Privacy Policy
- Effective date: 28 August 2026
- Last updated: 28 August 2026
1. Who we are
Peak Health Consultancy Pte. Ltd. (UEN 201804876H), trading as liftCLINIC (“liftCLINIC”, “we”, “us” or “our”), operates an outpatient medical service in Singapore. This Privacy Policy explains how we collect, use, disclose, retain and protect personal data and health information in connection with our website, enquiries, appointments and healthcare services.
Our clinic address is 218 Pasir Panjang Road, Icon @ Pasir Panjang #02-08, Singapore 118579. Our general contact details are Contact@liftclinic.org and +65 8892 8415. Our Data Protection Officer may be contacted at dpo@liftclinic.org.
2. Scope of this policy
This policy applies to patients, prospective patients, website visitors, authorised representatives, caregivers and other individuals whose personal data we handle. It covers personal data collected through liftclinic.org, WhatsApp, telephone, email, online or paper forms, in-person consultations, teleconsultations, off-site services and other interactions with liftCLINIC.
This policy is a privacy notice. It does not replace clinical consent, procedure-specific consent, financial consent, research consent or any other notice or authorisation that may be required for a particular service.
3. Personal data and health information we may collect
Depending on your relationship with us and the services requested, we may collect:
identity and demographic information, such as your name, date of birth, sex, nationality, NRIC or FIN details, and the identity of an authorised representative;
contact and administrative information, such as your address, telephone number, email address, appointment details, referral source and communication preferences;
clinical and health information, such as symptoms, diagnoses, medical and family history, medications, allergies, vaccination history, reproductive and hormonal history, examination findings, photographs, laboratory and imaging results, body-composition data, fitness or functional assessments, prescriptions, procedures and treatment plans;
information generated during care, including consultation notes, consent forms, clinical correspondence, referral letters, certificates, recordings or transcripts where specifically notified, and relevant messages exchanged with the clinic;
billing and transaction information, such as invoices, payment status and refund records. Payment-card details may be processed directly by a payment provider and may not be retained by liftCLINIC;
website and device information, such as IP address, browser type, pages visited, referring page, timestamps, cookie identifiers and security logs, where collected by our website or service providers; and
marketing preferences and responses to surveys, feedback or clinic communications.
Please provide only information that is accurate and relevant. If you provide personal data about another person, you must be authorised to do so and, where required, must inform that person about this policy.
4. How we collect information
We may collect information directly from you, from a parent, guardian, caregiver or other authorised representative, and from healthcare professionals or organisations involved in your care. We may also receive information from laboratories, imaging providers, pharmacies, referral partners, the National Electronic Health Record (“NEHR”), our clinic management system, payment providers, digital health platforms, website providers and public authorities, where authorised or permitted by law.
If you communicate with us through WhatsApp, email or another third-party platform, that platform may process information under its own terms and privacy policy. Relevant clinical communications may be copied into your medical record to support safe care and continuity.
5. Why we collect, use and disclose information
We may collect, use and disclose personal data and health information for purposes that include:
responding to enquiries, verifying identity, registering patients, arranging appointments and sending reminders;
assessing, diagnosing, treating, monitoring and coordinating your care, including teleconsultations, home or off-site care where applicable;
reviewing medical records and results, prescribing or supplying medicines, arranging tests, making referrals and communicating with other members of your care team;
maintaining complete and accurate medical, consent, billing and operational records;
processing fees, invoices, refunds, claims or other transactions requested or authorised by you;
managing clinic operations, quality assurance, service evaluation, clinical governance, audit, training, complaints and patient safety;
protecting our patients, personnel, premises, systems and services; detecting, investigating and responding to security incidents, fraud or misuse;
meeting legal, regulatory and professional obligations, including obligations under the Healthcare Services Act 2020, the Health Information Act 2026 when applicable, the Personal Data Protection Act 2012 (“PDPA”), public-health requirements, court orders and lawful requests from regulators or authorities;
contributing prescribed health information to, and accessing authorised information from, the NEHR when applicable and permitted; and
sending service updates or, where permitted, marketing communications. You may opt out of marketing at any time without affecting your clinical care.
We may use aggregated or de-identified information for quality improvement, planning, statistics and service development where the information no longer identifies you. We will not sell identifiable patient health information.
6. Consent and other permitted uses
Where consent is required, we will seek consent that is appropriate to the circumstances. Singapore law may also allow or require us to collect, use or disclose information without consent, including for patient care, emergencies, investigations, legal compliance, public-health purposes, legitimate interests or other applicable exceptions.
You may withdraw consent for a purpose by contacting our Data Protection Officer. Withdrawal will not affect processing that has already lawfully occurred. It also does not apply where collection, use, disclosure or retention is required or authorised by law, necessary for patient safety, needed to establish or defend legal claims, or forms part of a medical record that we must retain. Depending on the information and purpose involved, withdrawal may limit the services we can safely provide.
7. Health Information Act and NEHR
The NEHR is Singapore’s national repository of key health information. Once the relevant Health Information Act requirements apply to liftCLINIC, we will contribute the categories of health information prescribed for our licensed service, for the patients and within the timelines specified by law. This may include information such as diagnoses, medications, allergies, vaccinations, laboratory results and other prescribed data.
Contribution to the NEHR is a legal obligation where the Health Information Act applies and does not depend on consent. liftCLINIC personnel may access NEHR information only where they are authorised and require the information to provide patient care. NEHR information must not be accessed for employment, insurance or other unauthorised purposes.
Patients may view available NEHR information and access history through HealthHub. A patient may also be able to place an Access Restriction on detailed NEHR information. An Access Restriction limits viewing but does not stop healthcare providers from contributing prescribed information; a limited set of essential information may remain available for patient safety. Further information is available through HealthHub and official Ministry of Health channels.
8. Who we may disclose information to
Where reasonably necessary for the purposes described above, or where authorised or required by law, we may disclose information to:
liftCLINIC doctors, clinical personnel, operations personnel and authorised contractors who need the information for their duties;
laboratories, imaging providers, pharmacies, hospitals, specialists, allied health professionals, coaches or other providers involved in services requested by you or in your care;
our clinic management system provider, IT and cybersecurity providers, cloud or communications providers, document processors, payment processors, accountants, insurers, professional advisers and other data intermediaries supporting clinic operations;
the NEHR system operator, the Ministry of Health, the Personal Data Protection Commission, law-enforcement agencies, courts and other public authorities where applicable; and
another organisation involved in a proposed or completed restructuring, transfer or acquisition of our business, subject to appropriate confidentiality and legal safeguards.
We seek to disclose only the information reasonably necessary for the relevant purpose. Recipients may have independent legal duties and privacy notices, particularly where they provide services directly to you.
9. Service providers and data intermediaries
We use service providers to support functions such as medical-record management, communications, hosting, cybersecurity, payments, accounting and document preparation. We assess vendors according to the sensitivity of the information and the service provided, restrict access to authorised purposes and apply contractual or other safeguards where appropriate.
Our use of a service provider does not remove liftCLINIC’s responsibility for personal data in our possession or control. Some providers may retain information as independent organisations where they have their own legal or professional responsibilities.
10. Recordings, transcription and AI-assisted documentation
If liftCLINIC introduces a recording, transcription or artificial-intelligence-assisted clinical documentation tool, we will use it only after an internal approval and vendor-assessment process. We will provide an appropriate notice and obtain any agreement or consent required before recording a consultation. A clinician will review and correct any generated clinical note before relying on it, and the approved clinic medical record will remain the authoritative record.
We do not treat an AI-generated transcript or note as a substitute for professional judgement. Retention of any recording, transcript or draft will be limited according to the approved workflow and applicable legal, clinical and security requirements.
11. Overseas transfers
Some service providers or their subprocessors may process or store personal data outside Singapore. Where the PDPA requires it, we will take reasonable steps to ensure that transferred personal data receives a standard of protection comparable to that under the PDPA, for example through contractual obligations, vendor assessment and security controls.
12. Retention
We retain personal data and health information only for as long as it is reasonably necessary for patient care, continuity of care, the purposes for which it was collected, clinic operations, legal or professional obligations, dispute resolution and legitimate business needs. Medical records and related documents may be retained for minimum periods required by healthcare laws, licensing conditions, professional standards or other applicable requirements.
When information is no longer required, we will take reasonable steps to securely delete or destroy it, or remove the means by which it can be associated with an individual, subject to lawful backup, archival and evidential requirements.
13. Security
We implement reasonable administrative, physical and technical safeguards appropriate to the sensitivity of the information. These may include role-based access, named user accounts, authentication controls, approved systems and devices, secure configuration, software updates, malware protection, encryption or password protection where appropriate, backups, audit logs, confidentiality obligations, staff training, vendor controls and incident-response procedures.
No transmission or storage method is completely secure. Please do not use ordinary email, website forms or WhatsApp for urgent matters, and avoid sending highly sensitive information through those channels unless requested by the clinic and an appropriate method has been agreed.
14. Website, cookies and analytics
Our website may use cookies and similar technologies that are necessary for security, navigation, forms and basic functionality. If we use analytics, advertising or other non-essential technologies, we will provide appropriate information and choices where required. You can control cookies through your browser and, where available, through our cookie settings; blocking some cookies may affect website functionality.
Third-party sites, embedded content, maps, social-media features or booking and payment links may collect information under their own privacy policies. liftCLINIC is not responsible for the privacy practices of third-party websites that we do not control.
15. Communications and marketing
We may send communications needed to administer your enquiry, appointment or care. We may send promotional messages only where permitted by law and consistent with your preferences. Marketing consent is optional and is not a condition of receiving healthcare. You may opt out using the unsubscribe method provided or by contacting us. We may still send non-marketing communications concerning appointments, safety, billing or care.
16. Access, correction and other requests
Subject to the PDPA and other applicable laws, you may ask to access personal data in our possession or control and information about how it was used or disclosed, or ask us to correct an error or omission. We may need to verify your identity and authority before responding. Legal exceptions may apply, including where disclosure could affect another person, reveal confidential commercial information, threaten safety, prejudice an investigation or conflict with healthcare-record obligations.
Where permitted, we may charge a reasonable fee for an access request and will inform you of the estimated fee before processing it. We will respond as soon as reasonably possible and within applicable legal timelines. Requests concerning information held directly by the NEHR may also need to be made through HealthHub, Synapxe or another authorised channel.
17. Children and authorised representatives
Where a patient is a child or lacks capacity to manage their information, we may deal with a parent, legal guardian, donee, deputy, caregiver or other authorised representative as permitted by law and professional standards. We may request proof of identity, relationship and authority. Where appropriate, we will also take the patient’s views, maturity, safety and confidentiality interests into account.
18. Data breaches and complaints
We investigate suspected loss, misuse or unauthorised access, use or disclosure of personal data or health information. Where legally required, we will notify the Ministry of Health, the Personal Data Protection Commission, affected individuals or other relevant parties within the applicable timeframe.
If you have a privacy concern or believe your information has been mishandled, please contact our Data Protection Officer first so that we can investigate and respond. You may also contact the Personal Data Protection Commission or the Ministry of Health where appropriate.
19. Changes to this policy
We may update this policy to reflect changes in law, guidance, technology or our services. The revised policy will be posted on our website with a new “Last updated” date. Where a change materially affects how we handle information, we will take additional steps to notify affected individuals where appropriate.
20. Contact us
For access, correction, withdrawal of consent, privacy questions or complaints, contact:
Data Protection Officer
Peak Health Consultancy Pte. Ltd., trading as liftCLINIC218 Pasir Panjang Road
Icon @ Pasir Panjang #02-08Singapore 118579
Email: dpo@liftclinic.org
Please mark your correspondence “Data Protection”. For general clinic enquiries and appointments, contact Contact@liftclinic.org or +65 8892 8415.