Privacy notice

Oreka coordinates home physiotherapy in Singapore. Oreka is the trading name of Oreka Pte Ltd, a company registered in Singapore (UEN 202647400R). Our Data Protection Officer is Oreka’s owner, reachable at dpo@oreka.sg; a postal address will follow.

Patients; family members, friends or representatives who contact us for someone else; people named as emergency contacts or to receive updates; physiotherapists who apply to work with Oreka (section 13); and visitors to this website.

• When you enquire: who needs care and your relationship to them, an age range, a postal code, the kinds of help needed and goals, how the person moves around, home-access notes, timing preferences, and a name and WhatsApp number.
• If a physiotherapist accepts and you register: date of birth, full address and access details, who will be home, relevant health information (condition, history, precautions, medications), an emergency contact and anyone you choose to receive updates. You can also upload a discharge summary or scan report.
• While we arrange care: notes of calls and messages, including your answers to safety and background health questions on the call (such as the part of the body affected, recent hospital care and other conditions), visit times and outcomes, and a record of what was shared with your physiotherapist and when.
• Payment: amounts, dates and the payment reference. You pay by a link, on the page of our payment provider, Airwallex. Oreka never sees or stores your card number.
• This website: the technical records needed to keep it secure, and a count of visits to the public pages through Cloudflare Web Analytics, which uses no cookies and is kept off the registration page and the staff and physiotherapist apps. We use no advertising or analytics cookies.

If you contact us for another person, you tell us how you are acting for them: with their permission; as the parent or guardian of someone under 18; as their donee under a registered lasting power of attorney or their court-appointed deputy; or, where they cannot decide for themselves and have neither, as the family member or carer responsible for their care. If they do not yet know about the enquiry, we use what you give us only to talk to you and to check with them or their representative. No physiotherapist sees anything until they, or someone able to act for them, agree, and if nobody agrees within 30 days we delete it. We confirm how you are acting again at registration. Please tell the people you name — emergency contacts and update recipients — that you have given us their details.

• To understand what is needed, and whether home physiotherapy through Oreka is suitable.
• To propose a suitable physiotherapist, share the relevant record with the one who accepts, and arrange visits.
• To take payment for visits that took place, send receipts, give refunds and pay physiotherapists.
• To keep people safe, including contacting emergency services or next of kin in an emergency.
• To keep the service secure, prevent misuse, handle complaints and meet our legal obligations.
• Only with your separate permission: to send you occasional news about Oreka.

Your consent, or the consent of the person acting for the patient; what is reasonably needed to provide the service you asked for; our legitimate interests in keeping the service secure and preventing fraud and misuse (never for marketing); and, in an emergency, the exceptions the law allows to protect someone’s life, health or safety. You can ask our Data Protection Officer about any of these.

• Your physiotherapist. When a case is proposed, a physiotherapist sees a short summary — an area, an age range and the kind of help needed, not your name or address. The fuller record, your registration and the background you gave on the call, goes only to the physiotherapist who accepts, only after Oreka staff review it, and only what is relevant to the visits.
• Service providers who work for us: Cloudflare (hosting, security and email); Airwallex (payments); WhatsApp, run by Meta, for the messages you exchange with us; OneMap, run by the Singapore Land Authority, which receives postal codes only, to estimate travel times; and Google, whose email service holds our staff alerts (which contain no patient details) and any message you send to our Data Protection Officer’s address.
• In an emergency: emergency services, and next of kin where needed.
• Where the law requires it: public authorities.

We do not sell personal information, and we do not share it for anyone else’s advertising.

We ask only for what a safe visit needs. Staff access is limited by role, and every sensitive read is recorded. Documents are kept in private storage with no public link. Health information is kept out of analytics and logs. Please do not send medical details or documents by WhatsApp: we send a secure form instead.

Agreeing to care coordination does not sign you up for marketing. We send marketing messages only if you tick a separate box, which starts unticked, and you can stop them at any time by telling us. Messages about your own care are not marketing.

Oreka’s service is for adults. If an enquiry is about someone under 18, a person at Oreka reviews it before anything else happens, and we work with a parent or guardian. If an adult cannot make a decision themselves, we work with their donee under a registered lasting power of attorney or their court-appointed deputy; where there is neither, with a family member or carer responsible for their care, who acts in their best interests.

Our systems are hosted with Cloudflare, with storage primarily in the Asia-Pacific region. Our service providers may process information in other countries; where they do, we rely on contractual protections or recognised certifications (Cloudflare, for example, holds Global CBPR and Global PRP certification) so that it is protected to a standard comparable to Singapore’s, or on the transfer being needed to provide the service you asked for — for example, the WhatsApp messages you exchange with us.

Encrypted connections; sign-in through a verified identity provider for staff and physiotherapists, with access checked for every case and every action; a record of sensitive reads and of every change; private document storage; and registration links that expire and are stored only in scrambled form.

13. If you apply as a physiotherapist

We collect your contact details, professional registration and practising certificate, indemnity cover, qualifications, whether you may work in Singapore, languages, the areas you cover, your usual hours and, if you choose, the postal code you usually set out from, and the PayNow mobile number or UEN we pay you through. We use them to check your registration with the Allied Health Professions Council, to decide whether to work with you, to match you with patients and to pay you. We record who checked your registration, practising certificate, indemnity certificate, photo identification and right to work in Singapore, and when, but keep no copy of any of them and no identity number. Payout figures and your PayNow details are seen only by Oreka’s owner and finance. The postal code you set out from is used only to estimate travel times and is never shown to patients.

If you choose to, you can write a profile for our website in your app. It shows only with your consent and once we approve it: the name and photo you give, what you write, the conditions you treat, the languages you speak and your years of experience. We remove your photo’s location and camera details. It comes off the website at once if you take it down, and then we delete it and the photo.

• Enquiries that do not lead to a visit: 12 months after our last contact, then deleted or anonymised.
• The record of care arranged through Oreka — including consents, corrections, what was shared and visits: 7 years after the last visit; if the patient was under 21 at the last visit, until their 25th birthday if that is later.
• Uploaded documents: 12 months after the case closes. We keep a note that a document was shared, not the document.
• Payment and payout records: 7 years.
• Anything connected to an open complaint or dispute: until it is resolved, and at least for the periods above.
• Physiotherapist applications we do not take forward: 12 months; for physiotherapists we work with, 7 years after we stop.
• A physiotherapist’s website profile and photo: until they take it down or their account is deleted.

Your physiotherapist keeps their own clinical notes of your care, as their professional rules require.

• See what we hold, and how it has been used or shared in the past year.
• Correct it. We keep both the original and your correction, and pass the correction to the physiotherapist who received the record. A professional opinion is not rewritten, but your comment is added to it.
• Withdraw consent. We explain what that means for your care, and act on it within about 10 business days.

Write to dpo@oreka.sg. We reply as soon as we can and within 30 days, or tell you within those 30 days when we will. Corrections and withdrawals are always free. For a large request to see what we hold, we may charge a reasonable fee, but only after telling you the amount in writing.

If your information is affected by a data breach that is likely to cause significant harm, we will tell you and the Personal Data Protection Commission as the law requires.

Only what the site needs to work: a sign-in cookie for staff and physiotherapists, a cookie that remembers which sign-in you chose, and — while you fill in an enquiry — a copy of your answers kept in your own browser until you close the tab. No advertising or tracking cookies.

We post any change to this notice here, with its date. If we want to use your information for a new purpose, we tell you first and, where the law requires, ask for your consent. If Oreka’s business moves to a new company, your information moves with it, and we will tell you. If you are unhappy with how we have handled your information, please contact our Data Protection Officer first. You can also contact the Personal Data Protection Commission (pdpc.gov.sg).