Privacy Policy

Version 2.1 · Last updated: 25 September 2026

Introduction

Valiance Health (“we,” “our,” or “us”) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with us.

As a healthcare analytics company, we maintain the highest standards of data protection in compliance with applicable laws, including the Malaysia Personal Data Protection Act 2010 (PDPA), the United States Health Insurance Portability and Accountability Act (HIPAA), and other relevant regulations.

Contracting Entities

Depending on where you are located, you may be contracting with one of the following entities:

Valiance Health Inc.— 1303 West Valencia Drive, #327, Fullerton, California 92833, United States. Serves customers in the United States.

Valiance Health Sdn. Bhd.— 72, Plaza Danau 2, Jalan 2/109F, Taman Danau Desa, 58100 Kuala Lumpur, Malaysia. Serves customers in Malaysia and other APAC regions.

References to “Valiance Health,” “we,” “our,” or “us” in this Policy refer to the applicable contracting entity for your region.

Our Data Handling Model

Valiance Health hosts and processes customer data — including Protected Health Information (PHI) where applicable — within Amazon Web Services (AWS) infrastructure.

  • US customers (HIPAA-covered entities): Data is processed under a Business Associate Agreement (BAA). Data is stored within the AWS US East (Ohio) region (us-east-2).
  • Malaysian and other APAC customers: Data is processed under a Data Processing Addendum (DPA) aligned to the Personal Data Protection Act 2010 (PDPA). Your records are stored in the AWS Asia Pacific (Malaysia) region (ap-southeast-5), so your database stays in Malaysia. Some AI features send de-identified text to named destinations outside Malaysia for processing only — see Cross-Border Data Transfers below.
  • Other regions: Available on request. We work with customers to accommodate specific regional data residency requirements.

In all cases, customers retain ownership and control of their data. Valiance acts as a data processor (or Business Associate under HIPAA) — we process data on your behalf, pursuant to your instructions, and subject to the applicable BAA or DPA.

Information We Collect

Business Contact Information

We collect limited business contact information for service delivery purposes:

  • Contact information (name, business email address, phone number, company name)
  • Account credentials when you create an account with us
  • Communications you send to us (emails, form submissions, support requests)
  • Professional information (job title, organization, role)

Information Collected Automatically

  • Device information (browser type, operating system)
  • Log data (IP address, access times, pages viewed)
  • Cookies and similar tracking technologies (with your consent where required)
  • Usage patterns and preferences

What We Do NOT Collect from Website Visitors and Business Contacts

The following categories of information are not collected through our website or from business contacts:

  • Personal identification numbers (NRIC, passport numbers, etc.)
  • Financial account information

Note on Service Data: Data that our customers submit to Valiance Health's platform as part of their service subscription (“Service Data”), including any PHI, is governed by the applicable BAA or DPA rather than this Privacy Policy. Customers are responsible for the accuracy and lawfulness of Service Data they provide.

Data Sovereignty and Regional Processing

We respect data sovereignty requirements and maintain regional infrastructure to ensure compliance:

Malaysia

For Malaysian clients, your data is stored in the AWS Asia Pacific (Malaysia) region (ap-southeast-5). The database holding your records stays in Malaysia. It is not replicated or backed up outside the country.

Processing sometimes takes place outside Malaysia, and only to destinations we have assessed. Our AI features rely on large language models that are not available in the Malaysia region. Where a feature needs one, we remove identifiers first and send only the de-identified text to a named destination. Every such destination is covered by a Transfer Impact Assessment under section 129 of the PDPA, which names the country, the contract in force, and the retention terms. We do not use routes that cannot name where the data goes. The assessment is available to customers on request, and Cross-Border Data Transfers below sets out the current destinations.

United States

For US clients, data is processed within the AWS US East (Ohio) region (us-east-2), in accordance with applicable US laws and the terms of the applicable BAA.

Other Regions

We work with clients to ensure data processing occurs in compliance with local regulations and can accommodate specific regional requirements upon request.

PDPA Malaysia Compliance

In compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia, we adhere to the following principles:

  • General Principle: Personal data is processed lawfully and only for purposes directly related to our business activities
  • Notice and Choice Principle: We inform data subjects of the purposes for which their data is collected and provide choices regarding its use
  • Disclosure Principle: Personal data is not disclosed without consent except as permitted by law
  • Security Principle: We implement appropriate security measures to protect personal data from unauthorized access, processing, or disclosure
  • Retention Principle: Personal data is not kept longer than necessary for the fulfillment of its purpose
  • Data Integrity Principle: We take reasonable steps to ensure personal data is accurate, complete, and up to date
  • Access Principle: Data subjects may request access to and correction of their personal data

Malaysian data subjects may contact us to exercise their rights under the PDPA, including rights of access and correction.

HIPAA Compliance

For healthcare organizations and covered entities in the United States:

  • Valiance Health acts as a Business Associate under HIPAA
  • We enter into Business Associate Agreements (BAAs) with covered entities as required by 45 CFR Part 164
  • We implement administrative, physical, and technical safeguards as required by the HIPAA Security Rule
  • We maintain comprehensive privacy and security policies and procedures in compliance with the HIPAA Privacy Rule and Security Rule
  • In the event of a breach of unsecured PHI, we will notify affected covered entities without unreasonable delay and in no case later than 60 calendar days following discovery of the breach, as required under 45 CFR § 164.410

Sub-Processors

We engage third-party service providers (“sub-processors”) to support the delivery of our platform and services. Sub-processors operate under contractual obligations consistent with our privacy and security commitments. Categories of sub-processors include:

  • Cloud infrastructure providers — for hosting, storage, and compute
  • Observability and monitoring tooling — for performance, logging, and security monitoring
  • Customer support tooling — for managing support requests and communications
  • Messaging platforms — for patient surveys that healthcare providers send from their own WhatsApp Business numbers (see Patient Messaging on Behalf of Healthcare Providers below)

We do not publish the names of individual sub-processors on our public website. Customers may request the current sub-processor list in writing; it is made available under confidentiality. To receive notifications of material changes to our sub-processor list, please email admin@valiancehealth.ai to be added to the notification list.

Patient Messaging on Behalf of Healthcare Providers

Some hospital and clinic customers use our platform to send patient-reported outcome surveys to their patients over WhatsApp. For this feature:

  • The healthcare provider is the data controller. The provider decides which patients receive surveys and is responsible for obtaining their consent. We act only as the provider's data processor, under our agreement with the provider.
  • Messages come from the provider's own number. Surveys are sent from the provider's own WhatsApp Business account. They travel through the WhatsApp Business Platform (Cloud API), which Meta Platforms, Inc. and its affiliates operate under the provider's own agreement with Meta.
  • What we process: the patient's name and mobile number as supplied by the provider, the messages we send, the patient's survey answers, and the delivery and read status that WhatsApp reports. We use this data only to run the survey for the provider. We do not use it for our own marketing, and we do not sell it.
  • Other messages are not kept. If a patient sends a message that is not an answer to an active survey, we do not store its content and we do not reply automatically.
  • Opting out: a patient can reply STOP (or BERHENTI) at any time. We then send no further surveys to that number for that provider.
  • Patient rights requests: patients should contact their healthcare provider first. If a patient contacts us, we pass the request to the provider and act on the provider's instructions.

Survey data is kept for the period that the provider sets in its agreement with us. We delete it when the provider instructs us to, or when the agreement ends, unless the law requires us to keep it.

How We Use Your Information

We use the business contact information we collect to:

  • Provide, maintain, and improve our services
  • Process transactions and send related information
  • Respond to your comments, questions, and requests
  • Send technical notices, updates, and administrative messages
  • Communicate about products, services, and events (with consent where required)
  • Monitor and analyze trends, usage, and activities
  • Detect, investigate, and prevent security incidents
  • Comply with legal obligations

Data Sharing and Disclosure

We may share your information in the following limited circumstances:

  • Service Providers: With vendors and service providers who need access to perform services on our behalf, under appropriate contractual protections
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate notice
  • Legal Requirements: When required by law or to respond to valid legal process
  • Protection of Rights: To protect the rights, privacy, safety, or property of Valiance Health, our clients, or others
  • With Your Consent: When you have given us explicit permission to share your information

We do not sell your personal information to third parties.

Data Security

We implement appropriate technical and organizational measures to protect your information, including:

  • Encryption of data in transit (TLS 1.3) and at rest (AES-256)
  • Access controls and multi-factor authentication
  • Regular security assessments and penetration testing
  • Employee training on data protection and security awareness
  • Incident response and breach notification procedures
  • SOC 2 Type II compliance
  • Regular third-party security audits

Data Retention

We retain your business contact information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law. Specific retention periods are as follows:

  • Business records(contracts, invoices, correspondence): retained for 7 years from the date of creation or last activity, in accordance with applicable legal and regulatory requirements
  • Account data: deleted or anonymized within 30 days of service termination or upon your request, unless retention is required by law

For Malaysian data subjects, we comply with the PDPA retention principle. Any data not covered by the above periods will be retained only as long as necessary for the stated purpose and then securely deleted or anonymized.

Your Rights and Choices

Depending on your location, you may have the following rights:

Under PDPA Malaysia:

  • Right of Access: Request access to your personal data held by us
  • Right of Correction: Request correction of personal data that is inaccurate, incomplete, or outdated
  • Right to Withdraw Consent: Withdraw consent for processing where consent was the basis
  • Right to Prevent Processing: Request that we cease processing your personal data in certain circumstances

Additional Rights (where applicable):

  • Deletion: Request deletion of your personal information
  • Portability: Request a copy of your data in a portable format
  • Opt-out: Opt out of marketing communications at any time by contacting support@valiancehealth.com

To exercise your data protection rights or contact our Data Protection Officer, please write to admin@valiancehealth.ai. We will respond within the timeframes required by applicable law.

Data Deletion

To ask us to delete your personal data:

  1. Email admin@valiancehealth.ai with the subject line “Data deletion request”.
  2. Tell us your name, and the email address or mobile number that we hold for you.
  3. We confirm your identity by replying to that email address or number.
  4. We delete your data, or make it anonymous, within 30 days of confirmation, and we tell you when it is done.

If your data came to us from your healthcare provider (for example, a WhatsApp survey), we pass your request to that provider and delete the data on the provider's instruction. We keep data only where the law requires us to, and we tell you if that applies.

Cookies and Tracking

We use cookies and similar technologies to collect information about your browsing activities. Where required by law, we obtain your consent before placing non-essential cookies.

You can manage your cookie preferences through your browser settings. Note that disabling cookies may affect the functionality of our website.

Cross-Border Data Transfers

Your records stay in the region you are contracted for. Some AI features, however, need large language models that are not available in every region — so for those features, and only those, text is processed outside your region.

Identifiers are removed before anything leaves. Names, identity-card and passport numbers, medical record numbers, contact details and locations are stripped in your own region first. Only the de-identified text is sent. If the redaction step fails, the request fails — it is never sent unredacted.

For Malaysian data we rely on Section 129 of the PDPA, and specifically on the adequacy of the receiving organisation — its certifications, its security controls and its contractual obligations to us. Each destination is documented in a Transfer Impact Assessment that names the country, the agreement in force, the retention terms and the onward-transfer position. Current destinations include:

  • Asia-Pacific regions operated by Amazon Web Services, for our default models
  • Japan, for models confined to a single country
  • The United States and India, for specific frontier models that are not offered elsewhere

In every case the model runs inside our cloud provider’s own infrastructure under a Business Associate Agreement or Data Processing Addendum. The organisation that built the model does not receive your data.

We do not use routes that cannot name a destination. Some providers offer “global” endpoints that may process a request in any country. Those cannot be assessed under Section 129, so we refuse them for customer data — as we do model-aggregator services that route to undisclosed third parties. The assessment for any destination we do use is available to customers on request.

Children's Privacy

Our services are business-to-business services not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Last updated” date. For significant changes, we may provide additional notice such as email notification. We encourage you to review this Privacy Policy periodically.

Contact Us

If you have any questions about this Privacy Policy, our privacy practices, or wish to exercise your data protection rights, please contact us:

Privacy & Data Protection Officer matters

Rights requests, Data Processing Addendum inquiries, BAA questions, complaints

Valiance Health

Dr. Ridhwan Hassan, Co-founder & Data Protection Officer

Email: admin@valiancehealth.ai

Service-related matters

Support requests and promotional email opt-out

Email: support@valiancehealth.com

For Malaysian data subjects, you may also lodge a complaint with the Personal Data Protection Department (JPDP) if you believe your rights under the PDPA have been violated.