1. Agreement and parties
These Terms of Service ("Terms") form a binding agreement between mySihat Digital Sdn. Bhd. ("mySihat") and the healthcare provider, clinic or organisation that registers for or uses the Platform ("Customer", "Clinic", "you"). By creating an account, accepting these Terms, or using the Platform, you agree to them. If you accept on behalf of an organisation, you confirm you are authorised to bind it.
The Data Processing Agreement("DPA") is incorporated into and forms part of these Terms, and the Privacy Policy also applies.
2. The Platform
mySihat is a software-as-a-service clinic management platform providing modules that may include patient records / EHR, clinical consultations, lab orders, medical certificates, queue management, billing/invoicing, dashboards and a patient portal. Features may change over time.
2.1 Not a medical device; no clinical advice
The Platform is an information-management tool. It does not provide medical advice, diagnosis or treatment, and is not a substitute for the professional judgment of qualified healthcare practitioners. All clinical decisions remain the sole responsibility of the Customer and its practitioners, who are responsible for the accuracy and clinical appropriateness of all data entered.
3. Accounts, roles and security
- A Main Clinic Account is provisioned for the Customer, which may create staff accounts and assign roles/permissions and is responsible for all activity under its accounts.
- The Customer must keep credentials confidential, deactivate accounts of departing staff promptly, and notify us of suspected unauthorised access.
- We may suspend access where reasonably necessary to protect the Platform, other customers, or personal data.
4. Data protection — the Customer is the controller
As between the parties, the Customer is the Data Controller / Data User and mySihat is the Data Processor in respect of patient personal data and sensitive (health) data. mySihat does not own that data. The Customer warrants that, for all data it (and its patients and staff) put into the Platform, it:
- has a lawful basis and has provided all required notices and obtained all required consents (including, for sensitive/health data, explicit consent or another lawful basis under the PDPA);
- complies with the PDPA (as amended 2024), the PDP Standard 2015, its medical-confidentiality obligations, and applicable healthcare laws including the Private Healthcare Facilities and Services Act 1998;
- has authority to appoint mySihat as its processor on the terms of the DPA;
- submits accurate data and keeps it up to date.
mySihat processes patient data only on the Customer's documented instructions, as set out in the DPA.
5. Acceptable use
You agree to use the Platform only for lawful, legitimate clinic operations, and not to:
- upload unlawful, infringing or malicious content;
- attempt unauthorised access, probe or test security without our prior written consent, or circumvent access controls;
- reverse engineer, copy, resell or sublicense the Platform except as permitted by law;
- use the Platform to build a competing product or to scrape data at scale.
6. Fees and payment
Fees, billing cycle and taxes are as set out in your order or invoice and, unless stated otherwise, are payable in Malaysian Ringgit (MYR). Late payment may lead to suspension after reasonable notice. Fees are non-refundable except as expressly stated or required by law. We may change fees on reasonable prior notice, effective the next billing cycle.
7. Intellectual property
- The Platform and its software are owned by mySihat and its licensors; we grant the Customer a non-exclusive, non-transferable, revocable licence to use it during the subscription term for internal clinic operations.
- Customer Data — all patient data and records the Customer enters — remains owned by the Customer and/or the relevant data subjects. The Customer grants mySihat a limited licence to host and process it solely to provide the Platform and as set out in the DPA. We claim no ownership over Customer Data.
- We may use fully anonymised, aggregated statistics (that identify no individual, patient or clinic) to operate and improve the Platform.
8. Availability and support
We aim to provide a reliable service but, unless a separate written Service Level Agreement applies, the Platform is provided on a commercially reasonable-efforts basis without a guaranteed uptime. We may perform maintenance and will use reasonable efforts to schedule significant planned maintenance outside peak hours. Support is provided via dev@mysihat.digital.
9. Third-party services
The Platform relies on third-party providers (database/auth hosting, email, file storage, infrastructure and monitoring) listed in the DPA. We remain responsible for our sub-processors as set out in the DPA.
10. Warranties and disclaimers
Each party warrants it has authority to enter into these Terms. To the maximum extent permitted by law, and except as expressly stated, the Platform is provided "as is" and "as available", and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the Platform will be uninterrupted or error-free. Nothing in these Terms excludes liability that cannot lawfully be excluded under Malaysian law.
11. Limitation of liability
Subject to the paragraph above and applicable law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or loss of profits, revenue, goodwill or anticipated savings; and mySihat's total aggregate liability in any 12-month period shall not exceed the total fees paid by the Customer in the 12 months preceding the event giving rise to the claim. These limits do not apply to liability for breach of data-protection obligations caused by wilful misconduct or gross negligence, breach of confidentiality, or the Customer's indemnity obligations.
12. Suspension and termination
- Either party may terminate for convenience on the notice period in the order (or, if none, 30 days' written notice), effective at the end of the then-current billing period.
- Either party may terminate immediately for a material breach not remedied within 14 days of notice, or on insolvency.
- We may suspend access immediately where necessary to prevent harm or where required by law, giving notice as soon as practicable.
- On termination, the licence ends and mySihat will, per the DPA, make Customer Data available for export for a limited period and then return or securely delete it. The Customer is responsible for exporting and retaining records it must keep under medical-record retention laws.
13. Indemnity
The Customer shall indemnify mySihat against claims, losses and reasonable costs arising from its breach of Section 4 or Section 5, its failure to obtain required consents for patient data, or its unlawful or infringing use of the Platform. mySihat will indemnify the Customer against third-party claims that the Platform software (as provided and used per these Terms) infringes that third party's Malaysian intellectual property rights.
14. Confidentiality & force majeure
Each party will protect the other's confidential information with at least reasonable care and use it only to perform these Terms. Neither party is liable for failure or delay caused by events beyond its reasonable control, provided it takes reasonable steps to mitigate. The parties' data-protection obligations are governed by the DPA.
15. Governing law and disputes
These Terms are governed by the laws of Malaysia, and the parties submit to the exclusive jurisdiction of the courts of Selangor, Malaysia (save that either party may seek urgent injunctive relief in any competent court). The parties will first attempt to resolve disputes in good faith between senior representatives.
16. General
- Entire agreement: these Terms, the DPA, the Privacy Policy and any order form are the entire agreement on this subject. On data-protection matters, the DPA prevails.
- Changes: we may update these Terms on reasonable notice; continued use after the effective date constitutes acceptance.
- Assignment: the Customer may not assign without our consent; we may assign to an affiliate or in a business transfer, subject to the DPA.
- Severability & waiver: if any provision is unenforceable, the rest remains in effect; failure to enforce a right is not a waiver.
- Notices to mySihat: dev@mysihat.digital / 11, Jalan Teknologi 3/3A, Taman Sains Selangor 1, Kota Damansara, 47810 Petaling Jaya, Selangor, Malaysia.