Privacy Policy
This policy explains what personal data we collect, why we collect it, how long we keep it and what you can require us to do with it. It is written to comply with the Singapore Personal Data Protection Act.
1. Who is responsible
HealthStore Pte. Ltd., 7 Mandai Link, Singapore 728664, is the organisation responsible for personal data collected through this site. Our Data Protection Officer can be reached at dpo@healthstoreofficial.com.
2. What we collect
Identity and contact data: name, email address, telephone number, delivery and billing address. Order data: products purchased, order value, order history, delivery status. Payment data: we receive a payment token and the last four digits of your card. We never see or store full card numbers.
Technical data: IP address, browser and device type, pages viewed, referring source. Communications data: messages you send us and our replies. Marketing data: your subscription status and stated preferences.
3. Why we collect it
To take and fulfil your order, including passing your address to the courier. To take payment and prevent fraud. To answer your questions and handle returns. To meet accounting and tax obligations. To improve the site and the range, using aggregated analytics. To send you marketing, only where you have asked us to.
4. Cookies and tracking
We use functional cookies to keep your cart and session, analytics cookies to understand which pages are useful, and advertising pixels to measure campaign performance. Functional cookies are required for the site to work; the others can be declined without losing any function.
You can clear or block cookies in your browser at any time. Doing so will empty your cart.
5. Who we share it with
Payment processors, to take payment. Courier partners, to deliver your parcel. Our email and helpdesk platforms, to communicate with you. Our accountants and auditors, where required by law. We do not sell personal data, and we do not share it with data brokers.
6. Overseas transfer
Some of our service providers store data outside Singapore. Where that happens we require a standard of protection comparable to the PDPA by contract before any transfer takes place.
7. How long we keep it
Order and transaction records: seven years, as required by Singapore tax law. Marketing consent records: for as long as you remain subscribed, plus twenty-four months. Support correspondence: three years. Analytics data: twenty-six months, in aggregated form.
8. Your rights
You may ask us what personal data we hold about you and how it has been used. You may require us to correct anything inaccurate. You may withdraw consent to marketing at any time, by using the link in any email or by writing to us. You may ask us to delete data we no longer have a legal reason to keep.
We respond to access and correction requests within thirty days. There is no fee for a reasonable request.
9. Security
The site runs over TLS. Payment is handled by PCI-DSS compliant processors. Access to customer records is limited to staff who need it, logged, and reviewed. No system is perfect; if a breach affecting you occurs we will notify you and the Commission as the PDPA requires.
10. Children
This site is not directed at people under 18 and we do not knowingly collect their data. If you believe a minor has given us personal data, contact our DPO and we will delete it.
11. Changes to this policy
We will post any change on this page and update the date at the top. Material changes affecting how we use your data will be notified by email to subscribers before taking effect.