Last updated: 22-09-2026

Under the Healthcare Services Act (previously the Private Hospitals and Medical Clinics Regulations, Section 12(1)), every licensee of a clinic or healthcare establishment is required to carry out proper documentation and accurate verification of a person’s identity to ensure medical care and treatment is provided to the right patient, and to take reasonable steps to keep records accurate, complete, and up to date.

Therefore, by law, the collection, use, and disclosure of your NRIC/FIN or passport number when seeking treatment at our clinic is required.

We at AURA AESTHETICS PTE. LTD take our responsibilities under Singapore’s Personal Data Protection Act 2012 (“PDPA”) seriously, and recognise the importance of properly managing, protecting, and processing the personal data you entrust to us.

Policy

This Policy explains how MAX Clinic Singapore, our representatives, and/or agents (collectively, “we”, “us”, “our”) collect, use, disclose, and/or process the personal data you provide through our website https://mymaxclinic.sg/ and/or application (the “Platform“), or in connection with your dealings with us, including as a patient or prospective patient.

1. Personal Data

1.1 “Personal Data” means data that falls within the definition of personal data under the PDPA, including but not limited to: name, residential or business address, email address, telephone number, photograph, NRIC/FIN, passport number, date of birth, and any other information that can identify you or is associated with such identifying information.

1.2 Examples of personal data you may provide to us include:

• your name, address, telephone number, email address, NRIC/FIN or passport number, photographs, video images, contact preferences, date of birth, medical and treatment records, and other information you provide via forms or other interactions with us;
• your payment-related information, such as bank account or credit card details.

2. Collection of Your Personal Data

2.1 We may collect your personal data in the following ways, depending on the nature of your interaction with us:

• when you register your details with our clinic staff or book an appointment;
• when you enter into any agreement, consent form, or provide documentation in connection with your treatment;
• when you enter our clinic premises and/or are captured on our CCTV, or in photographs/videos taken at our clinic (e.g. before/after treatment photos, with your consent);
• when you make enquiries, submit requests, or contact us by phone (calls may be recorded), WhatsApp, email, contact forms, social media, or in person;
• when you use or subscribe to our consultation, treatment, or aftercare services;
• when you make payments for our services;
• when you participate in promotions, contests, or events, or respond to a request for additional information;
• when we receive your personal data from business partners, referral sources, or other third parties (e.g. if you were referred to us); and/or
• when you submit your personal data to us for any other reason.

2.2 We may also collect information about the device (computer, mobile phone, tablet) you use to access our Platform, such as IP address, browser type, and usage data.

2.3 When you browse our Platform, you generally do so anonymously, except where cookies and similar technologies are used (see Section 9 below).

2.4 If you provide us with personal data relating to a third party (for example, a referral), you represent that you have obtained that person’s consent to share their information with us.

2.5 Where consent has not been obtained, we may still collect, use, or disclose personal data where permitted under an exception in the PDPA or other written law — for example, to respond to an emergency threatening someone’s life, health, or safety, or where necessary for an investigation or legal proceeding.

3. Purposes for Collection, Use, and Disclosure of Personal Data

Subject to applicable law, we may collect, use, and disclose your personal data for purposes including:

• communicating with you and responding to your enquiries or feedback;
• assessing your suitability for treatment, and providing consultation, treatment, and aftercare services;
• scheduling and managing appointments;
• processing payments and maintaining billing and treatment records;
• verifying your identity in accordance with our obligations under the Healthcare Services Act and MOH regulations;
• complying with legal, regulatory, and medical record-keeping requirements;
• detecting and preventing fraud or misuse of our services, and managing commercial and clinical risk;
• enforcing our legal rights, or defending against claims;
• managing the safety and security of our premises (including CCTV);
• monitoring or recording calls for quality assurance and training purposes; and
• internal administration, business planning, and (where applicable) facilitating a business transaction such as a merger, acquisition, or asset sale.

We may additionally, where you have consented or as otherwise permitted under the PDPA:

• feature before/after photographs or testimonials in our marketing materials or on our website (with your specific consent);
• send you information about our services, promotions, or events that may be of interest to you;
• contact you via phone call, SMS, or other means for marketing purposes where you have indicated consent to receive marketing communications on your Singapore telephone number, in compliance with the Do Not Call (DNC) Registry provisions of the PDPA; and
• analyse aggregated patient data and website usage trends to improve our services.

If you choose not to provide certain personal data, we may not be able to provide our services to you (for example, we cannot safely treat you without accurate identification and medical history). You have the right to object to processing and to withdraw consent, as set out in Sections 5 and 6 below.

4. Disclosure of Personal Data

Subject to applicable law, your personal data may be disclosed, for the purposes above, to:

• our clinical staff, doctors, and practitioners involved in your care;
• third-party service providers who assist us in operating our business (e.g. payment processors, IT providers, appointment-booking systems), bound by confidentiality obligations;
• relevant government regulators, ministries, statutory boards, or law enforcement agencies (e.g. MOH), where required by law;
• any business partner, investor, or transferee in connection with an actual or prospective business transaction; and/or
• any other party you authorise us to disclose your data to.

We do not sell your personal data.

5. Request for Access and/or Correction of Personal Data

You have the right, under the PDPA, to request:

• access to a copy of the personal data we hold about you, or information on how it has been used or disclosed; or
• correction of any inaccurate or incomplete personal data we hold about you,

by writing to our Data Protection Officer at the contact details below. We will endeavour to respond within 30 days. If we cannot do so within that time, we will inform you in writing of when we expect to respond. We may charge a reasonable fee to recover administrative costs for access requests involving significant effort; you will be informed of any fee before we proceed.

6. Request to Withdraw Consent

You may withdraw your consent to our collection, use, or disclosure of your personal data for any or all of the purposes above by writing to our Data Protection Officer. We may require reasonable time to process your request and to notify you of the consequences, including any effect on our ability to continue providing treatment or services to you, or any contractual implications. Withdrawing consent does not affect our right to continue collecting, using, or disclosing your data where permitted or required by law without consent (e.g. mandatory medical record-keeping).

7. Accuracy and Retention of Personal Data

We rely on you to ensure the personal data you provide is accurate and complete. Please inform our Data Protection Officer promptly of any changes. We will retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, for legal or clinical record-keeping purposes (including MOH-mandated retention periods for medical records), or as otherwise required or permitted by law.

8. Transfers of Personal Data Outside Singapore

Where your personal data is transferred to a recipient outside Singapore (for example, a regional office or cloud service provider), we will take appropriate steps to ensure the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA.

9. Use of Cookies, Web Beacons, and Similar Technologies

When you visit our Platform, we or our service providers may use cookies, web beacons, and similar technologies to provide a better, faster, and safer experience. These technologies may recognise you as a unique visitor and collect information such as your browser type, operating system, IP address, and browsing behaviour (e.g. pages viewed, time spent).

• Cookies — small text files stored in your browser. Session cookies expire when you close your browser; persistent cookies remain stored between sessions; first-party cookies are set by our site; third-party cookies are set by other parties (e.g. advertisers).
• Web beacons — small graphic images that work with cookies to help us understand visitor behaviour.

You can block, delete, or disable these technologies through your browser settings, though this may limit your ability to use certain features of our Platform.

10. Third-Party Advertising

We may use third-party services (such as Google) that use cookies to serve advertisements based on your visits to our site and others. You may opt out of personalised advertising via Google’s Ads Settings. We have no control over third-party cookies — please review their own privacy policies.

11. Third-Party Sites

Our Platform may link to third-party websites, including business partners. We are not responsible for their data protection practices, and encourage you to review their privacy policies separately.

12. Children’s Information

We do not knowingly collect personal data from minors without the consent of a parent or legal guardian. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will take reasonable steps to remove it.

13. Contacting Us — Data Protection Officer

If you have questions or feedback about this Policy, wish to withdraw consent, or wish to access or correct your personal data, please contact:

Data Protection Officer

Address: 16 Collyer Quay, #02-01, Second Floor, Singapore 049318

Contact No: +65 84008476

Email: [email protected]

When emailing or writing to us with a PDPA-related request, including “PDPA Request” in the subject line helps us route it promptly.

If your personal data was provided to us by a third party (e.g. an employer or referral partner), please direct queries to that party in the first instance.

You may also lodge a complaint with the Personal Data Protection Commission of Singapore (PDPC) at www.pdpc.gov.sg if you believe your data protection rights have been infringed.

14. Updates to This Policy

We may amend this Policy from time to time to reflect changes in our practices or legal requirements. The prevailing version will always be posted at https://mymaxclinic.sg/privacy-policy. We encourage you to check back periodically.

15. Governing Law

This Policy is governed in all respects by the laws of Singapore.

16. MOH Licence

MAX Clinic Singapore operates under Healthcare Services Act licence number L/25M0575/MDS/001/252, issued by the Ministry of Health. Licence status can be verified via the MOH HealthHub HCSA Healthcare Directory at eservices.healthhub.sg/public/directory.