Announcement

30 Days Money Back Guarantee Free shipping, West Malaysia Beware Counterfeit Product
30 Days Money Back Guarantee Free shipping, West Malaysia Beware Counterfeit Product

Privacy Policy

Last updated: 24 September 2026

1. Who we are

my.omniwell.store ("Omniwell", "we", "us") is operated by ULTRARE ENTERPRISE, a business registered in Malaysia (registration no. 202203216008), trading as ULTRARE.

ULTRARE ENTERPRISE is the data controller for personal data collected through my.omniwell.store and the related Malaysia sales channels (our WhatsApp line, email and social media pages). We are an authorised reseller of Wellous products.

This policy explains how we handle your personal data under Malaysia's Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024.

Contact for privacy matters
  • Email: privacy@omniwell.store
  • WhatsApp: +60 10-666 7296
  • Post: ULTRARE ENTERPRISE, 22, Jalan Keembong 10, Taman Johor Jaya, 81100 Johor Bahru, Johor, Malaysia

Purchases from sg.omniwell.store are made with OMNIWELL INTERNATIONAL PTE. LTD. and are covered by the privacy policy on that site.

2. Personal data we collect

  • Identity and contact: name, email address, phone number.
  • Delivery and billing: delivery address, billing address.
  • Order details: products bought, order value, order history, returns and refund requests.
  • Payment: payment method, transaction status, last four card digits. Full card and online banking details are handled by our payment providers and never stored by us.
  • Account: login email, password (stored encrypted), saved addresses.
  • Messages: what you send us by WhatsApp, email, contact form or social media.
  • Device and usage: IP address, browser and device type, pages viewed, how you arrived on our site, actions such as adding to cart or checking out.
  • Marketing preferences: whether you agreed to receive promotions, and on which channel.
  • Health-related information: only if you choose to tell us about symptoms or health conditions, for example when asking whether a product suits you (see section 8).

You do not have to give us your personal data. Without your name, contact details and address, however, we cannot process or deliver an order.

3. How we collect it

  • From you: when you place an order, create an account, message us or sign up for promotions.
  • Automatically: through cookies and similar technologies when you browse our site (see section 5).
  • From partners: payment confirmations from Billplz and Stripe, delivery status from our couriers, and, where you interact with our ads, limited information from Meta and Google.

4. Why we use it

We use your personal data to:
  1. Process, pay for, deliver and track your orders.
  2. Handle returns, refunds and our 30-day money-back guarantee.
  3. Answer your questions and provide customer support.
  4. Verify that products are authentic and protect you from counterfeits.
  5. Manage your account.
  6. Send promotions and product updates, only where you have agreed (see section 9).
  7. Measure and improve our website, and measure and show relevant advertising (see section 5).
  8. Prevent fraud and keep our site and systems secure.
  9. Meet our legal, tax and accounting obligations.

We will ask for your consent before using your personal data for a purpose not listed here.

5. Cookies, tracking and advertising

We use cookies and similar technologies to run the store, understand how it is used and measure our advertising.

  • Essential: keeps your cart and login working and secures checkout. Provided by our website (WordPress, WooCommerce).
  • Analytics: counts visits and shows which pages and products people use. Provided by Google Analytics and Google Tag Manager.
  • Advertising: measures which ads lead to purchases and shows our ads to people who visited our site. Provided by the Meta (Facebook, Instagram) Pixel and Conversions API.

Server-side tracking. Some tracking runs through our own server using Stape. When you place an order, we may send Meta a hashed (scrambled, one-way encoded) version of your email and phone number, together with the order value and products. Meta uses this to match the purchase to an ad you saw. It does not receive your details in readable form from us.

Your choices
  • Block or delete cookies in your browser settings. Essential cookies are needed for checkout to work.
  • Control ad personalisation in your Facebook and Instagram settings (Settings > Accounts Center > Ad preferences) and at adssettings.google.com.
  • Opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout.

6. Who we share it with

We do not sell your personal data. We share it only as needed to run the store:

  • Billplz: processes FPX online banking payments.
  • Stripe: processes card payments.
  • Courier and delivery companies: deliver your order.
  • Website hosting, checkout and email service providers: run our site, checkout and order emails.
  • Meta and Google: analytics and advertising (see section 5).
  • WhatsApp (Meta): customer support messages you start with us.
  • Wellous: product authenticity checks and product-related queries, where needed. We place your order through the Wellous order portal, so Wellous receives your name, phone number, delivery address and order details to supply your products and, where they ship directly, deliver them.
  • Professional advisers: accountants, auditors and lawyers, under a duty of confidentiality.
  • Authorities: where the law requires it, or to protect our rights and prevent fraud.

Our service providers may use your data only to provide their service to us.

7. Transfers outside Malaysia

Some of our service providers store or process data outside Malaysia, including Stripe, Meta, Google, Stape and our hosting provider. Their servers may be in Singapore, the United States, the European Union or elsewhere.

When we transfer your personal data outside Malaysia, we take steps required by the PDPA to ensure it stays protected, such as using providers bound by data protection terms and security standards at least equivalent to Malaysian law.

8. Health-related information

Our products are dietary supplements, and some customers tell us about digestive or other health concerns when asking for advice. Under the PDPA, health information is sensitive personal data.

  • We only use it to answer your question or handle your order, and only with your explicit consent. When you share health details, we will ask you to confirm that you agree to us using them for that purpose.
  • We do not use it for advertising and do not send it to Meta or Google.
  • You can ask us to delete it at any time.

Our team can share general product information but does not give medical advice. Please consult a doctor about any medical condition.

9. Marketing

We send promotions by email, WhatsApp or SMS only if you have opted in, for example by ticking the box at checkout or asking to join our list.

You can stop anytime: click "unsubscribe" in an email, reply STOP to a WhatsApp or SMS message, or contact us. Stopping marketing does not affect messages about your orders.

10. How long we keep it

  • Order, payment and invoice records: 7 years after the order, as required for tax and accounting.
  • Customer account: until you ask us to close it, or after 3 years of no activity.
  • Support messages: 2 years after the conversation ends.
  • Health-related information: deleted once your question is resolved, or sooner on request.
  • Marketing list: until you unsubscribe.
  • Analytics and advertising data: as set by Google and Meta; Google Analytics is set to 14 months.

When we no longer need your data, we delete or anonymise it.

11. Security and data breaches

We protect your data with encrypted (HTTPS) connections, secure payment providers, access limited to staff who need it, and regular software updates.

If a data breach is likely to cause you significant harm, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it, and notify you without unnecessary delay, as the PDPA requires.

12. Your rights

Under the PDPA you can:
  • Access the personal data we hold about you.
  • Correct data that is inaccurate, incomplete or out of date.
  • Withdraw consent to our use of your data, including for marketing.
  • Limit how we use your data, including to stop processing likely to cause you damage or distress.
  • Transfer your data to another organisation where technically feasible (data portability).
  • Ask us to delete data we no longer need, except records we must keep by law.

To make a request, email privacy@omniwell.store or write to the address in section 1. We may need to verify your identity first. We will respond within 21 days. We may charge the fee permitted under the PDPA regulations for access requests, and will tell you before we do.

If you are not satisfied with our response, you can complain to the Personal Data Protection Commissioner (pdp.gov.my).

13. Other matters

Children. Our store is not directed at children under 18. We do not knowingly collect personal data from them.

Changes. We may update this policy. We will post the new version here with a new "last updated" date, and tell you directly of any major change.

Language. This policy is available in English and Bahasa Malaysia. If the two versions differ, the English version prevails.

Contact. Questions about this policy: privacy@omniwell.store or WhatsApp +60 10-666 7296.