Privacy Policy

We may collect the following types of personal data:

Account and Profile Information

This may include your name, email address, password stored as a secure hash, professional title, profile photo, contact details, and other information you provide in your account profile.

Payment and Transaction Information

When you enroll in a course or purchase a product, payment may be processed by Curlec / Razorpay or another approved payment provider.

We do not store your full card number, online banking credentials, online banking password, or bank account login details on our servers.

We may retain limited transaction records such as payment amount, date, item purchased, invoice or receipt details, payment status, and payment reference for accounting, tax, audit, support, refund, and fraud-prevention purposes.

Learning and Certification Data

We may collect course enrollment records, course progress, module completion, quiz attempts and scores, assignment or activity completion, resource access, attendance or participation records, certificate eligibility, certificate issue date, certificate verification code, and certificate status.

Usage, Device, and Technical Data

When you use the Platform, we may automatically collect limited technical data such as pages visited, features used, browser type, device type, operating system, IP address, log data, session information, error reports, and cookie or similar tracking data.

This helps us operate, improve, monitor, and secure the Platform.

User-Submitted Content

If the Platform allows comments, uploads, assignments, messages, discussions, forms, reviews, or case reflections, we may collect the content you submit.

You must not upload or disclose another person's personal data, patient information, clinical records, photos, videos, or confidential information unless you have the necessary consent, authority, or legal basis to do so.

Sensitive Personal Data

Because Biorehab operates in the allied healthcare and physiotherapy environment, some information submitted through the Platform may relate to health, rehabilitation, clinical learning, physical conditions, or other sensitive matters.

Where sensitive personal data is submitted to us, we will process it only where permitted by law, where necessary for the stated purpose, or where express consent has been obtained.

We may use your personal data to:

• create, manage, verify, and secure your account;
• provide access to courses, learning materials, quizzes, resources, programmes, and certificates;
• track learning progress and course completion;
• generate, issue, verify, manage, replace, or revoke certificates;
• process payments, enrollments, receipts, refunds, and related support;
• communicate with you about your account, purchases, courses, certificates, Platform security, and important updates;
• provide customer support and respond to enquiries, complaints, or requests;
• improve the Platform, user experience, learning engagement, and service quality;
• monitor performance, detect errors, and maintain Platform security;
• prevent fraud, unauthorised access, abuse, or misuse;
• keep internal records for administration, accounting, tax, audit, and compliance purposes;
• comply with legal, regulatory, professional, contractual, and administrative obligations; and
• protect our rights, property, users, service providers, and the public where necessary.

We process personal data in accordance with the PDPA principles, including the General Principle, Notice and Choice Principle, Disclosure Principle, Security Principle, Retention Principle, Data Integrity Principle, and Access Principle.

When you complete a course, programme, training, or assessment and a certificate is issued, certain certificate details may be made available through our certificate verification feature.

This allows employers, institutions, clients, regulators, professional bodies, or other relevant third parties to verify the authenticity and status of a certificate.

Anyone who holds your certificate verification code or QR code may be able to view limited certificate information, such as:

• a partially masked version of your name;
• course, programme, or training title;
• certificate issue or completion date;
• certificate verification code; and
• certificate status.

The verification page is intended only to confirm certificate authenticity. It will not display your full email address, phone number, payment details, quiz scores, full learning records, private account information, or unrelated personal data.

By accepting, downloading, presenting, sharing, or using a certificate issued through the Platform, you acknowledge that limited certificate information may be disclosed through the verification feature for authenticity and verification purposes.

Biorehab may suspend, revoke, correct, or update a certificate status if there is an error, suspected misuse, fraud, non-compliance, administrative issue, or other valid reason affecting certificate integrity.

We do not sell, rent, or trade your personal data.

We may share personal data only where necessary for the purposes stated in this Privacy Policy, where required by law, where reasonably necessary to operate the Platform, or where you have provided consent.

Service Providers and Data Processors

We may share personal data with trusted third-party service providers, vendors, platforms, contractors, or technical partners who process data on our behalf.

These may include providers for payment processing, database and authentication, file storage, website hosting, email delivery, video hosting, analytics, performance monitoring, customer support, security, fraud prevention, error monitoring, accounting, document or certificate generation, communication tools, and other technical or operational services required to run the Platform.

Examples of service providers we may use include Curlec / Razorpay, Supabase, Vercel, Resend, and Vimeo. We may also use other providers from time to time where necessary for the operation, security, improvement, or delivery of the Platform.

These providers are expected to protect your personal data and process it only for the purposes of providing services to us, in accordance with applicable legal, contractual, confidentiality, and data protection obligations.

Legal, Business, and Professional Purposes

We may disclose personal data where required or permitted by law, regulation, court order, lawful request, enforcement authority, or legal process.

We may also disclose personal data where necessary to protect our legal rights, enforce our terms and policies, investigate suspected fraud or misuse, respond to complaints or disputes, protect users or the public, or comply with legal, regulatory, professional, or administrative obligations.

If Biorehab, Catalyst, or part of our business is involved in a merger, restructuring, acquisition, sale, transfer, financing, or similar business transaction, personal data may be transferred subject to appropriate confidentiality and data protection safeguards.

We may also share personal data with professional advisors, auditors, accountants, insurers, legal advisors, consultants, or representatives where reasonably necessary for business, compliance, legal, accounting, insurance, risk management, or dispute-resolution purposes.

Some of our service providers, hosting providers, payment processors, email providers, video hosting providers, analytics providers, security providers, or technical partners may store or process personal data outside Malaysia.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that appropriate contractual, technical, organisational, confidentiality, and security safeguards are in place, consistent with the PDPA.

By using the Platform, you acknowledge that your personal data may be transferred, stored, accessed, or processed outside Malaysia where necessary for the purposes described in this Privacy Policy.

We take reasonable technical, organisational, and administrative steps to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These may include encryption in transit, secure hosting infrastructure, access controls, password hashing, database security controls, system monitoring, restricted administrative access, internal confidentiality controls, and other reasonable security measures.

However, no method of internet transmission or electronic storage is completely secure. While we take reasonable steps to protect personal data, we cannot guarantee absolute security.

You are responsible for keeping your login credentials confidential and for notifying us promptly if you suspect unauthorised access to your account.

If we become aware of a personal data breach or suspected personal data breach, we will take reasonable steps to assess, contain, investigate, and remediate the incident.

Where required by law, we will notify the relevant regulatory authority and/or affected users in accordance with the PDPA and applicable guidelines.

We may also contact affected users with recommended steps to protect their account or personal data, where appropriate.

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

In general:

• account data is retained while your account remains active;
• learning records are retained as necessary to provide course access, support learning progress, and issue certificates;
• certificate records may be retained as necessary to verify issued credentials and protect the integrity of the certification system;
• transaction records are retained for tax, accounting, audit, refund, legal, and business record purposes;
• support and communication records may be retained to respond to enquiries, complaints, or disputes; and
• technical logs may be retained for security, troubleshooting, fraud-prevention, and system administration.

If you request account deletion, we will delete or anonymise personal data associated with your account, unless retention is required or permitted for legal, accounting, security, certification, dispute-resolution, compliance, or legitimate business purposes.

Certificate verification records may continue to be retained in limited form where necessary to confirm the authenticity, validity, revocation, replacement, or status of certificates previously issued.

Subject to the PDPA and applicable legal limitations, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate, incomplete, misleading, or outdated personal data;
• withdraw consent to certain processing, where processing is based on consent;
• limit the processing of your personal data in certain circumstances;
• request deletion of your account and associated personal data, subject to retention exceptions;
• request a copy of your personal data, where applicable; and
• contact us with questions, concerns, or complaints about how your personal data is handled.

Most profile information can be updated directly through your account settings, where available.

To exercise your rights, contact us at privacy@gocatalyst.my. We may need to verify your identity before processing your request.

We may refuse, limit, or defer a request where permitted by law, including where the request affects the rights of another person, relates to legal or regulatory obligations, compromises security, affects certificate integrity, or cannot be fulfilled due to valid retention requirements.

We may send you transactional emails relating to your account, enrollment, purchases, payment receipts, course access, password reset, certificates, Platform security, and important service updates.

Transactional emails are necessary to provide the Platform and cannot be opted out of while your account remains active.

Where we send marketing or promotional emails, you may unsubscribe or manage your email preferences using the available unsubscribe link or account settings, where applicable.

Even if you unsubscribe from marketing emails, we may still send transactional, administrative, legal, security, payment, certificate, and service-related communications where necessary.

We use cookies, pixels, tags, log files, device identifiers, analytics tools, and similar technologies to operate, secure, analyse, and improve the Platform.

These technologies may be used to enable login sessions, authentication, account security, payment flow, certificate access, Platform functions, preferences, analytics, performance monitoring, error detection, security, fraud prevention, and interaction with third-party features such as embedded videos, payment pages, analytics tools, communication tools, or other Platform features.

You can control cookies through your browser settings. However, disabling essential cookies may affect the functionality, security, or availability of the Platform.

The Platform may contain links to third-party websites, payment gateways, video platforms, resources, social media pages, communication tools, or external services.

This Privacy Policy applies only to personal data processed by Biorehab through the Catalyst Platform. We are not responsible for the privacy practices, content, security, or policies of third-party websites or services.

You should review the privacy policies of any third-party service before providing personal data to them.

Catalyst is intended for adults aged 18 and above, professionals, and users seeking professional education or training.

We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a child under 18 without appropriate consent or legal basis, we will take reasonable steps to delete such data.

We may suspend or delete an account if we reasonably believe the user is under 18 or has provided false age-related information.

You are responsible for ensuring that the personal data you provide to us is accurate, complete, not misleading, and kept up to date.

You may update your profile information through your account settings, where available, or contact us for assistance.

We may take reasonable steps to verify or update personal data where necessary for account security, certificate integrity, legal compliance, payment processing, or Platform administration.

Biorehab has designated a person responsible for handling privacy and personal data protection matters.

You may contact our Privacy Officer / Data Protection Contact at privacy@gocatalyst.my for access or correction requests, withdrawal or limitation of consent, account deletion requests, personal data complaints, certificate data enquiries, security or breach concerns, or any question about this Privacy Policy.

If Biorehab is required by law to appoint or register a Data Protection Officer, Biorehab will take reasonable steps to comply with the applicable requirement.

We may update this Privacy Policy from time to time to reflect changes in our practices, Platform features, service providers, legal obligations, regulatory requirements, or business operations.

When we update this Privacy Policy, we will revise the "Last updated" date above.

For significant changes, we may notify you through the Platform, by email, or by other appropriate means.

Your continued use of the Platform after the updated Privacy Policy becomes effective means you acknowledge the updated Privacy Policy.

For questions, requests, corrections, complaints, or concerns about this Privacy Policy or your personal data, you may contact us at:

• Data Controller: Biorehab Group PLT
• LLP Registration No.: LLP0005319-LGN
• Brand / Platform: Catalyst
• Business Nature: Allied healthcare and physiotherapy services / online learning platform
• Address: Lot No. 5, Hong Tong Centre, Taman Hiburan, 88450 Kota Kinabalu, Sabah, Malaysia
• Privacy Officer / Data Protection Contact: privacy@gocatalyst.my
• Support Email: support@gocatalyst.my
• Phone: +60 12-827 1717
• Contact Page: The contact page available on the Platform

We may request additional information to verify your identity before acting on any personal data request.