← Back to Site
At The Care Records, we are committed to protecting the privacy and security of your personal and medical information. This Privacy Policy explains how we collect, use, and safeguard your data in compliance with the Malaysian Personal Data Protection Act 2010 (PDPA) and the 2024 Amendments.
1. Personal and Sensitive Data We Collect
We collect information that you voluntarily provide to us when you create an account, manage a care profile, or use our clinical tools.
Personal & Identification Data
- Nicknames: Users are encouraged to use nicknames. We do not require or collect your legal name for general app usage.
- Email Address: Required for account authentication and secure Care Circle invitations.
Strict Privacy Policy: We do not collect phone numbers, profile photos, or government identification documents.
Transient Storage & Privacy Protection
To further protect your privacy, we implement a "Verify & Purge" policy for uploaded documents:
- Immediate Deletion: Any images or PDFs uploaded for AI-assisted parsing (e.g., lab reports) are deleted permanently from our storage servers immediately after you verify and save the extracted data.
- Anonymized Structured Data: Only the resulting structured numeric data and your verified notes are retained. No copies of the original files containing visual identifiers are kept.
2. Purpose of Data Collection
Your data is processed strictly for the following purposes:
- Care Coordination: Enabling Care Circle members to view and update health records in real-time.
- Clinical Continuity: Generating the "Assessment-First" Summary for sharing with medical professionals.
- Notifications: Sending reminders for medications and upcoming appointments.
- Personalization: Calculating clinical scores (e.g., IBS-SSS, PHQ-9) to track well-being trends.
3. Data Sharing and the Care Circle
We prioritize your privacy. Your data is only shared with those you explicitly authorize:
- Care Circle Members: Only users invited by the Profile Owner (via email) can access the data. Members are identified within the circle by their chosen nicknames.
- Clinical Professionals: Data is only shared with doctors when you explicitly generate a summary for clinical review.
- No Commercial Sale: We do not sell, rent, or trade your personal or medical data to third parties for marketing purposes.
4. Data Security and Isolation
We employ enterprise-grade security to protect your sensitive records:
- Multi-Tenant Isolation: Every record is strictly scoped to a unique Profile ID and protected by robust database rules.
- Encryption: Data is encrypted both in transit (SSL/TLS) and at rest within our secure cloud infrastructure.
- Offline Safety: Deterministic logging IDs prevent record duplication and ensure data integrity during poor connectivity.
5. Your Rights & Data Portability
Under the Malaysian PDPA (including the 2024 Amendments), you have the following rights:
- Right to Access: You can view all data stored in your profile at any time.
- Right to Correction: You can update or correct inaccuracies in your records.
- Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON) to transfer to another service. You can trigger this from your Settings.
- Right to Withdrawal & Erasure: You may delete your account or specific profiles, which will involve the permanent deletion of all linked medical data from our active servers.
- Right to Limit Processing: You can manage who has access to your data via the Care Circle settings.
6. Data Breach Notification
In the event of a qualifying data breach that is likely to cause significant harm, we are committed to notifying the Personal Data Protection Commissioner and affected individuals within 72 hours of becoming aware of the breach, as per the 2024 statutory requirements.
7. Data Protection Officer (DPO)
We have appointed a Data Protection Officer to oversee our privacy practices. If you have any questions or wish to exercise your rights, please contact:
Email: privacy@carerecords.my
8. International Data Transfers
Your data is stored using Google Cloud/Firebase infrastructure. While we are a Malaysian service, your data is processed on secure servers located outside of Malaysia (typically in Singapore or the United States). By providing your consent, you explicitly acknowledge and agree to this cross-border transfer, which is protected by robust contractual safeguards and enterprise-grade encryption as required by the PDPA.
9. Data Retention
We retain your personal data only for as long as your account is active or as needed to provide you with the services. Upon deletion of a profile, associated medical history is purged from our active records.