Privacy Policy

Last updated: 22 September 2026

Identity and Role of the Data Controller

journawaveel operates this website as the data controller for personal data collected through our corporate health services platform. We determine the purposes and means of processing personal data in accordance with Singapore's Personal Data Protection Act (PDPA). Our role includes managing health-related data for corporate clients while ensuring compliance with all applicable local regulations.

Scope of the Notice and the People It Covers

This privacy notice applies to all visitors, corporate clients, employees of client organisations, and other individuals who interact with our services based in Singapore. It covers data collected via our website, contact forms, blog interactions, and any corporate health programmes we administer. The notice does not apply to third-party sites linked from our platform.

Categories of Personal Data and Sources

We collect categories such as contact details, employment information, health and wellness data provided voluntarily for corporate programmes, usage data from website interactions, and technical data like IP addresses. Sources include direct submissions through forms, cookies, analytics tools, and information supplied by corporate clients on behalf of their employees. Health data is treated as sensitive and collected only with explicit consent.

Purpose-by-Purpose Explanation of Processing and Legal Basis

Personal data is processed for service delivery and account management under the basis of contractual necessity; for marketing and blog engagement under legitimate interests or consent; for compliance with legal obligations such as PDPA reporting; and for improving corporate health offerings under legitimate interests. Each purpose is evaluated to ensure processing remains proportionate and necessary.

Whether Providing Data Is Required and Consequences

Providing certain data is necessary to access corporate health services or respond to enquiries. Failure to supply required information may result in inability to register for programmes, receive tailored health recommendations, or use contact features. Optional data, such as additional wellness details, can be withheld without affecting core service access.

Cookies and Similar Technologies

Our site uses cookies for functionality, analytics, and personalisation. A site-wide cookie banner allows users to manage preferences. For full details on cookie types, durations, and management options, please refer to our separate Cookie Policy available on this website.

Processors, Service-Provider Categories, Recipients, and Disclosures

We engage processors including cloud hosting providers, analytics services, payment processors, and health programme partners. Categories of recipients include corporate clients receiving aggregated reports and authorities where legally required. Disclosures occur only when mandated by Singapore law or with appropriate safeguards in place.

International Transfers and Safeguards

Some data may be transferred outside Singapore to service providers in countries with adequate protection levels. Transfers are protected by contractual clauses approved under PDPA requirements, ensuring equivalent safeguards for personal data including health information.

Specific Retention Periods or Criteria

Personal data is retained only as long as necessary for the stated purposes: service records for up to seven years to meet accounting obligations; marketing data until consent withdrawal; and health programme data for the duration of the corporate contract plus a reasonable period thereafter. Criteria include legal retention requirements and ongoing business needs.

Security and Data-Minimisation Practices

We implement reasonable technical and organisational measures such as encryption, access controls, and regular audits to protect data. Data minimisation principles are applied by collecting only what is essential. While we strive to maintain security, no system can guarantee absolute protection against all risks.

All Applicable Data-Subject Rights and Exercise Methods

Under PDPA you may request access, correction, or withdrawal of consent regarding your personal data. To exercise these rights contact us using the details on our Contacts page or via [email protected]. Requests are handled within statutory timeframes and may require identity verification.

Right to Withdraw Consent and Object to Direct Marketing

You can withdraw consent at any time by contacting [email protected] or using unsubscribe links in communications. Objections to direct marketing or profiling for marketing purposes are respected promptly, and we maintain records of such preferences to prevent further unwanted contact.

Right to Complain to the Competent Supervisory Authority

If you believe your data has been handled improperly you may lodge a complaint with the Personal Data Protection Commission of Singapore. Contact details and procedures are available on their official website. We encourage first contacting us at [email protected] to resolve concerns directly.

Children or Age Restrictions

Our corporate health services target adult employees of client organisations. We do not knowingly collect personal data from individuals under 18 years of age. If such data is discovered it will be deleted promptly upon notification.

Automated Decision-Making and Profiling

We may use automated tools for basic analytics or generating aggregated wellness insights but do not engage in solely automated decisions that produce legal or significant effects on individuals. Profiling, where used, is limited to improving service relevance and always includes human oversight options.

Policy Changes and Effective Date

We may update this policy periodically to reflect legal or operational changes. The last updated date appears at the top. Continued use of the site after updates constitutes acceptance of the revised terms. Previous versions are not archived publicly but summaries of material changes can be requested via [email protected].