Parties
- The Clinic — the healthcare provider using the Platform — the "Controller" (data user / data controller under the PDPA); and
- mySihat Digital Sdn. Bhd. (202601029229 (1691324-U)), of 11, Jalan Teknologi 3/3A, Taman Sains Selangor 1, Kota Damansara, 47810 Petaling Jaya, Selangor, Malaysia — the "Processor" ("mySihat").
In case of conflict with the Terms of Service on data-protection matters, this DPA prevails.
Recitals
- The Controller is the data controller / data user for its patients' and staff's personal data. The patient is the data subject, and the data is about, and belongs to, the patient and the Controller — not the Processor.
- The Processor provides the mySihat platform and processes personal data solely on behalf of and on the documented instructions of the Controller.
1. Roles and scope
As between the parties, the Controller is the data controller and the Processor is the data processor. The Processor acquires no rights in the personal data beyond those needed to perform the agreement. The Processor processes personal data only (a) on the Controller's documented instructions (the Terms, this DPA, and the Controller's configuration and use of the Platform), and (b) as required by Malaysian law, informing the Controller first where lawful. The details of processing are in Schedule 1.
2. Controller's obligations
The Controller warrants it has authority to appoint the Processor; has a lawful basis and all required notices/consents (including explicit consent for sensitive health data); gives lawful instructions; complies with the PDPA, its medical-confidentiality duty and applicable healthcare laws; and submits accurate data.
3. Processor's obligations
- process personal data only as instructed (Clause 1);
- implement and maintain the security measures in Schedule 2;
- ensure authorised personnel are bound by confidentiality and granted least-privilege access;
- not sell personal data or use it for its own purposes (including advertising or AI/ML training), other than fully anonymised aggregate statistics;
- assist the Controller with data-subject requests and its PDPA compliance;
- make available information reasonably necessary to demonstrate compliance, and maintain records of processing.
4. Security
Taking into account the high risk of health data, the Processor implements the measures in Schedule 2, including encryption of personal data, access controls, audit logging and protection against unauthorised access, and reviews and improves them over time (without materially reducing protection).
5. Sub-processing
The Controller provides general written authorisation for the sub-processors in Schedule 3. The Processor imposes equivalent data-protection obligations on each by written contract, remains fully liable for them, and gives the Controller prior notice (at least 30 days where practicable) of any addition or replacement, with a right to object on reasonable grounds.
6. Data subject rights
The Processor assists the Controller — including through the Platform's access, correction and export functions — to fulfil data-subject requests under the PDPA (access, correction, withdrawal of consent, limiting direct marketing, and data portability). If a data subject contacts the Processor directly, it forwards the request to the Controller and does not respond substantively except to acknowledge and redirect, unless required by law.
7. Personal data breach notification
The Processor notifies the Controller without undue delay, and within 72 hoursof becoming aware of a breach affecting the Controller's personal data, with the information known (nature, categories and approximate numbers affected, likely consequences, and measures taken). The Processor assists the Controller's own notification duties; as between the parties, the Controller decides whether and how to notify the Commissioner and data subjects.
8. Audit
On reasonable request (no more than once per 12 months, or following a breach or a Commissioner requirement), the Processor makes available information to demonstrate compliance, and permits an audit by the Controller or an independent auditor under confidentiality, conducted so as not to compromise other customers' data.
9. Cross-border transfer
The Processor does not transfer personal data outside Malaysia except as in Schedule 4, and only where protections substantially consistent with the PDPA, or another lawful basis under the PDPA (as amended), apply.
10. Return and deletion
On termination, the Processor returns and/or securely deletes the personal data (and copies) at the Controller's choice, unless retention is required by law, making it available for export for 30 days first. The Controller remains responsible for retaining medical records for the minimum periods required by law (generally at least 7 years, longer for minors). The Processor certifies deletion in writing on request.
11. Liability and term
Each party is responsible for its own PDPA compliance in its role. Liability limits in the Terms apply, except for wilful misconduct, gross negligence, or breaches of confidentiality; each party indemnifies the other for fines/penalties arising from its breach. This DPA is governed by the laws of Malaysia (courts of Selangor) and remains in force while the Processor processes personal data for the Controller.
Schedule 1 — Details of processing
Subject-matter: provision of the mySihat platform. Duration: the term of the agreement plus the export/deletion period. Nature & purpose: hosting, storing (encrypted), organising, retrieving, displaying, transmitting, encrypting/decrypting and deleting personal data, solely to operate the Platform's modules.
Categories of data subjects: the Controller's patients (including minors/dependants) and its staff/authorised users.
Personal data (non-sensitive): identity & demographics (name, NRIC/IC or passport, phone, email, age, DOB, gender, race, address, patient reference/MRN, photo); staff account data (name, email, role, permissions); billing data; technical/security data (login events, IP, user agent, audit entries).
Sensitive personal data (health): examination notes; vital signs; lab/imaging orders and results; diagnoses; treatment plans, prescriptions, dosages, procedures, injections; medical certificates, time-slips, referrals and clinical documents; visit/consultation history; insurance/panel information.
Schedule 2 — Security measures
- Encryption at rest (application layer): AES-256-GCM applied before storage; random nonce per value; tampered ciphertext fails on decrypt; plaintext not stored in the database.
- Blind indexing: one-way keyed HMAC-SHA256 indexes (IC, name) for lookup without readable values.
- In transit: HTTPS/TLS everywhere.
- Key management: encryption key held only in the application environment, never in code or the database; rotation procedures defined.
- Access control: managed authentication; role-based access (superadmin / admin / clinic / staff / patient) with per-staff scoping; database Row-Level Security; server-side-only privileged access.
- Attack resilience: rate limiting and tiered lockouts; constant-time login handling; authenticated webhooks.
- Logging & monitoring: application audit trail and authentication logs; monitoring designed to exclude health data.
- Organisational: confidentiality obligations; need-to-know access; secrets in environment configuration; secure development and change management; a breach incident-response process.
Schedule 3 — Authorised sub-processors
| Sub-processor | Service | Data involved | Region |
|---|---|---|---|
| Supabase | Managed database, authentication, storage | Encrypted patient records, account data, auth logs | Malaysia (Kuala Lumpur) |
| Email — Resend / SMTP | Transactional email | Recipient email; patient details where included by the Controller | — |
| Nextcloud file storage | Document / lab-report / attachment storage | Clinical documents and files uploaded by the Controller | — |
| Hosting & infrastructure — Yotta / Dokploy | Application hosting | Application data in transit/processing | Malaysia (Kuala Lumpur) |
| InfluxDB | Operational monitoring/telemetry | Telemetry, designed to exclude health data | — |
Schedule 4 — Cross-border transfer
Primary hosting location: Malaysia (Kuala Lumpur). The parties intend for personal data to be hosted within Malaysia where feasible. To the extent any sub-processor stores or processes personal data outside Malaysia, such transfer is undertaken only where (a) there are protections substantially consistent with the PDPA, or (b) another lawful basis under the PDPA (as amended) applies, and (c) the transfer is limited to what is necessary to provide the Platform.
For the signed contractual copy and execution block, refer to the version provided during clinic onboarding. Questions: dev@mysihat.digital. Regulator: https://www.pdp.gov.my.