Privacy Policy

1. Introduction

Hearthline ("we", "us", "our") is committed to handling personal information responsibly and in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). This policy describes what personal data we collect, how we use it, how we protect it, and what rights you have in relation to it.

This policy applies to information collected through our website at https://hearthliz.cyou, through our contact form, and through the delivery of our services at 12 Jalan Bangkung, Bukit Damansara, 50490 Kuala Lumpur, Malaysia.

If you have questions about this policy, contact us at [email protected].

2. Data We Collect

We collect the following categories of personal data:

• Contact data: name, email address, phone number — provided voluntarily through our contact form or during service delivery.
• Service data: information about your family's practical arrangements as shared during facilitated sessions or documentation appointments. This data is treated with the highest level of discretion.
• Usage data: pages visited, time on site, browser type — collected automatically via analytics cookies where consent has been given.
• Communication data: emails or messages sent to us.

We do not collect sensitive personal data (such as health, financial, or legal information) on behalf of clients. Any sensitive information shared during sessions is the property of the participants and is recorded only in the written summaries distributed to them.

Legal basis for processing: consent (for marketing and analytics), performance of a contract (for service delivery), and legitimate interests (for operational records).

Retention periods: Contact enquiry data is retained for 24 months. Session records and written summaries are retained for 36 months and then securely deleted. Analytics data is retained for 14 months.

3. How We Use Your Data

• To respond to enquiries and arrange service appointments
• To deliver the services you have engaged us for (facilitation, documentation, records)
• To circulate written session summaries to the relevant participants
• To maintain operational records and invoicing
• To analyse website usage and improve our online presence (analytics cookies only, where consented)
• To comply with applicable Malaysian law

We do not use personal data for unsolicited marketing. We do not sell, rent, or trade personal data to third parties.

4. Data Sharing

We share personal data only in the following circumstances:

• Service participants: Written session summaries are shared equally with all participants present at a given session.
• Service providers: We use third-party tools for website hosting and analytics. These providers process data under their own privacy policies and only to the extent necessary.
• Legal requirements: Where required by Malaysian law or a competent authority.

We do not share session content with anyone other than the participants present, including other family members not present at the session.

5. Data Protection Measures

• Website data transmitted over HTTPS (TLS encryption)
• Session notes stored on password-protected systems accessible only to the assigned coordinator
• Physical session notes held in locked storage at our Bukit Damansara office
• Access to client records limited to the coordinator responsible for that programme
• Security practices reviewed periodically
• In the event of a data breach, affected individuals will be notified as required under Malaysian law

6. Cookies

Our website uses cookies to maintain basic functionality and, where you consent, to collect anonymised analytics data. For full details of the cookies we use and how to manage your preferences, please see our Cookie Policy.

7. Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Withdraw consent to processing where processing is based on consent
• Request that we cease processing your data for direct marketing purposes
• Request deletion of your data, subject to legal retention requirements

To exercise any of these rights, contact us at [email protected] or write to us at our registered address. We will respond within 21 days.

If you believe your rights have not been respected, you may lodge a complaint with Malaysia's Personal Data Protection Commissioner (Department of Personal Data Protection, JPDP).

8. Third-Party Links

Our website may contain links to external websites, including those in our practitioner directory. We are not responsible for the privacy practices of those websites. We recommend reviewing their privacy policies before submitting any personal information.

9. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If a parent or guardian believes we have inadvertently collected data relating to a minor, please contact us at [email protected] and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. The updated version will be published on this page with a revised "Last Updated" date. We encourage you to check this page periodically. Continued use of our website or services after changes are published constitutes acceptance of the updated policy.

11. Contact

Data Controller: Hearthline
12 Jalan Bangkung, Bukit Damansara, 50490 Kuala Lumpur, Malaysia
Email: [email protected]
Phone: +60 3-2783 5140