This Privacy Policy explains how mySihat Digital Sdn. Bhd.("mySihat", "we", "us") handles personal data in connection with the mySihat clinic management platform (the "Platform"). It is written to comply with the Personal Data Protection Act 2010 (Act 709)("PDPA"), as amended by the Personal Data Protection (Amendment) Act 2024, the Personal Data Protection Standard 2015, and the directions of the Personal Data Protection Commissioner of Malaysia.
1. The most important thing: our role
We are a data processor, not the owner of patient data. The medical and personal data is about, and belongs to, the patient; the clinic decides why and how it is processed.
| Party | PDPA role | Plain meaning |
|---|---|---|
| The patient | Data Subject | The data is about, and belongs to, you. |
| The clinic (our customer) | Data Controller / "Data User" | Decides why and how patient data is processed; holds the primary legal duty over it, including medical confidentiality. |
| mySihat | Data Processor | Processes patient data only on the documented instructions of the clinic, solely to operate the Platform. We do not own it, sell it, or use it for our own purposes. |
For patient data, the clinic is responsible for what is collected and why, for obtaining consent, and for honouring your rights. We are responsible for processing that data securely and only as the clinic instructs. The relationship is governed by our Data Processing Agreement with each clinic.
2. When mySihat is a controller in its own right
We act as a data controller only for a limited set of data where we decide the purpose: clinic account and staff contact details, our own billing records, support communications, security and audit logs, and operational telemetry (designed to exclude patient health data). For everything else — patient records — the clinic is the controller.
3. Patient data we process on behalf of clinics
The clinic — not mySihat — determines that this data is collected:
Identity & demographics
Name, NRIC/IC or passport number, phone, email, age, date of birth, gender, race, address, patient reference / medical record number, profile photo.
Sensitive clinical data (health data)
- Examination notes — chief complaint, clinical findings;
- Vital signs — blood pressure, heart rate, temperature, SpO₂, respiratory rate, height, weight;
- Lab and imaging orders, test codes and results;
- Diagnoses;
- Treatment plans, prescriptions, medication dosage and instructions, procedures, injections;
- Medical certificates, time-slips, referrals and other clinical documents;
- Visit and consultation history; insurance / corporate panel information.
Billing data
Invoices, line items, panel/corporate billing, payment status, method and amount.
How patient data is protected at the data layer: patient identity fields and the clinical health fields above are encrypted with AES-256-GCM at the application layer beforethey are written to the database — the plaintext never exists in the database. IC numbers and names are additionally indexed using a one-way keyed hash ("blind index") so lookups work without storing the value in readable form. We do not sell patient data or use it for advertising or to train AI/ML models for our own purposes.
4. How we collect data
- From the clinic and its staff, when they register and enter patient and clinical records;
- From patients directly, via the patient portal or IC-based login;
- From connected devices (e.g. MyKad/smart-card readers) where the clinic enables them;
- Automatically — login, security and audit events, and limited technical data.
5. Why data is processed
Patient data (as processor): solely to provide the Platform to the clinic — registering patients; recording consultations, vitals, lab orders, diagnoses and prescriptions; producing medical certificates; generating invoices; enabling the patient portal; and maintaining audit trails. We do not process patient data for any purpose of our own.
Controller data: to operate, secure, support, bill for and improve the Platform, and to comply with law.
6. Who data is shared with
We do not sell personal data. We disclose it only:
To sub-processors acting for us
| Sub-processor | Function | Data involved |
|---|---|---|
| Supabase | Managed database, authentication, storage | Encrypted patient records, account data, auth logs |
| Email provider (Resend / SMTP) | Transactional email (invoices, reports, notifications) | Recipient email; patient details where the clinic includes them in a document |
| Nextcloud file storage | Storage of documents, lab reports and attachments | Clinical documents and files uploaded by the clinic |
| Hosting & monitoring (Yotta / Dokploy; InfluxDB) | Application hosting and operational monitoring | Application data in transit; telemetry designed to exclude health data |
Sub-processors process data only on our instructions, under contract, and subject to confidentiality and security obligations. The authoritative list is maintained in the Data Processing Agreement.
Also
- To the clinic and its authorised users, under role-based access controls;
- Where required by Malaysian law, court order, or a lawful regulator/law-enforcement request;
- As part of a business transfer, subject to the protections in this Policy.
7. How we protect data
- Encryption at rest (application layer): AES-256-GCM applied before storage; a random nonce per value; tampered ciphertext fails to decrypt.
- Blind indexing: one-way HMAC-SHA256 indexes for IC number and name.
- Encryption in transit: HTTPS/TLS for all connections.
- Key management: the encryption key is held only in the application environment, never in source code or the database.
- Access control: managed authentication, role-based access, per-staff permission scoping, and database Row-Level Security.
- Brute-force protection: rate limiting, tiered lockouts, and constant-time login handling.
- Audit logging: an application audit trail plus authentication logs.
- Least privilege & secrets management: privileged database access is server-side only.
8. Cross-border transfer
Personal data is hosted in Malaysia (Kuala Lumpur). Where any processing or storage occurs outside Malaysia (e.g. through a cloud region or a sub-processor located abroad), we ensure it takes place only where there are protections substantially consistent with the PDPA, or another lawful basis under the PDPA (as amended) applies.
9. Retention
Patient data (as processor): retained for as long as the clinic instructs and maintains an active subscription. The clinic sets the retention period, consistent with its medical-record retention obligations (under the Private Healthcare Facilities and Services Act 1998 and applicable guidance, medical records are generally kept for at least 7 years from the last entry, and longer for minors). On termination, we return or delete patient data as set out in the Data Processing Agreement.
Controller data:retained for the life of the clinic's account and a reasonable period afterwards for legal, accounting, tax and security-audit purposes, then securely deleted or anonymised.
10. Your rights
Under the PDPA (as amended) you have rights to:
- Access the personal data held about you;
- Correct inaccurate, incomplete or out-of-date data;
- Withdraw consent (where processing relies on consent);
- Limit processing for direct marketing;
- Data portability — request transfer of your data, where technically feasible;
- Lodge a complaint with the Personal Data Protection Commissioner.
Because the clinic is the controller of patient data, patients should direct requests about their medical records to their clinicfirst. mySihat will assist the clinic but will not independently disclose or change patient data without the clinic's instruction, except where the law requires. For data where mySihat is the controller, contact us at dev@mysihat.digital.
11. Data breach notification
We maintain an incident response process. For patient data, we notify the affected clinic (controller) without undue delay so the clinic can meet its duties. Under the 2024 Amendment, breaches must be notified to the Commissioner within the prescribed timeframe (a 72-hour expectation applies), and affected individuals must be notified where a breach is likely to cause significant harm.
12. Data Protection Officer
Our current data-protection point of contact is dev@mysihat.digital. We are appointing and registering a Data Protection Officer in line with the 2024 Amendment and will update this Policy with the DPO's details.
13. Contact us
- Data protection / privacy: dev@mysihat.digital
- General / support: dev@mysihat.digital
- Post: mySihat Digital Sdn. Bhd., 11, Jalan Teknologi 3/3A, Taman Sains Selangor 1, Kota Damansara, 47810 Petaling Jaya, Selangor, Malaysia
You may also contact the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) at https://www.pdp.gov.my.
14. The mySihat mobile app
The mySihat patient app is the interface through which a patient reaches the records their clinic holds. Most of what the app shows is data processed on behalf of the clinic, as described in section 3. This section covers what the app itself does on the patient's device.
Location
The app can sort clinics by how near they are, so that a patient booking a visit sees the closest one first. Location is requested only when the patient taps to use it on the booking screen. It is never collected in the background, and the app does not ask for it when it starts.
The patient's location never leaves their device.The distance to each clinic is calculated on the phone itself, from coordinates the clinic has published. mySihat does not receive, store or transmit a patient's location, and does not use any mapping, geocoding or location-lookup service. Declining the permission changes nothing except the order in which clinics are listed.
Camera and photos
A patient may set a profile picture, taken with the camera or chosen from their photo library. The app requests access only at the moment the patient chooses to add or change the picture. The picture is stored privately, is not published, and is used for nothing other than displaying it back to the patient and — where the patient has approved a family link — to that family member. The patient can remove it at any time.
Notifications
If a patient allows notifications, the device is issued an anonymous push token, which we store so that we can send alerts to that device. The token identifies a device, not a person, and is deleted when the patient signs out or disables notifications.
Notifications tell a patient that something has happened — an appointment was confirmed, results are ready, it is their turn at the clinic. They never contain clinical values. Test results, medication names, dosages and vital-sign readings are encrypted before they reach our database, and the systems that compose notifications cannot read them.
Biometric sign-in
A patient may choose to unlock the app with a fingerprint or face. This is handled entirely by the phone's operating system, which tells the app only whether the check passed. No fingerprint or facial data is available to the app, and none is transmitted or stored by mySihat.
Encryption on the device
Clinical fields are encrypted on the device before being sent to us, and decrypted on the device when displayed. They are unreadable in transit and at rest in our database.
What the app does not do
- It contains no advertising, no advertising identifier and no ad networks.
- It contains no analytics or behavioural tracking software.
- It does not access contacts, calendar, messages, call logs or the microphone.
- It does not track location in the background.
15. Deleting your data
Different data has a different owner, so there are two routes.
Your medical records.The clinic that treated you is the controller of your medical records, and is also under a legal obligation to retain them for a period set by Malaysian healthcare regulations (section 9). Requests to access, correct or erase a medical record should go to the clinic. mySihat will act on the clinic's instruction but cannot independently delete a clinical record.
Your mySihat app account. You can ask us to close your app account and delete the data we hold as controller — your sign-in credentials, notification token, profile picture, app preferences and the family links you have created. Write to dev@mysihat.digital from the email address on your account, or use the form at https://mysihat.app/legal/data-deletion.
We will confirm your identity before acting, respond within 21 days as required by the PDPA, and tell you what was deleted and what had to be retained, and why. Closing the app account does not delete your medical records at the clinics that treated you, and does not affect your care.