Introduction
Woorut (“Woorut”, “we”, “us” or “our”) provides on-site corporate chair and seated massage services delivered by professionally qualified, visually impaired Malaysian massage therapists.
This Privacy Policy explains how we collect, use, disclose, store and protect personal data relating to corporate clients, prospective clients, event organisers, website visitors and individuals participating in Woorut massage sessions.
We process personal data in accordance with Malaysia’s Personal Data Protection Act 2010 (“PDPA”), as amended from time to time, and other applicable Malaysian laws. Where consent is required by law—particularly for sensitive personal data or optional marketing—we will request it separately.
What Personal Data We Collect
Booking and enquiry information
When a company representative, HR manager, office administrator, event organiser or other contact person makes an enquiry or booking, we may collect the company or organisation name; contact person’s name and job title; business email address; telephone or WhatsApp number; office address or event venue; preferred date and time; expected number of participants; requested session arrangement; and other relevant booking instructions.
Participant information
Where reasonably necessary to organise or safely deliver a session, we may collect a participant’s name, appointment time and brief health, allergy or comfort notes—for example, an area to avoid, a disclosed injury or sensitivity, or an allergy to massage oil where oil is used.
Health-related information may be sensitive personal data under the PDPA. Providing it is generally voluntary. We collect and use it only with the participant’s explicit consent or where otherwise permitted by law. Participants should share only information relevant to receiving the service safely. Woorut does not provide medical diagnosis or treatment.
Website and technical information
When you visit woorut.my, we may automatically collect an IP address, browser and device type, operating system, pages viewed, time spent on the website, referring link, approximate location derived from an IP address, and cookie or analytics identifiers.
Some information is necessary for us to respond to an enquiry or provide the requested service. If it is not provided, we may be unable to confirm or fulfil a booking. If a corporate client provides employee or participant data, the client is responsible for ensuring it is authorised to do so and that the individuals have received any necessary notice.
How We Collect Data
We may collect personal data through booking, enquiry or contact forms; WhatsApp or telephone enquiries to 019-432 4421; emails sent to hello@woorut.my; quotations and booking confirmations; a corporate client or event organiser; participants before or during a session; on-site sign-in or appointment sheets; and cookies, website logs or analytics technologies.
We aim to keep on-site collection proportionate. Health or comfort notes should be provided privately and should not be written on a publicly visible sign-in sheet.
Purpose of Processing
We may process personal data to respond to enquiries; prepare quotations; schedule and deliver sessions; coordinate participant flow; assign therapists; protect participant and therapist safety; communicate reminders or operational instructions; manage corporate-client relationships; prepare invoices and accounting records; handle feedback or incidents; improve our website and services; maintain security; send marketing only with consent or where legally permitted; and meet legal, tax or regulatory obligations.
We will not use personal data for a materially different purpose without appropriate notice and consent where required.
Disclosure of Personal Data
We disclose personal data only where reasonably necessary for the purposes stated in this Policy. Relevant booking information may be shared with Woorut therapists and internal staff on a need-to-know basis. A therapist may receive the venue, schedule, participant name and any relevant comfort or safety note required to deliver the session.
We may use trusted service providers supporting website hosting, communications, analytics, document storage, accounting or other business operations. They may process personal data only for the services they provide to us and are expected to protect it appropriately.
Woorut does not sell, rent or trade personal data. We may disclose it to authorities, regulators, law-enforcement bodies, courts or professional advisers where required or permitted by Malaysian law, or where reasonably necessary to protect a person’s safety or Woorut’s legal rights.
Data Security
We use reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. These may include restricted access, password protection, secure digital storage, controlled handling of physical records, confidentiality requirements, and secure deletion or disposal.
No website, transmission or storage system is completely secure. If a personal data breach occurs, we will assess it and notify the relevant authorities and affected individuals where required under the PDPA.
Data Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or to meet legal, accounting and operational requirements.
- Enquiries that do not become bookings may be retained for up to 12 months after the last communication.
- Booking, contractual, invoicing and transaction records may be retained for up to seven years, or longer where legally required.
- General participant lists and attendance records are kept only as long as needed to administer the event and handle reasonable follow-up.
- Health-related comfort notes are normally deleted within 30 days after the event.
For recurring bookings, relevant comfort notes may be retained with the participant’s consent for up to 12 months after their last session. A participant may ask for earlier deletion, subject to any lawful reason requiring limited retention. When data is no longer required, we delete, anonymise or securely dispose of it.
Your Rights Under the PDPA
Subject to the PDPA and applicable exceptions, you may ask whether we hold personal data about you; request access; ask us to correct inaccurate or outdated information; withdraw consent where processing is based on consent; stop direct marketing; request deletion of data that is no longer needed or is processed without a lawful basis; and raise a concern about our handling of your data.
A deletion request may be limited where information must be retained for tax, accounting or other legal obligations, to establish or defend legal claims, prevent fraud, or complete an existing contractual matter.
To exercise your rights, email hello@woorut.my or contact us at 019-432 4421. Please provide enough information for us to identify you and understand the request. We may ask for reasonable proof of identity before disclosing or changing personal data.
Withdrawing consent does not affect processing already carried out lawfully. It may affect our ability to provide a service where the information is necessary for that service.
Cookies and Website Analytics
Woorut.my may use cookies and similar technologies to keep the website functioning, remember preferences, understand traffic, measure performance and improve the user experience. Essential cookies may operate automatically because they are required for functionality or security. Where required, analytics or other non-essential cookies will be used only after consent is obtained.
You may control or delete cookies through your browser settings and, where available, our website controls. Blocking certain cookies may affect how parts of the website function. Analytics providers may receive technical information such as an IP address, device type, browser information and pages visited. Where appropriate, we configure analytics tools to minimise or anonymise the data collected.
Third-Party Links
Our website may link to third-party websites or platforms, including social media, messaging, map or payment services. They operate independently and have their own privacy policies and security practices. Woorut is not responsible for how third parties handle data after you leave our website.
Children’s Privacy
Woorut is a business-to-business corporate wellness service and our website is not directed at children. We do not knowingly collect personal data directly from children through the website. If a session is intended to include anyone under 18, the corporate client or organiser must inform us in advance, and appropriate consent from a parent or legal guardian may be required.
Changes to This Policy
We may update this Privacy Policy to reflect changes in our services, website, business practices or legal obligations. The latest version will be published on woorut.my with a revised effective date. Material changes may also be communicated through the website or directly to affected corporate clients where appropriate.
Contact Us
For questions, privacy requests or concerns about how Woorut handles personal data, contact:
Woorut
Email: hello@woorut.my
Phone/WhatsApp: 019-432 4421