Privacy notice
How RecoveryGo Sdn Bhd handles personal and medical data on RecoveryGo, in line with Malaysia's Personal Data Protection Act 2010 (PDPA).
Last updated: 22 August 2026
Who we are
RecoveryGo is operated by RecoveryGo Sdn Bhd (“we”, “us”). We are the data user for personal data processed through this website and the RecoveryGo apps. Questions about this notice can be sent to hello@recoverygo.my.
What we collect
- On this website: your email address and whether you signed up as a patient or a physiotherapist, if you join the waitlist.
- In the apps (at launch): your name and contact details, your visit address and location during a booking, the condition notes and photos you choose to share, booking and payment records, in-app messages, and ratings.
- From physiotherapists: professional registration, qualifications, indemnity insurance and payout details, for verification and payment.
- Automatically: basic analytics such as pages viewed and approximate region, used to understand demand.
Medical information
Condition notes and photos are sensitive personal data. We only collect them because a physiotherapist needs them to treat you safely, we ask for your explicit consent before collecting them, and we share them only with the physiotherapist assigned to your session.
Why we use it
- To match your request with a suitable, verified physiotherapist.
- To take payment, hold it, and release it once a session is done.
- To keep both sides safe: identity checks, tracking, and disputes.
- To meet tax, accounting and record-keeping obligations.
- To tell you about launch, if you asked us to.
Who we share it with
We share only what is necessary, with: the physiotherapist assigned to your booking; payment providers who process and hold your payment; infrastructure and communication providers who run the platform on our behalf; and authorities or regulators where the law requires it. We do not sell personal data.
Where it is stored
Data is stored on managed cloud infrastructure and may be processed outside Malaysia by our service providers. Where that happens, we require contractual protections consistent with the PDPA.
How long we keep it
Booking, payment and verification records are kept for as long as the law requires for financial and professional records. Waitlist emails are kept until you unsubscribe or we launch and you decline to sign up.
Your rights
Under the PDPA you may ask us to:
- give you access to the personal data we hold about you;
- correct data that is inaccurate or out of date;
- limit how we process it, or withdraw a consent you gave;
- stop sending you marketing messages.
Write to hello@recoverygo.my and we will respond within the period allowed by law. Withdrawing consent for medical data may mean we can no longer provide the service.
Security
Access to personal data is restricted to staff and practitioners who need it, transmission is encrypted, and card details are handled by our payment providers, so we never store full card numbers.
Children
Accounts are for adults. A parent or legal guardian must make the booking and give consent where the patient is under 18.
Changes
We will update this notice as the platform develops, and the date at the top will change. Material changes will be notified in the app or by email.