Privacy & Data Handling

This section explains terminology used in this privacy policy to help you understand how EliteMStay collects, uses and protects personal data in connection with premium sanatorium services for seniors. Definitions clarify roles, categories of data and processing activities.

We collect data that is necessary to operate our services professionally, ensure safe care coordination, and comply with legal obligations. We limit data collection to what is relevant for service delivery, administrative needs and quality assurance.

Information you provide directly supports bookings, clinical screening, billing and communication. We request only the minimum necessary information to provide appropriate care recommendations and administrative support.

• Contact details: name, phone number, postal and email address for account creation and appointment confirmations.
• Booking information: preferred dates, services requested, accommodation preferences and special assistance needs.
• Health-related information supplied with consent: medical conditions, mobility status, medications and dietary requirements necessary for safe service planning.
• Payment and billing data: billing name, payment method details and invoicing information to process transactions with care and accuracy.
• Communications: messages, feedback and enquiries submitted via forms, email or telephone to improve service and handle requests.
• Representative information: details of authorized family members, carers or legal representatives when provided for client support and decision-making.

Certain technical data is collected automatically when you interact with EliteMStay.club to support website functionality, security monitoring and service improvement efforts.

• Device and browser information: device type, operating system, browser version and language settings to optimize site compatibility.
• Usage data: pages visited, time spent on pages, navigation paths and interaction events used to analyze and improve user experience.
• Connection data: IP address, connection timestamps and region-level location to detect and prevent misuse and to support analytics.
• Cookies and identifiers: persistent and session cookies, local storage identifiers and similar technologies to maintain sessions and preferences.
• Security logs: records of access attempts, errors and other system events used to maintain platform security and contribute incidents.
• Performance metrics: aggregated analytics about system performance and service usage to plan infrastructure and service improvements.

We may receive data about you from trusted third parties where necessary to provide services or fulfill obligations. We assess the reliability and contractual safeguards of such sources.

• Healthcare providers and referral partners supplying clinical summaries or referral information with your consent to ensure continuity of care.
• Payment processors and business institutions to confirm transactions and manage invoicing in a secure manner.
• Analytic and cloud service providers that process technical data under contract to support website operations and data storage.

We process personal data for a defined set of purposes necessary to operate EliteMStay, manage client care and maintain regulatory compliance. Processing is limited to legitimate, proportionate objectives.

• To provide and manage bookings, accommodations and care planning for our senior-focused sanatorium services.
• To communicate appointment details, service updates and essential information to clients and authorized representatives.
• To perform medical and wellness assessments where explicit consent is provided and necessary for safe service delivery.
• To process payments, invoices and refunds in relation to services purchased through EliteMStay.club.
• To improve service quality through aggregated analytics, feedback and support operations while minimizing identifiable data exposure.
• To comply with legal obligations, regulatory reporting and legitimate requests from competent authorities.
• To detect, contribute and prevent fraud or security incidents affecting EliteMStay’s platform and clients.
• To manage contractual relationships with vendors and partners who deliver operational support under confidentiality commitments.

When applicable law requires a lawful basis for processing personal data, we rely on one or more of the lawful grounds below depending on the processing activity and jurisdictional requirements.

• Performance of a contract: processing necessary to fulfil bookings, care agreements and service delivery.
• Consent: for optional activities such as marketing communications or clinical screening where explicit consent is obtained.
• Legal obligation: processing necessary to meet statutory or regulatory duties.
• Legitimate interests: for operational needs such as fraud prevention and platform security, balanced against individual rights.

EliteMStay uses cookies and similar technologies to provide essential site functions, enhance performance and analyze usage. You can manage cookie preferences via your browser or through available site controls.

We use session cookies for authentication, persistent cookies for preferences, performance cookies for analytics, and functional cookies for features such as language selection. No cookies are used to profile health conditions without explicit consent.

Categories include: essential (required for site function), analytics (usage and performance), functional (user preferences) and marketing (third-party integrations where consent is granted).

You can manage cookie settings in your browser or via the cookie management tool on EliteMStay.club. Disabling certain cookies may affect functionality and user experience.

Full cookie information is available on the EliteMStay.cookie policy section of EliteMStay.club.

We share personal data only with parties that require it to deliver services, under contractually enforced data protection measures and on a need-to-know basis to protect client confidentiality.

• Healthcare partners and referring clinicians involved in client care, shared only with consent or where legally permitted.
• Payment and billing service providers to process transactions in a secure manner.
• IT, hosting and analytics providers under strict contractual terms limiting use to service provision and maintenance.
• Regulatory and law enforcement authorities where disclosure is required by applicable law or court order.
• Vendors and suppliers that support operational delivery, subject to data processing agreements and confidentiality obligations.
• Family members or authorized representatives when you provide their details or otherwise consent to such sharing for care coordination.

EliteMStay may transfer personal data to service providers located outside Malaysia when required for operations. Transfers are managed with appropriate legal safeguards and contractual protections to maintain data security.

Where transfers occur, we implement safeguards such as standard contractual clauses, data processing agreements and limited access controls. We review partners to ensure adequate protection consistent with applicable law.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, to comply with legal obligations, to resolve disputes, and to support legitimate business operations.

Account and profile information is retained for the duration of the client relationship and for a period thereafter in line with administrative and legal requirements.

Communications and support correspondence are retained for a period necessary to address enquiries, improve service and maintain records, typically no longer than required by law.

Security logs and technical records are retained for incident response and infrastructure assessment for limited periods consistent with operational needs and legal obligations.

When retention periods expire or personal data is no longer necessary, EliteMStay will securely delete, anonymize or archive the data in a manner appropriate to the sensitivity of the information.

EliteMStay applies a layered security approach to protect personal data, combining administrative policies, technical controls and physical safeguards. Access is role-limited, communication channels are encrypted, and third-party providers are contractually required to maintain strong security standards. Regular reviews and risk assessments help keep protections current and commensurate with the sensitivity of the data handled in senior care operations.

• Encryption of data in transit using TLS and encryption at rest for sensitive records where appropriate.
• Role-based access controls, multi-factor authentication for administrative access and least-privilege principles.
• Regular backups, vulnerability scanning and incident response procedures to detect and address security events promptly.

Depending on applicable law, you may have rights over personal data that EliteMStay processes. We describe how to exercise those rights and the process for responding to requests in a timely manner.

• Right to access: request a copy of personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete personal data.
• Right to erasure: request deletion of personal data where processing is no longer necessary or lawful.
• Right to restriction of processing: request limits on use of your personal data under certain circumstances.
• Right to data portability: obtain a machine-readable copy of personal data provided to us where applicable.
• Right to object: object to processing based on legitimate interests or direct marketing where applicable.
• Right to withdraw consent: withdraw consent given for processing activities at any time without affecting processing prior to withdrawal.
• Right to lodge a complaint with a supervisory authority if you consider our processing does not comply with applicable law.

Although EliteMStay is based and operates in Malaysia, we provide this GDPR guidance for users who may be subject to EU data protection rules and to demonstrate adherence to international best practices.

GDPR provisions may apply where we process personal data of individuals located in the European Economic Area in the context of offering services or monitoring behaviour. Where GDPR is applicable, we will act in accordance with its principles and provide the rights outlined above.

• Lawfulness, fairness and transparency in all processing activities.
• Purpose limitation and data minimization to collect only data necessary for defined purposes.
• Accuracy and retention limits to ensure data remains relevant and is deleted when no longer required.
• Accountability measures including record-keeping, risk assessments and vendor due diligence for cross-border processing.

If you are subject to GDPR and wish to lodge a complaint, you may contact us directly. You also have the right to contact a supervisory authority in the EU country where you normally reside or work.

To exercise any of your rights, please contact EliteMStay using the details provided in the Contact section. Include sufficient information to identify yourself and a clear description of the request so we can locate and process the relevant data.

[email protected]

We aim to respond to valid requests promptly and within applicable legal timelines. Where necessary, we may request additional information to verify identity before fulfilling a request. If a legal exemption applies, we will explain the reason for any refusal.

We may send marketing communications where you have consented or where permitted by applicable law. Marketing messages focus on service updates, promotions relevant to senior wellness and facility announcements. You can manage preferences at any time.

To stop receiving marketing communications, use the unsubscribe link in email communications, update preferences in your account settings on EliteMStay.club, or contact our privacy team using the details below.

EliteMStay’s services are intended for adults, and we do not knowingly collect personal data from children under the age of majority. If we become aware that data for a minor was collected without appropriate authorization, we will take steps to delete it.

EliteMStay.club may include links to third-party websites or resources. We are not responsible for the privacy practices of those sites. Review their privacy policies before providing personal information.

We may update this privacy policy to reflect operational, legal or regulatory changes. When significant changes occur, we will publish a revised date and provide notice through EliteMStay.club or directly to affected users when appropriate. The effective date for this policy is 09-01-2026.