This website is intended for healthcare professionals.Teepham Medical Sdn. Bhd. · Co. No. 199801018145 (474274-T)
Teepham Medical Sdn BhdPrivacy Notice

Privacy Notice

This notice is given under the Personal Data Protection Act 2010 ("the Act"). It explains how Teepham Medical Sdn. Bhd. (Co. No. 199801018145 (474274-T)) ("Teepham", "we") handles the personal data of the people who use our online store and account pages ("the store"): the owners, partners, directors and staff of the businesses that buy from us, and of businesses that apply to. Teepham is the data controller.

1. What we collect

  • When you claim an account: your name, your role in the business and your full MyKad or passport number (section 3); on the claim page, the number, date and total of a recent invoice, which we check against our records; the business's TIN and SSM number, or that you don't have them to hand; whether the business has changed hands, and any change of address you ask for; your email address and mobile number; and the password you choose.
  • When you ask for a personal link, or a representative calls or visits: the business's name and town, your name, mobile number and email address, and the representative's record of the call.
  • When a business applies for an account: its kind, name, address and SSM number; your name, role, mobile number and email address; for a clinic, the doctor's Annual Practising Certificate (APC) number and the name on it; for a pharmacy, its poison licence number; any note; and up to three files you attach, such as a copy of a licence.
  • When the owner or an admin adds you to an account: your name and email address, from them, and then the password you choose.
  • When you use the store: the orders and quote requests you place, with their products, quantities and prices, your PO numbers and notes; your cart and saved lists; your answers to price changes, and cancellations; and a record of who on the account did what.
  • When you pay online: CHIP tells us whether the payment was made, and its reference. We never receive your card or bank details.
  • When you sign in: when you did, your internet (IP) address and your browser's type, for security; and the codes we email to confirm a new device.
  • From our own records: the business's name, delivery address, TIN and SSM number, email address and phone number; its representative, customer group and payment terms; whether it has an overdue balance or is on credit hold; its recent invoices; and the identity numbers of its owners, partners and directors, given to us when its account was opened. The store keeps those numbers only as scrambled digests, made in Malaysia, which let it check a claim without holding the numbers themselves.
  • From our staff: their notes and decisions on claims, applications, requests and orders.

2. Why we use it

  • To check that the person claiming an account is its owner, a partner or a director, and to decide applications.
  • To create your sign-in and keep it secure.
  • To take, confirm, deliver and invoice orders, to take payment, and to handle returns.
  • To contact you about your account and orders by email, phone or WhatsApp: codes, confirmations, changes, and notices that someone tried to claim the account.
  • To keep our records correct, to manage credit, and to meet our duties under the law, e-invoicing and tax among them.
  • To prevent fraud and misuse, and to find and fix faults in the store.
  • To understand our sales and improve our service.

3. Your MyKad or passport number

When you claim a business's account as its owner, a partner or a director, on the claim page or through a representative's personal link, we ask for your full MyKad or passport number. We use it only to check your claim against the identity numbers of the business's owners, partners and directors in our records, and to keep a record of who claimed the account.

  • We encrypt it before it is stored, and compare it only as a scrambled digest. The keys are held only by the live store, so test copies of the store can't read it.
  • It never goes into logs, error reports, emails or web addresses, nor to the AI model providers in section 5.
  • Our staff see only its last four characters. Whoever decides your claim (our finance staff, or a director) can view it in full while the claim waits, and each viewing is recorded.
  • We keep it while your claim waits and while the account stays open. We erase it when a claim is declined or we close the account, and a claim given up part-way is gone within about three hours.

Giving it is obligatory if you claim an account online. If you would rather not give it, you can still buy from Teepham through your representative or our offices.

4. Whether you must give it

The details a form marks as needed are obligatory: without them we can't check who you are, open an account or a sign-in, or take your order. The rest, such as a note or your PO number, is up to you. You may give the TIN and SSM number later, but we need them to issue e-invoices. Whatever you choose, you can still buy from Teepham through your representative or our offices.

5. Who we share it with

  • Our staff and representatives who look after your account, each seeing what their work needs.
  • Within the business: the owner and admins of its account see who on it did what, and the business's email address on our records is told when someone claims the account, and by whom.
  • Companies that provide services to us under contract:
    • Vercel Inc. (United States), which hosts the store, its functions and files in Singapore; and Neon (part of Databricks, Inc., United States), the store's database, in Singapore.
    • Cloudflare, Inc. (United States): our domain's DNS.
    • PostHog Inc. (United States), in its US Cloud region: anonymous usage analytics and masked session replay, described below.
    • Zoho Corporation, in its United States data centre: our email, the store's emails (codes and account notices), and our staff's sign-in.
    • Functional Software, Inc. (Sentry), in its European Union data region, in Germany: reports of errors in the store, set up to leave out who you are, your cookies and what you type.
    • CHIP IN Sdn. Bhd. (Malaysia): online payments, once we offer them. It receives the order number, the amount, and the name and email address of the person paying.
    • Amazon Web Services, in its Malaysia region: our backups, and a working copy of our business records.
    • YGL Intelligent Technology Sdn. Bhd. (Malaysia), which supplies and supports our business system, where orders are entered and invoices issued.
    • Couriers in Malaysia, when our own lorries don't deliver: the delivery address, the business's name and a contact.
    • Providers that help us build and support our systems, such as GitHub and Anthropic (Claude) (United States), which may see customers' names and figures while doing so.
    • AI model providers (Anthropic, OpenAI and Google; United States): when our management analyses our sales with AI tools, customers' names and sales figures may be sent to them; never contact details or identity numbers.
  • Lembaga Hasil Dalam Negeri Malaysia (LHDN), for e-invoices: the business's TIN and the identity details the law requires.
  • Authorities, courts and our professional advisers, where the law requires or allows it.

We don't sell personal data, and we don't give it to anyone for their own marketing.

6. Where it is kept, and transfers outside Malaysia

Our business system and its backups are in Malaysia. The store's records, the encrypted identity numbers among them, are kept in Singapore (Vercel and Neon); our email and the store's emails in the United States (Zoho); and error reports in Germany (Sentry). Providers in the United States may also handle data while providing their service. Each provider is bound by its data protection terms to protect it. When you accept this notice, you agree to these transfers, as section 129 of the Act provides.

7. How long we keep it

  • A claim you start but don't finish: gone within about three hours of your last step.
  • The codes we email: 10 minutes. Personal links, and links to join an account: 7 days.
  • Your full MyKad or passport number: as section 3 says.
  • Your sign-in, and what you did on an account: while the business is our customer, and afterwards with its records.
  • The business's records, its orders, invoices and claims among them: while it is our customer, and afterwards for as long as the law requires us to keep business records (seven years, for tax and accounting records).
  • An application or request that doesn't lead to an account: as long as we need it to deal with it and to keep a record of what we decided.
  • Backups: until they expire, on a fixed schedule.

8. How we protect it

  • The store is served only over encrypted connections.
  • Passwords and the codes we email are kept only in scrambled (hashed) form, never as typed; full identity numbers are encrypted before they are stored, under keys only the live store holds.
  • A device that hasn't signed in before needs a code sent to your email, and repeated wrong tries are slowed down or stopped.
  • Our staff reach the records only through their own sign-in, and see what their role needs.
  • Our providers are bound to protect the data they hold for us.

No system is completely secure, but we keep these measures under review.

9. If something goes wrong

If personal data we hold is breached, we notify the Personal Data Protection Commissioner, as the Act requires; and if the breach is likely to cause you significant harm, we tell you without unnecessary delay, with what happened and what you can do.

10. Your rights, and how to limit what we do

  • See your data: you may ask, in writing, whether we hold personal data about you, and for a copy of it. We may charge the fee the Personal Data Protection Regulations 2013 allow.
  • Correct it: you may ask us to correct personal data that is wrong, incomplete, misleading or out of date.
  • Limit its use: you may ask us to stop using your personal data for a purpose that isn't needed to supply you, or to stop processing that is likely to cause you damage or distress.
  • Take it elsewhere: you may ask us to send your personal data to another organisation, where that is technically possible.
  • Withdraw your consent: you may withdraw your consent at any time. We would then close your sign-in, and might no longer be able to supply the business through the store.

Send your request to us in writing, using the details below. We may ask you to confirm who you are first. We answer a request to see or correct your data within 21 days, as the Act requires. If you aren't satisfied with our answer, you may complain to the Personal Data Protection Commissioner.

11. Cookies

The store uses the cookies below to work. None is for advertising or follows you to other websites. Analytics uses this tab's session storage instead of analytics cookies.

  • __Host-teepham.session_token keeps you signed in: for 30 days from your last visit, or until you close your browser if you didn't choose to stay signed in (__Host-teepham.dont_remember then marks it).
  • __Host-teepham.trust_device remembers, for 30 days from your last sign-in, that this device has given an emailed code; __Host-teepham.two_factor holds your sign-in for the 10 minutes while that code is checked.
  • teepham-signed-in tells our website's pages that you are signed in, so that they can show "Your account". It holds nothing else.
  • teepham-visit keeps a claim you have started, for up to 6 hours.

The store also keeps, in your browser's own storage, which clinic you last ordered for. CHIP's payment page is CHIP's own, with its own cookies and privacy policy.

Analytics and session replay · 23 October 2026

We use PostHog to understand visits and improve our website, staff pages, store and Business Pulse. It receives anonymous page visits, IP address, device information and selected actions. Session replay records how pages are used, including displayed business information such as prices, balances and Ask answers. We hide input values, credentials, full identity numbers, personal links and contact details before sending recordings. We do not record payment frames, console logs or network request and response bodies.

Analytics identifiers stay in this tab's session storage and are separate for each host; we do not attach your name or email to an analytics profile. Your off choice is saved in this browser's local storage on this host. We respect Do Not Track and Global Privacy Control. Turning analytics off does not stop you using the site or change essential sign-in cookies.

Analytics and session replay in this browser and on this host: off. . Your browser’s privacy signal takes priority.

12. Changes to this notice

We may update this notice. The current version, with its date, is always on this page in English and Bahasa Malaysia, and for a change that matters we tell you by email before it applies. If the two versions differ, the English one prevails.

13. Contact

For a question, a request or a complaint about your personal data, write to us, marked "Personal data":