HelloPhysio Pte. Ltd.
Last updated: July 2026
1. Introduction
HelloPhysio Pte. Ltd. (“HelloPhysio”, “we”, “us” or “our”) operates physiotherapy clinics in Singapore and the website at www.hellophysio.sg.
We are committed to protecting your personal data in accordance with the Personal Data Protection Act 2012 of Singapore (“PDPA”) and other applicable laws.
This Privacy Policy explains how we collect, use, disclose, store, protect, retain and transfer personal data when you interact with us. This includes when you visit our website, contact us by phone, email, WhatsApp, or social media, book an appointment, attend treatment, make a payment, submit forms, apply for a role, or otherwise communicate with HelloPhysio.
By using our website, services or communication channels, or by providing personal data to us, you acknowledge that you have read and understood this Privacy Policy.
2. What personal data means
“Personal data” means data about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.
Personal data may include health-related information if it identifies you or can reasonably be linked to you.
3. Personal data we collect
Depending on how you interact with us, we may collect the following types of personal data.
Identity and contact data
This may include your name, date of birth, gender, nationality, phone number, WhatsApp number, email address, residential address and emergency contact details.
Appointment and clinic data
This may include appointment dates and times, practitioner preferences, appointment history, attendance records, cancellation records, treatment package information, clinic location preferences and communication preferences.
Health and treatment-related data
This may include symptoms, injury descriptions, pain levels, medical history, medication information, surgical history, rehabilitation goals, physiotherapy assessments, treatment notes, consent forms, intake forms, referral information, medical reports, imaging summaries, exercise programs and other information relevant to your care.
Communication data
This may include emails, WhatsApp messages, telephone call notes, SMS messages, social media messages, website enquiry forms, images, documents, voice messages and other content you send to us.
Payment and transaction data
This may include invoice details, payment status, payment method, transaction references and billing information. We do not store full credit card details unless expressly stated by the relevant payment service provider.
Website and technical data
When you use our website, we may collect information such as your IP address, browser type, device information, pages visited, time spent on pages, referral source, search terms and cookie data.
Job applicant data
If you apply for a role with HelloPhysio, we may collect your name, contact details, CV, employment history, education history, professional qualifications, references, interview notes and other information you provide as part of the recruitment process.
4. How we collect personal data
We may collect personal data directly from you when you:
- Make an appointment or enquiry.
- Complete an intake form, consent form or clinic form.
- Attend a physiotherapy consultation or treatment session.
- Communicate with us via WhatsApp, phone, email, SMS, the website form, or social media.
- Make payment for services.
- Subscribe to updates or marketing communications.
- Provide feedback, reviews or testimonials.
- Apply for a job with us.
We may also collect personal data from third parties where appropriate, such as referring doctors, medical specialists, insurers, employers, caregivers, parents or legal guardians, payment providers, clinic management platforms, messaging platforms and other service providers.
Where you provide personal data about another individual, such as a child, family member, caregiver or emergency contact, you confirm that you have obtained their consent or are otherwise authorized to provide that information to us.
5. Purposes for collecting, using and disclosing personal data
We collect, use and disclose personal data for purposes that are reasonably necessary for our clinic operations, patient care and legal obligations.
These purposes may include:
- Providing physiotherapy assessment, treatment and rehabilitation services.
- Scheduling, confirming, rescheduling and cancelling appointments.
- Sending appointment reminders and follow-up communications.
- Managing patient records and treatment notes.
- Responding to enquiries about our services, fees, locations and operating hours.
- Processing payments, invoices, receipts and refunds.
- Communicating with referring doctors, medical specialists or other healthcare professionals where appropriate for your care.
- Providing memos, reports or documentation requested by you or required for treatment-related purposes.
- Managing clinic administration, patient experience and service quality.
- Operating and improving our website, communication systems and digital tools.
- Reviewing communications for appointment management, service quality, troubleshooting, audit, compliance and security purposes.
- Sending service-related messages, clinic updates or administrative notices.
- Sending marketing communications where permitted by law and where you have not opted out.
- Complying with legal, regulatory, professional, audit, insurance and record-keeping obligations.
- Preventing fraud, misuse, unauthorized access or security incidents.
- Managing job applications and recruitment.
We will not collect, use or disclose your personal data for purposes that are not reasonably appropriate without your consent, unless permitted or required by law.
6. Consent and withdrawal of consent
We may collect, use and disclose your personal data with your consent, or where permitted under the PDPA or other applicable laws.
Your consent may be given expressly, such as when you complete a form, book an appointment, message us or agree to receive communications. Consent may also be deemed in certain situations, such as when you voluntarily provide personal data for a purpose that is reasonably apparent.
You may withdraw your consent for the collection, use or disclosure of your personal data by contacting our Data Protection Officer using the details in this policy.
Please note that withdrawing consent may affect our ability to provide services to you. For example, if you withdraw consent for us to use your health information or contact details, we may not be able to manage appointments, provide treatment, maintain clinical records, respond to enquiries or communicate with you about your care.
We will process withdrawal requests within a reasonable time and, where appropriate, inform you of any likely consequences.
7. WhatsApp and electronic communications
HelloPhysio may use WhatsApp, SMS, email, telephone and other communication channels for appointment, administrative, payment, service and care-related purposes.
When you communicate with us through WhatsApp, the information you provide may include personal data, health-related information, images, documents or voice messages. These communications may be reviewed by authorized HelloPhysio staff and, where necessary, service providers supporting our communication systems.
WhatsApp is operated by Meta. Your use of WhatsApp is also subject to WhatsApp’s and Meta’s own terms, privacy policies and data-handling practices.
You should avoid sending highly sensitive information through WhatsApp unless it is necessary for your appointment or care. Please do not send NRICs, passports, financial documents or unrelated medical records unless specifically requested by HelloPhysio staff.
Our electronic communication channels are not emergency services. If you are experiencing severe or worsening symptoms, chest pain, breathing difficulty, sudden weakness, loss of bladder or bowel control, or another urgent medical concern, seek immediate medical attention or call 995 in Singapore.
Messages sent through WhatsApp, email, social media or website forms may not be read immediately.
8. Disclosure of personal data to third parties
We may disclose personal data to third parties where necessary for the purposes described in this Privacy Policy, or where permitted or required by law.
These third parties may include:
- Cliniko, our clinic management and patient record system.
- Meta and WhatsApp, as communication platform providers.
- Payment processors, banks and financial service providers.
- IT, hosting, website, cybersecurity, analytics and communication service providers.
- Referring doctors, medical specialists, hospitals, insurers or other healthcare providers where relevant to your care.
- Professional advisers, auditors, insurers, legal advisers and consultants.
- Regulators, government agencies, law enforcement authorities or courts where required by law.
- Service providers that support clinic operations, administration, marketing, recruitment or data storage.
We require service providers that process personal data on our behalf to protect the data and use it only for authorized purposes.
We do not sell, rent or trade your personal data to third parties for their independent marketing purposes.
9. International transfer of personal data
Some of our service providers, systems or technology platforms may store, process or access personal data outside Singapore.
Where personal data is transferred outside Singapore, we will take the reasonable steps required under the PDPA to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA, unless an exception applies.
This may include contractual safeguards, data processing agreements, security obligations, access controls, service provider due diligence and other appropriate measures.
10. Protection and security of personal data
We take reasonable steps to protect personal data in our possession or under our control from unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks.
Our safeguards may include:
- Access controls and role-based permissions.
- Administrative safeguards for staff access to patient data.
- Password protection and, where appropriate, multi-factor authentication.
- Encryption in transit and at rest where supported by the relevant system.
- Secure clinic management and communication systems.
- Audit logs and access monitoring where available.
- Staff confidentiality obligations and data protection awareness.
- Vendor due diligence and contractual safeguards.
- Reasonable physical security controls at our clinics.
- Secure disposal or anonymization when personal data is no longer required.
No method of transmission or storage is completely secure. However, we take reasonable precautions to protect personal data and review our practices where appropriate.
11. Accuracy of personal data
We make reasonable efforts to ensure that the personal data we use is accurate and complete where it is likely to be used to make a decision that affects you or disclosed to another organization.
You are responsible for ensuring that the personal data you provide to us is accurate and up to date. Please inform us as soon as possible if your contact details, health information or other personal data changes.
12. Retention of personal data
We retain personal data only for as long as it is reasonably necessary to fulfill the purposes for which it was collected, or as required for legal, regulatory, professional, insurance, audit, accounting or business purposes.
Clinical records may be retained for longer periods in accordance with healthcare, professional, medico-legal and operational requirements.
WhatsApp, email and other communication records may be retained for the duration of your patient relationship with HelloPhysio and for a reasonable period afterwards, in accordance with our retention practices and legal obligations.
Job applicant data may be retained for a reasonable period for recruitment, legal or administrative purposes, unless you request otherwise and we are able to comply.
When personal data is no longer required, we will take reasonable steps to securely delete, destroy, anonymize or otherwise dispose of it.
13. Access and correction requests
You may request access to the personal data we hold about you, or request correction of personal data that is inaccurate or incomplete.
To make an access or correction request, please contact our Data Protection Officer using the details in this policy. We may need to verify your identity before processing your request.
We will respond to your request as soon as reasonably possible and generally within 30 days, unless a longer period is permitted or required by law. If we are unable to respond within 30 days, we will inform you of the expected timeframe.
We may charge a reasonable fee for access requests where permitted by law. We may also decline a request where an exception under the PDPA or other applicable law applies.
14. Data breach notification
If a data breach occurs, we will take steps to assess, contain and manage the incident.
Where a breach is assessed as notifiable under the PDPA, we will notify the Personal Data Protection Commission as soon as practicable and, in any case, no later than three calendar days after we assess that the breach is notifiable.
Where required under the PDPA, we will also notify affected individuals as soon as practicable, either at the same time as or after notifying the Personal Data Protection Commission.
We may contact affected individuals with information about the breach and steps they may take to protect themselves, where appropriate.
15. Cookies and website analytics
Our website may use cookies and similar technologies to operate the site, improve user experience, understand website traffic and support analytics.
Cookies are small files placed on your browser or device when you visit a website. They may help us remember preferences, understand how users interact with our website and improve its performance.
We may use:
- Essential cookies needed for the website to function.
- Analytics cookies to understand website usage and improve content.
- Functional cookies to remember preferences or improve usability.
- Marketing cookies where applicable and permitted by law.
You can adjust your browser settings to block or delete cookies. Some website features may not work properly if cookies are disabled.
If we use third-party analytics tools, such as Google Analytics, those providers may collect information about your use of our website in accordance with their own privacy policies.
16. Marketing communications and Do Not Call
We may send you marketing communications about HelloPhysio services, clinic updates, health information, promotions or events where permitted by law.
You may opt out of marketing communications at any time by following the unsubscribe instructions in the communication or contacting us directly.
Even if you opt out of marketing communications, we may still send service-related messages, such as appointment reminders, payment notices, clinic updates, policy changes or communications related to your care.
Where the Do Not Call provisions apply, we will comply with our obligations under the PDPA and applicable Singapore marketing rules. This may include checking applicable Do Not Call registers, obtaining clear and unambiguous consent where required, and providing sender identification and opt-out instructions where applicable.
17. Children and minors
We may collect the personal data of children or minors when appointments, treatment or enquiries are made by a parent, legal guardian or authorized caregiver.
Where required, we will seek consent from a parent or legal guardian before collecting, using or disclosing a minor’s personal data.
Parents or legal guardians should ensure that personal data provided on behalf of a minor is accurate and that they are authorized to provide it.
18. Third-party links and platforms
Our website, emails, WhatsApp messages or social media pages may contain links to third-party websites, platforms or services.
We are not responsible for the privacy practices, content or security of third-party websites or platforms. You should review the privacy policies of those third parties before providing them with personal data.
This includes platforms such as WhatsApp, Meta, Google, social media platforms, payment providers and other external services that may operate independently from HelloPhysio.
19. Testimonials, reviews and social media
If you provide a review, testimonial, comment, image or feedback about HelloPhysio, we may request your consent to use it on our website, social media, marketing materials or clinic communications.
You should avoid posting personal, medical, or sensitive information on publicly accessible platforms or social media if you do not wish it to be publicly visible.
Public reviews and posts on third-party platforms are subject to those platforms’ privacy policies and terms.
20. Job applications
If you apply for a role at HelloPhysio, we may collect, use, and disclose your personal data to assess your application, verify your qualifications and references, conduct interviews, communicate with you, and manage recruitment.
If your application is unsuccessful, we may retain your information for a reasonable period for recruitment, legal or administrative purposes, unless you request otherwise and we are able to comply.
21. Accountability and Data Protection Officer
HelloPhysio has designated a Data Protection Officer to oversee our personal data protection practices and respond to data protection enquiries, access requests, correction requests, consent withdrawal requests and complaints.
If you have questions or concerns about how your personal data is handled, you may contact our Data Protection Officer using the details below.
22. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, technology, data practices or clinic operations.
The latest version will be available on our website. Where changes are material, we may take reasonable steps to notify you, such as by posting a notice on our website or contacting you through an appropriate communication channel.
Your continued use of our website, services or communication channels after changes are published constitutes your acknowledgement of the updated Privacy Policy.
23. Contact us
If you have questions about this Privacy Policy, wish to withdraw consent, make an access or correction request, or raise a data protection concern, please contact:
Data Protection Officer
HelloPhysio Pte. Ltd.
Email: hello@hellophysio.sg
Phone / WhatsApp: +65 8787 3198