Last updated: 13 October 2026
This notice explains what personal information Heal by Norman collects when you visit this website or book a session, why we collect it, who we share it with, and what rights you have over it. It is issued in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA) and its subsequent amendments.
We only collect what we need to serve you. We never sell your data. We never share your session content with anyone. You can ask us to delete your information at any time.
Heal by Norman ("we", "us", "our") is a healing and coaching practice operating from Malaysia, offering Pranic Healing, inner child healing, meditation guidance, and related wellness services both in person and online worldwide.
This notice covers healbynorman.com and all of its pages, including our booking, workshop, and partner pages. It does not cover third-party websites we link to, which have their own policies.
We do not collect or store your credit card or bank details. All payments are handled by our payment providers on their own secure systems. We never see your full card number.
| What we collect | Why | Legal basis |
|---|---|---|
| Name, email, phone | To confirm bookings, send session details, and respond to enquiries | Performance of a contract |
| Booking and payment records | To process payment, issue receipts, and keep accounting records | Legal obligation |
| Email address (newsletter) | To send occasional updates, offers, and event invitations | Your consent |
| Website usage data | To understand which content is useful and improve the site | Legitimate interest |
Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect anything we did lawfully before you withdrew it.
Anything you share during a healing or coaching session is treated as strictly confidential. We do not discuss it, publish it, or share it with any third party.
We may keep brief private notes to support continuity of your care across sessions. These notes are kept securely and are never shared.
We will never use your name, photograph, story, or session content in marketing, on social media, or as a testimonial without your separate, explicit, written permission. You may withdraw that permission at any time and we will remove the content.
The only circumstances in which we may disclose session information without your consent are where we are compelled to do so by law, by a court order, or by a regulatory authority, or where there is a serious and immediate risk to your life or to someone else's.
What you share in a session may touch on your physical or emotional wellbeing. Information of that kind is treated as sensitive personal data under the Malaysian PDPA, and as a special category of personal data under the UK and EU GDPR, which means it carries stricter protection than ordinary contact details.
We process it only with your explicit consent, which you give when you book and attend a session, and only for the purpose of delivering your care. You may withdraw that consent at any time, and we will stop processing it and delete our notes on request.
Please note: our services are complementary wellness practices. They are not medical treatment, psychiatric care, or psychotherapy, and nothing shared with us carries legal medical confidentiality or privilege.
We do not sell, rent, or trade your personal information. We share it only with service providers who help us run the practice, and only to the extent they need it:
These providers process your data on our instructions and are bound by their own data protection obligations.
Our partner pages contain affiliate links to other businesses. If you click one, you leave our site and that business collects your information under its own privacy policy, not ours. We may earn a small commission from purchases you make, at no extra cost to you. We do not pass your personal information to these partners.
A cookie is a small file placed on your device. This site uses:
Most browsers let you refuse or delete cookies in their settings. If you block them, some parts of the site may not work properly.
We use secure HTTPS encryption across the whole site, password-protected accounts, and reputable service providers with their own security standards. Access to client information is limited to those who need it to deliver your service.
No method of transmission over the internet is completely secure, and we cannot guarantee absolute security. If a data breach occurs that is likely to cause you significant harm, we will notify you and the relevant authority as required by law.
Under the PDPA and comparable laws, you have the right to:
To exercise any of these rights, contact us using the details in section 13. We will respond within 21 days as required under the PDPA. We may ask you to verify your identity first. There is normally no charge.
We serve clients worldwide, and some of our service providers store data outside Malaysia. Where your information is transferred abroad, we take reasonable steps to ensure it receives a level of protection comparable to that required under Malaysian law, and we transfer it only where this is necessary to deliver the service you asked for or where you have given consent.
Malaysia is not currently the subject of an adequacy decision by the European Commission. Where we receive personal data from the United Kingdom or the European Economic Area, we rely on your explicit consent and on the necessity of the transfer for the performance of our agreement with you.
If you are located in the UK or the EEA, the UK GDPR or the EU GDPR applies to our processing of your information. In addition to the rights listed in section 9, you have the right to object to processing, the right to restrict processing, and the right to receive your data in a portable format.
You may lodge a complaint with your own supervisory authority. In the United Kingdom this is the Information Commissioner's Office. In the EEA it is the data protection authority of the country where you live or work.
If you are located in Singapore, the Personal Data Protection Act 2012 applies. You may withdraw consent, request access to and correction of your data, and lodge a complaint with the Personal Data Protection Commission.
If you are located in Australia, the Privacy Act 1988 and the Australian Privacy Principles apply. You may request access to and correction of your data, and complain to the Office of the Australian Information Commissioner.
If you are in another region with its own data protection law, including residents of certain United States states, you may have additional rights. Contact us and we will honour any right you are entitled to under your local law.
Our services and this website are intended for adults aged 18 and over. We do not knowingly collect personal information from children. Where a session involves a minor, we require the consent of a parent or legal guardian, who must be contactable throughout. If you believe a child has provided us with personal information, please contact us and we will delete it.
We may update this notice from time to time to reflect changes to our practice or to the law. The date at the top of this page shows when it was last revised. Material changes will be announced on this page. We encourage you to review it occasionally.
For any question about this notice, or to exercise any of your rights:
If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Ministry of Digital, Malaysia.