Privacy Policy

Dr Marco Faria Correa Plastic Surgery Pte Ltd (“the Clinic,” “we,” “us,” or “our”) is committed to protecting the privacy and personal data of every individual who interacts with our clinic, whether in person, by telephone, by email, through our website at www.drmarco.com, or through any other communication channel.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights in relation to it. It applies to patients, prospective patients, website visitors, and any other individual whose personal data we hold.

We comply with the Personal Data Protection Act 2012 (PDPA) of Singapore, the Ministry of Health (MOH) Singapore regulations governing healthcare institutions and the handling of medical records, and applicable data protection obligations under the Healthcare Services Act 2020 (HCSA).

By using our website, submitting an enquiry, or engaging our services, you acknowledge that you have read and understood this Privacy Policy.

The Clinic acts as the data controller in respect of personal data collected through this website and through our clinical operations. All decisions about how and why personal data is processed are made by the Clinic.

Registered Name: Dr Marco Faria Correa Plastic Surgery Pte Ltd
Registered Address: Mount Elizabeth Novena Specialist Centre, #10-26/27, 38 Irrawaddy Road, Singapore 329563
Telephone: +65 6464 8075
WhatsApp: +65 9176 1813
Email: [email protected]
Business Hours: Monday to Friday, 10:00 AM to 6:00 PM

For data protection enquiries, contact us at the address or email above, marked for the attention of the Data Protection Officer.

We collect personal data that you provide directly to us and data collected automatically when you use our website.

3.1 Data You Provide Directly

When you contact us through our website contact form, by telephone, by email, or via WhatsApp, we may collect:

• Full name
• Email address
• Phone number
• Type of enquiry or procedure of interest
• Preferred appointment date
• Any message or information you choose to share with us

When you become a patient of the Clinic, we additionally collect:

• Date of birth and NRIC or passport number (for patient identity verification)
• Medical history, current medications, allergies, and pre-existing conditions
• Surgical history and relevant clinical photographs taken for medical record purposes
• Information provided during consultations, clinical assessments, and follow-up reviews
• Payment information sufficient to process your clinical account (we do not store full card details)
• Next-of-kin or emergency contact details where provided

3.2 Data Collected Automatically

When you visit www.drmarco.com, we collect certain technical data automatically through cookies and similar technologies, including:

• IP address and approximate geographic location
• Browser type and version
• Device type and operating system
• Pages visited, time spent on pages, and referral source
• Interaction data such as clicks and form interactions

This data is collected via Google Tag Manager (GTM-TLVXVVJ) and associated analytics tools, including Google Analytics. It is used in aggregate and anonymised form to understand how visitors use our website and to improve its content and performance.

We use your personal data only for the purposes for which it was collected or for related purposes that you would reasonably expect. These purposes include:

4.1 Responding to Enquiries

To respond to messages, questions, and consultation requests submitted through our website contact form, WhatsApp, telephone, or email.

Legal basis: Your consent, given when you submit an enquiry.

4.2 Providing Clinical Care

To assess your suitability for procedures, conduct consultations, perform surgery or clinical treatments, manage your recovery and follow-up care, and maintain accurate medical records in compliance with MOH requirements.

Legal basis: Performance of a contract (your clinical engagement with the Clinic) and compliance with legal obligations under the HCSA and MOH regulations, which require us to maintain patient records for a minimum of six years from the date of last contact or, for minors, until the patient reaches the age of 21 years.

4.3 Clinical Safety and Communications

To send pre-operative instructions, post-operative care guidance, appointment reminders, and follow-up communications relevant to your treatment.

Legal basis: Legitimate interests in providing safe clinical care, and your contractual engagement with the Clinic.

4.4 Administrative and Billing Purposes

To process payments, issue receipts and invoices, and manage clinic administration including scheduling and records management.

Legal basis: Performance of a contract and legitimate interests.

4.5 Compliance with Legal and Regulatory Obligations

To comply with our obligations under Singapore law, including the PDPA, HCSA, MOH licensing conditions, and any other applicable legislation or regulatory requirement. This includes disclosures required by law, court order, or government authority.

Legal basis: Legal obligation.

4.6 Website Analytics and Improvement

To understand how our website is used and to improve its structure, content, and accessibility. This is done using aggregate and anonymised data collected through Google Tag Manager and Google Analytics.

Legal basis: Legitimate interests in maintaining and improving our website.

4.7 Marketing Communications

We do not send unsolicited marketing communications. If you have expressly consented to receive updates about our services, we may send relevant clinical information or service updates. You may withdraw this consent at any time by contacting us at [email protected].

Legal basis: Consent.

Medical and health information is classified as sensitive personal data. We handle all clinical data — including medical history, diagnoses, surgical records, and clinical photographs — with the highest level of care and in accordance with our obligations under the PDPA and MOH regulations.

Clinical photographs taken for medical record purposes are stored securely and are not used for any other purpose, including marketing, without your specific, separate written consent.

We will never sell, rent, or share your medical information with third parties for commercial purposes.

We do not sell your personal data. We may share your data with third parties only in the following circumstances:

6.1 Accredited Surgical Facilities

Dr Marco Faria Correa holds operating privileges at several licensed hospitals and accredited day surgery centres in Singapore, including Mount Elizabeth Novena Hospital, Gleneagles Hospital, Parkway East Hospital, Thomson Medical Centre, Raffles Medical, Mount Alvernia Hospital, Farrer Park Hospital, and other accredited day surgery centres. When procedures are performed at these facilities, relevant clinical information will be shared with the facility’s medical and anaesthetic teams as necessary for your safe surgical care.

6.2 Anaesthetists and Referring Practitioners

Where your procedure requires an anaesthetist, or where you have been referred to or from another practitioner, relevant clinical information will be shared as necessary to coordinate your care.

6.3 Laboratories and Diagnostic Services

Where pre-operative blood tests, imaging, or other diagnostic investigations are required, your identifying information and relevant clinical details will be shared with the relevant laboratory or diagnostic provider.

6.4 Insurance Providers and MediSave

Where you are claiming through a health insurer or through CPF MediSave, we will share the clinical and billing information required to process your claim.

6.5 Service Providers and Technology Partners

We engage third-party service providers to support the operation of our website and clinic systems. These include:

• Google (Google Analytics, Google Tag Manager): For website analytics. Google may process your data in accordance with its own privacy policy. You can opt out of Google Analytics tracking at tools.google.com/dlpage/gaoptout.
• WordPress / Hosting Provider: Our website is built on WordPress and hosted with a CDN (BunnyCDN). Your data processed through the website may be handled by these providers under appropriate data processing agreements.
• WhatsApp (Meta Platforms): When you contact us via WhatsApp, your message is processed by Meta Platforms. We recommend reviewing WhatsApp’s privacy policy at www.whatsapp.com/legal/privacy-policy.
• Email Service Provider: Emails sent to and from our clinic are processed through our email service provider.

All third-party service providers are required to handle your data only as instructed by us and in accordance with applicable data protection law.

6.6 Legal and Regulatory Disclosure

We may disclose personal data to regulators, law enforcement agencies, courts, or government bodies where required by law or where we are legally permitted to do so, including to the Singapore Medical Council or the Ministry of Health in connection with a regulatory matter.

We retain personal data for as long as it is necessary for the purpose for which it was collected, or as required by law.

When personal data is no longer required, it is securely deleted or anonymised.

Our website uses cookies and similar tracking technologies to enable core website functionality, analyse website traffic, and improve the user experience.

8.1 Types of Cookies We Use

Strictly Necessary Cookies: Required for the website to function and cannot be disabled. These do not store any personally identifiable information.

Analytics Cookies: Placed by Google Analytics via Google Tag Manager to collect anonymised data about how visitors use the website. This data helps us understand which pages are most visited and how users navigate the site.

Functional Cookies: Used to remember preferences such as language settings.

8.2 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies or to be alerted when cookies are being sent. Please note that disabling certain cookies may affect the functionality of our website.

For more information about managing cookies, visit www.aboutcookies.org. To opt out of Google Analytics, visit tools.google.com/dlpage/gaoptout.

Under the Personal Data Protection Act 2012 (Singapore), you have the following rights in relation to your personal data:

Right of Access: You may request a copy of the personal data we hold about you and information about how it is being used.

Right of Correction: You may request that we correct any inaccurate or incomplete personal data we hold about you.

Right of Withdrawal of Consent: Where we are processing your personal data on the basis of your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. It may affect our ability to continue providing certain services to you.

Right to Be Informed: You have the right to be notified in the event of a data breach that is likely to result in significant harm to you, in accordance with the PDPA’s mandatory data breach notification obligations.

To exercise any of these rights, please contact us in writing at:

Email: [email protected]
Post: Data Protection Officer, Dr Marco Faria Correa Plastic Surgery Pte Ltd, Mount Elizabeth Novena Specialist Centre, #10-26/27, 38 Irrawaddy Road, Singapore 329563

We will respond to verified requests within 30 days. We may ask you to verify your identity before processing your request.

Please note that certain data — particularly medical records — may not be deleted on request where retention is required by law or where deletion would compromise patient safety.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Secure password-protected clinic and records management systems
• Restricted access to personal and clinical data on a need-to-know basis
• Secure encrypted email and communication channels where applicable
• Regular review of our data protection practices

While we take reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of data transmitted over the internet.

Dr Marco Faria Correa also maintains a clinical practice in Porto Alegre and Rio de Janeiro, Brazil. If you are a patient who has received care at or in connection with the Brazil practice, relevant clinical information may be shared between the Singapore and Brazil practices to support continuity of your care.

Where personal data is transferred outside Singapore, we take steps to ensure it is protected to a standard comparable to the PDPA, including through appropriate contractual safeguards.

Some of our technology service providers, including Google, may process data outside Singapore. We rely on the adequacy mechanisms and standard contractual clauses recognised under applicable law when such transfers occur.

We do not knowingly collect personal data from individuals under the age of 18 through our website without parental or guardian consent. Where a minor is a patient of the Clinic, personal data is collected and processed with the consent of the parent or legal guardian and is handled in accordance with this Privacy Policy and our clinical obligations.

Our website may contain links to external websites, including hospital websites, medical society websites, and social media platforms (Instagram, Facebook, TikTok). This Privacy Policy applies only to www.drmarco.com. We are not responsible for the privacy practices of third-party websites, and we encourage you to review the privacy policies of any external site you visit.

The Clinic maintains profiles on Instagram (@drmarco.fariacorrea), Facebook (marcoaurelio.fariacorrea), and TikTok (@drmarco.fariacorrea). When you interact with us on these platforms, your interactions are subject to the privacy policies of those platforms. We do not control the data practices of these platforms and are not responsible for how they use your data.

We do not collect or store social media data unless you contact us directly through a platform and we respond, in which case the contents of that communication may be retained as a record of your enquiry.

As a licensed healthcare institution in Singapore, we comply with the following MOH-specific data obligations:

• Patient medical records are maintained in accordance with MOH guidelines on medical records management.
• Clinical photographs are taken only for the purpose of medical documentation and treatment planning, and are stored as part of the patient’s confidential medical record.
• We do not publish clinical photographs, before-and-after images, or patient testimonials in advertising or marketing materials, in compliance with MOH Healthcare Services Act advertising regulations.
• Patient information is not shared with third parties for commercial or marketing purposes without your specific written consent.
• In the event of a medical emergency or for the purposes of continuing clinical care, we may share relevant medical information with other healthcare professionals as permitted under the PDPA’s healthcare exceptions.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or regulatory guidance. The “Last Updated” date at the top of this page will be revised whenever changes are made.

We encourage you to review this page periodically. Where changes are material, we will take reasonable steps to inform you, which may include a notice on our website or direct communication where appropriate.

Continued use of our website or our services following an update constitutes your acknowledgement of the revised Privacy Policy.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us:

Dr Marco Faria Correa Plastic Surgery Pte Ltd
Mount Elizabeth Novena Specialist Centre
#10-26/27, 38 Irrawaddy Road
Singapore 329563

Tel: +65 6464 8075
WhatsApp: +65 9176 1813
Email: [email protected]
Business Hours: Monday to Friday, 10:00 AM to 6:00 PM

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.

This Privacy Policy is governed by and construed in accordance with the laws of Singapore. Any disputes relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Singapore.

This Privacy Policy was last reviewed and updated on 16 July 2026.