment method, transaction references and billing information. We do not store full credit card details unless expressly stated by the relevant payment service provider.

Website and technical data

When you use our website, we may collect information such as IP address, browser type, device information, pages visited, time spent on pages, referral source, search terms and cookie data.

Job applicant data

If you apply for a role with HelloPhysio, we may collect your name, contact details, CV, employment history, education history, professional qualifications, references, interview notes and other information you provide as part of the recruitment process.

4. How we collect personal data

We may collect personal data directly from you when you:

• Make an appointment or enquiry
  
• Complete an intake form, consent form or clinic form
  
• Attend a physiotherapy consultation or treatment session
  
• Communicate with us by WhatsApp, phone, email, SMS, website form or social media
  
• Use our AI-powered WhatsApp Assistant
  
• Make payment for services
  
• Subscribe to updates or marketing communications
  
• Provide feedback, reviews or testimonials
  
• Apply for a job with us

We may also collect personal data from third parties where appropriate, such as referring doctors, medical specialists, insurers, employers, caregivers, parents or legal guardians, payment providers, clinic management platforms, messaging platforms and other service providers.

Where you provide personal data about another individual, such as a child, family member, caregiver or emergency contact, you confirm that you have obtained their consent or are otherwise authorised to provide that information to us.

5. Purposes for collecting, using and disclosing personal data

We collect, use and disclose personal data for purposes that are reasonably necessary for our clinic operations, patient care and legal obligations.

These purposes may include:

• Providing physiotherapy assessment, treatment and rehabilitation services
  
• Scheduling, confirming, rescheduling and cancelling appointments
  
• Sending appointment reminders and follow-up communications
  
• Managing patient records and treatment notes
  
• Responding to enquiries about our services, fees, locations and operating hours
  
• Processing payments, invoices, receipts and refunds
  
• Communicating with referring doctors, medical specialists or other healthcare professionals where appropriate for your care
  
• Providing memos, reports or documentation requested by you or required for treatment-related purposes
  
• Managing clinic administration, patient experience and service quality
  
• Operating and improving our website, communication systems and digital tools
  
• Supporting our AI-powered WhatsApp Assistant and related appointment services
  
• Reviewing communications for appointment management, service quality, troubleshooting, audit, compliance and security purposes
  
• Sending service-related messages, clinic updates or administrative notices
  
• Sending marketing communications where permitted by law and where you have not opted out
  
• Complying with legal, regulatory, professional, audit, insurance and record keeping obligations
  
• Preventing fraud, misuse, unauthorised access or security incidents
  
• Managing job applications and recruitment

We will not collect, use or disclose your personal data for purposes that are not reasonably appropriate without your consent, unless permitted or required by law.

6. Consent and withdrawal of consent

We may collect, use and disclose your personal data with your consent, or where permitted under the PDPA or other applicable laws.

Your consent may be given expressly, such as when you complete a form, book an appointment, message us or agree to receive communications. Consent may also be deemed in certain situations, such as when you voluntarily provide personal data for a purpose that is reasonably apparent.

You may withdraw your consent for the collection, use or disclosure of your personal data by contacting our Data Protection Officer using the details in this policy.

Please note that withdrawing consent may affect our ability to provide services to you. For example, if you withdraw consent for us to use your health information or contact details, we may not be able to manage appointments, provide treatment, maintain clinical records, respond to enquiries or communicate with you about your care.

We will process withdrawal requests within a reasonable time and, where appropriate, inform you of any likely consequences.

7. AI-powered WhatsApp Assistant

HelloPhysio uses an AI-powered WhatsApp Assistant to help with appointment bookings, rescheduling, cancellations, appointment reminders and general clinic enquiries.

When you communicate with us through WhatsApp, you may be interacting with an AI assistant rather than a human staff member.

The AI-powered WhatsApp Assistant may help with:

• Appointment booking
  
• Appointment rescheduling
  
• Appointment cancellation
  
• Appointment reminders
  
• General clinic enquiries
  
• Clinic location, fee and operating hour information
  
• Administrative support

The AI-powered WhatsApp Assistant does not provide medical advice, diagnosis, clinical recommendations, emergency advice or treatment decisions. It is not a substitute for assessment by a physiotherapist, doctor or other qualified healthcare professional.

Clinical, complex, urgent or sensitive enquiries may be escalated to HelloPhysio staff where appropriate. Messages may also be reviewed by HelloPhysio staff or authorised service providers for appointment management, service quality, troubleshooting, audit, compliance and security purposes.

If you are experiencing a medical emergency, severe or worsening symptoms, loss of bladder or bowel control, chest pain, breathing difficulty, sudden weakness, or any urgent medical concern, you should seek immediate medical attention or contact emergency services.

Our AI-powered WhatsApp Assistant is operated with support from Vascue Limited, our technology service provider. Vascue processes personal data on our behalf to deliver and support the WhatsApp messaging service. Vascue is not permitted to use your personal data for its own independent purposes unless permitted by law or separately authorised.

WhatsApp is operated by Meta. When you use WhatsApp, your use is also subject to WhatsApp’s and Meta’s own terms, privacy policies and data handling practices.

You should avoid sending highly sensitive information through WhatsApp unless it is necessary for your appointment or care. If you are unsure whether a matter is suitable for WhatsApp, please contact our clinic directly.

8. Disclosure of personal data to third parties

We may disclose personal data to third parties where necessary for the purposes described in this Privacy Policy, or where permitted or required by law.

These third parties may include:

• Vascue Limited, our technology provider for the AI-powered WhatsApp Assistant
  
• Cliniko, our clinic management and patient record system
  
• Meta and WhatsApp, as the messaging platform provider
  
• Payment processors, banks and financial service providers
  
• IT, hosting, website, cybersecurity, analytics and communications service providers
  
• Referring doctors, medical specialists, hospitals, insurers or other healthcare providers where relevant to your care
  
• Professional advisers, auditors, insurers, legal advisers and consultants
  
• Regulators, government agencies, law enforcement authorities or courts where required by law
  
• Service providers who support clinic operations, administration, marketing, recruitment or data storage

We require service providers that process personal data on our behalf to protect the data and use it only for authorised purposes.

We do not sell, rent or trade your personal data to third parties for their independent marketing purposes.

9. International transfer of personal data

Some of our service providers, systems or technology platforms may store, process or access personal data outside Singapore.

Where personal data is transferred outside Singapore, we will take the reasonable steps required under the PDPA to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA, unless an exception applies.

This may include contractual safeguards, data processing agreements, security obligations, access controls, due diligence on service providers and other appropriate measures.

10. Protection and security of personal data

We take reasonable steps to protect personal data in our possession or under our control from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.

No method of transmission or storage is completely secure. However, we take reasonable precautions to protect personal data and review our practices where appropriate.

11. Accuracy of personal data

We make reasonable efforts to ensure that the personal data we use is accurate and complete where it is likely to be used to make a decision that affects you or to be disclosed to another organisation.

You are responsible for ensuring that the personal data you provide to us is accurate and up to date. Please inform us as soon as possible if your contact details, health information or other personal data changes.

12. Retention of personal data

We retain personal data only for as long as it is reasonably necessary to fulfil the purposes for which it was collected, or as required for legal, regulatory, professional, insurance, audit, accounting or business purposes.

Clinical records may be retained for longer periods in accordance with healthcare, professional, medico-legal and operational requirements.

WhatsApp and communication records may be retained for the duration of your patient relationship with HelloPhysio and for a reasonable period thereafter, in accordance with our retention practices and legal obligations.

Job applicant data may be retained for a reasonable period for recruitment, legal or administrative purposes, unless you request otherwise and we are able to comply.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy, anonymise or otherwise dispose of it.

13. Access and correction requests

You may request access to the personal data we hold about you, or request correction of any inaccurate or incomplete personal data.

To make an access or correction request, please contact our Data Protection Officer using the details in this policy. We may need to verify your identity before processing your request.

We will respond to your request as soon as reasonably possible and generally within 30 days, unless a longer period is permitted or required by law. If we are unable to respond within 30 days, we will inform you of the expected timeframe.

We may charge a reasonable fee for access requests where permitted by law. We may also decline a request where an exception under the PDPA or other applicable law applies.

14. Data breach notification

If a data breach occurs, we will take steps to assess, contain and manage the incident.

Where a breach is assessed as notifiable under the PDPA, we will notify the Personal Data Protection Commission as soon as practicable, and in any case no later than three calendar days after we assess that the breach is notifiable.

Where required under the PDPA, we will also notify affected individuals as soon as practicable, either at the same time as, or after, notifying the Personal Data Protection Commission.

We may contact affected individuals with information about the breach and steps they may take to protect themselves, where appropriate.

15. Cookies and website analytics

Our website may use cookies and similar technologies to operate the site, improve user experience, understand website traffic and support basic analytics.

Cookies are small files placed on your browser or device when you visit a website. They may help us remember preferences, understand how users interact with our website and improve the website’s performance.

We may use:

• Essential cookies needed for the website to function
  
• Analytics cookies to understand website usage and improve content
  
• Functional cookies to remember preferences or improve usability
  
• Marketing cookies where applicable and permitted by law

You can adjust your browser settings to block or delete cookies. Some website features may not work properly if cookies are disabled.

If we use third-party analytics tools, such as Google Analytics, those providers may collect information about your use of our website in accordance with their own privacy policies.

16. Marketing communications and Do Not Call

We may send you marketing communications about HelloPhysio services, clinic updates, health information, promotions or events where permitted by law.

You may opt out of marketing communications at any time by following the unsubscribe instructions in the communication or contacting us directly.

Even if you opt out of marketing communications, we may still send you service-related messages, such as appointment reminders, payment notices, clinic updates, policy changes or communications related to your care.

Where the Do Not Call provisions apply, we will comply with our obligations under the PDPA and applicable Singapore marketing rules. This may include checking applicable Do Not Call registers, obtaining clear and unambiguous consent where required, and providing sender identification and opt-out instructions where applicable.

17. Children and minors

We may collect the personal data of children or minors when appointments, treatment, or enquiries are made by a parent, legal guardian, or authorised caregiver.

Where required, we will seek consent from a parent or legal guardian before collecting, using or disclosing a minor’s personal data.

Parents or legal guardians should ensure that personal data provided on behalf of a minor is accurate and that they are authorised to provide it.

18. Third party links and platforms

Our website, emails, WhatsApp messages, or social media pages may contain links to third-party websites, platforms, or services.

We are not responsible for the privacy practices, content, or security of third-party websites or platforms. You should review the privacy policies of those third parties before providing them with personal data.

This includes platforms such as WhatsApp, Meta, Google, social media platforms, payment providers and other external services that may operate independently from HelloPhysio.

19. Testimonials, reviews and social media

If you provide a review, testimonial, comment, image or feedback about HelloPhysio, we may request your consent to use it on our website, social media, marketing materials or clinic communications.

You should avoid posting personal, medical or sensitive information in public review platforms or social media comments if you do not wish that information to be publicly visible.

Public reviews and posts on third-party platforms are subject to those platforms’ privacy policies and terms.

20. Job applications

If you apply for a role at HelloPhysio, we may collect, use, and disclose your personal data to assess your application, verify your qualifications and references, conduct interviews, communicate with you, and manage recruitment.

If your application is unsuccessful, we may retain your information for a reasonable period for recruitment, legal or administrative purposes, unless you request otherwise and we are able to comply.

21. Accountability and Data Protection Officer

HelloPhysio has a designated Data Protection Officer to oversee our personal data protection practices and to respond to data protection enquiries, access requests, correction requests, consent withdrawal requests and complaints.

If you have questions or concerns about how your personal data is handled, you may contact our Data Protection Officer using the details below.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, technology, data practices or clinic operations.

The latest version will be available on our website. Where changes are material, we may take reasonable steps to notify you, such as by posting a notice on our website or contacting you through an appropriate communication channel.

Your continued use of our website, services, or communication channels after changes are published constitutes your acknowledgement of the updated Privacy Policy.

23. Contact us

If you have questions about this Privacy Policy, wish to withdraw consent, make an access or correction request, or raise a data protection concern, please contact:

Data Protection Officer
HelloPhysio Pte. Ltd.
Email: hello@hellophysio.sg