Privacy Policy

Effective date: 21 April 2026  |  Last updated: 21 April 2026  |  Version 2.0

1. Who We Are

MigrantCare is a digital telehealth platform that connects users with licensed healthcare professionals for remote consultations. The platform is developed and operated by Simple Motion Sdn. Bhd. ("we", "us", "our").

MigrantCare is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Healthcare professionals (HCPs) listed on the platform are independently licensed and solely responsible for the clinical care they provide.

Data Controller: Simple Motion Sdn. Bhd., Malaysia.
Contact: support@migrantcare.com.my

2. Data We Collect

A. Account and identity data

• Full name, email address, phone number, date of birth
• Profile photo
• Residential address, city, state, country
• Login credentials (hashed; never stored in plain text)
• Authentication method (username/password, phone OTP, or OAuth via Google/Apple)

B. Health and medical data Sensitive

• Self-reported symptoms entered via the app or the MIRA AI intake assistant
• Medical history, current medications, allergies, and pre-existing conditions voluntarily provided
• Height, weight, age, blood group
• Consultation notes and records generated during video/audio appointments
• E-prescriptions issued by licensed HCPs
• Lab test orders, results, and reports uploaded or generated within the app
• Medicine and pharmacy orders placed through the app

C. Financial data

• Wallet: Wallet top-up amounts, top-up transaction history, wallet balance, and deduction history for consultations, prescriptions, and pharmacy/lab orders
• Direct subscription payments: Subscription plan purchased, payment amount, and transaction date. Direct subscription payments are processed by Fiuu and do not pass through your in-app wallet.
• Payment method details used for wallet top-ups or direct subscription purchases (processed entirely by Fiuu; Simple Motion Sdn. Bhd. does not store your full card number, bank account number, or CVV)
• Refund records — method (wallet credit or bank transfer), amount, and date
• Agent-facilitated fund transfer records (transaction amount and account reference only)

D. Location data

• Approximate and precise device location, used solely to show nearby pharmacies and clinics. Precise location (ACCESS_FINE_LOCATION) is requested only when you actively use the pharmacy/clinic finder feature and is not stored on our servers.

E. Device and usage data

• Device identifiers (Android advertising ID), device model, OS version
• App interaction logs, feature usage, and navigation events
• Crash reports and diagnostic data
• IP address and general network information

F. Communications data

• In-app messages and chat history between patients and doctors
• Voice messages sent to MIRA
• Support tickets and email correspondence with our team

G. Healthcare professional (HCP) data

• Medical registration number and licensing certificates
• Professional specialisation and practice details
• Availability schedules

3. How We Use Your Data

We do not use your health data for advertising, sell it to third parties, or use it to train AI models beyond what is described in Section 4.

4. AI Assistant (MIRA) and Health Data

How MIRA processes your data

When you interact with MIRA, the following occurs:

• Your symptom descriptions and follow-up answers are sent to Google's Gemini API (via our secure backend) to generate structured intake summaries.
• MIRA's output is used only to help you articulate your health concerns before speaking with a licensed HCP and to suggest relevant specialties.
• Conversation history with MIRA is stored on our servers and linked to your account.
• Google processes this data as a data processor under our agreement. Google does not use your health data to train its public AI models under our enterprise API terms.

Your consent for MIRA

You are presented with a specific consent notice before your first MIRA interaction. You may decline to use MIRA and proceed directly to booking a consultation. Withdrawing MIRA consent does not affect your ability to use other app features.

5. Third-Party Data Processors

We engage the following third-party processors. Each is bound by a data processing agreement and processes your data only on our instructions.

6. Data Sharing and Disclosure

We do not sell your personal data. We share data only in the following circumstances:

• With your chosen HCP: Your symptom summary, MIRA intake report, medical history you have shared, and consultation notes are visible to the licensed doctor you book with.
• With pharmacies and labs: When you place an order from an e-prescription, relevant prescription data is shared with the selected pharmacy or laboratory.
• With Fiuu (payment processor): When you make a wallet top-up or purchase a subscription directly, your payment method details and transaction amount are shared with Fiuu solely to process the payment. Fiuu does not receive your health or medical data.
• With authorised agents: Agents who facilitate wallet top-ups on your behalf see only the transaction amount and your account reference number.
• Legal and regulatory obligations: We may disclose data to competent authorities in Malaysia (e.g., Ministry of Health, PDPC) or Bangladesh when required by law, court order, or regulatory directive.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred. You will be notified in advance.

7. Data Retention

Upon account deletion, all data outside mandatory legal retention periods is permanently purged. Retained clinical and financial records are anonymised where legally permissible.

8. Your Rights

Malaysia (PDPA 2010)

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access: Request a copy of personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Withdrawal of consent: Withdraw consent at any time (e.g., for MIRA). This does not affect prior processing.
• Limit processing: Request that we stop using your data for purposes other than those required by law.
• Account and data deletion: Request deletion of your account and non-legally-retained data.

Bangladesh (Digital Security Act 2018 / ICT Act 2006)

Users in Bangladesh have rights consistent with Bangladesh's applicable digital and consumer protection laws, including the right to know how their data is used and to request correction or deletion of personal data that is not subject to a legal retention requirement.

Payment data rights

You may request a full statement of your transaction history (wallet top-ups, deductions, subscription payments, and refunds) at any time via Profile → Transaction History in the app. For records beyond what is shown in-app, submit a data access request using the methods below.

How to exercise your rights

• In-app: Profile → Settings → Delete Account (for deletion requests)
• Email: support@migrantcare.com.my — subject line: "Data Rights Request"
• Web form: https://request.migrantcare.com.my

We will respond to all rights requests within 21 days. Complex requests may take up to 30 days; we will notify you if an extension is needed.

9. Data Security

• All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Health data and financial records are encrypted at rest using AES-256.
• Access to patient data is restricted to authorised personnel and the HCP you are consulting with, using role-based access controls.
• We conduct periodic security reviews and vulnerability assessments.
• In the event of a data breach that is likely to affect your rights, we will notify you and the relevant authority (PDPC Malaysia) within 72 hours of becoming aware of the breach.

No system is 100% secure. If you believe your account has been compromised, contact us immediately at support@migrantcare.com.my.

10. Children's Privacy

MigrantCare is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If a parent or guardian believes their child has created an account, please contact us immediately and we will delete the account and associated data without delay.

11. Cross-Border Data Transfers

Some of our processors (specifically Google LLC for Firebase, Gemini API, and Maps SDK) are located in the United States. Fiuu and ADN Archive are based in Malaysia. Where we transfer personal data outside Malaysia or Bangladesh, we ensure adequate protections are in place through:

• Standard contractual clauses or data processing agreements that meet PDPA requirements.
• Processor commitments under Google Cloud's Data Processing Addendum.

Health data is not transferred to any country without an adequate level of data protection unless covered by one of the above safeguards.

12. Cookies and Analytics

The MigrantCare mobile app does not use browser cookies. The app uses Firebase Analytics to collect anonymised, aggregated usage statistics (e.g., feature usage rates, session lengths). You can opt out of analytics data collection in Profile → Settings → Privacy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or phone (SMS) to your registered contact details at least 14 days before the change takes effect. Continued use of the app after the effective date constitutes acceptance of the updated policy. Previous versions are available on request.

14. Contact and Complaints

If you are unsatisfied with our response, you may escalate to the Personal Data Protection Commissioner of Malaysia at www.pdp.gov.my or the relevant authority in Bangladesh.