MigrantCare is a digital telehealth platform that connects users with licensed healthcare professionals for remote consultations. The platform is developed and operated by MigrantCare. ("we", "us", "our").
MigrantCare is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Healthcare professionals (HCPs) listed on the platform are independently licensed and solely responsible for the clinical care they provide.
Data Controller: MigrantCare, Malaysia.
Contact: support@migrantcare.com.my
ACCESS_FINE_LOCATION) is requested only when you actively use the pharmacy/clinic finder feature and is not stored on our servers.| Purpose | Lawful basis (Malaysia PDPA) |
|---|---|
| Creating and managing your account | Contractual necessity |
| Booking and conducting video/audio consultations | Contractual necessity |
| Processing payments, wallet top-ups, and subscriptions | Contractual necessity |
| Generating and storing e-prescriptions | Contractual necessity; legal obligation |
| Facilitating pharmacy and lab orders from e-prescriptions | Contractual necessity |
| Operating the MIRA AI symptom intake assistant | Consent (given at first use of MIRA) |
| Sending appointment reminders and service notifications | Contractual necessity; consent |
| Improving app performance and fixing bugs | Legitimate interests |
| Complying with Malaysian and Bangladeshi legal obligations | Legal obligation |
| Fraud prevention and platform security | Legitimate interests |
We do not use your health data for advertising, sell it to third parties, or use it to train AI models beyond what is described in Section 4.
When you interact with MIRA, the following occurs:
You are presented with a specific consent notice before your first MIRA interaction. You may decline to use MIRA and proceed directly to booking a consultation. Withdrawing MIRA consent does not affect your ability to use other app features.
We engage the following third-party processors. Each is bound by a data processing agreement and processes your data only on our instructions.
| Processor | Purpose | Data transferred | Location |
|---|---|---|---|
| Google LLC (Firebase) | Authentication, push notifications, crash reporting, file storage | Account data, device identifiers, crash logs, profile photos, medical documents | United States (adequacy safeguards apply) |
| Google LLC (Gemini API) | AI-powered symptom intake (MIRA) | Symptom descriptions, MIRA chat content | United States |
| Google LLC (Maps SDK) | Pharmacy and clinic location finder | Approximate device location | United States |
| Fiuu (formerly Razer Merchant Services) | Payment processing for wallet top-ups, subscriptions, and prescription payments | Payment method details, transaction amounts, email/phone for verification | Malaysia |
We do not sell your personal data. We share data only in the following circumstances:
| Data category | Retention period | Basis |
|---|---|---|
| Account identity data (name, phone, email) | Deleted within 30 days of account deletion request | User request |
| Medical and clinical records (consultations, prescriptions, lab results) | Minimum 7 years | Private Healthcare Facilities and Services Act 1998 (Malaysia) |
| Financial and wallet transaction records | 7 years | Income Tax Act 1967 (Malaysia) / LHDN audit requirements |
| MIRA conversation history | 2 years, or until account deletion (whichever comes first) | Service improvement; capped by consent period |
| Crash logs and diagnostic data | 90 days | Legitimate interests (bug fixing) |
| HCP licensing documents | Duration of registration on platform + 3 years | Regulatory compliance |
Upon account deletion, all data outside mandatory legal retention periods is permanently purged. Retained clinical and financial records are anonymised where legally permissible.
Under Malaysia's Personal Data Protection Act 2010, you have the right to:
Users in Bangladesh have rights consistent with Bangladesh's applicable digital and consumer protection laws, including the right to know how their data is used and to request correction or deletion of personal data that is not subject to a legal retention requirement.
We will respond to all rights requests within 21 days. Complex requests may take up to 30 days; we will notify you if an extension is needed.
No system is 100% secure. If you believe your account has been compromised, contact us immediately at support@migrantcare.com.my.
MigrantCare is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If a parent or guardian believes their child has created an account, please contact us immediately and we will delete the account and associated data without delay.
Some of our processors (Google, LiveKit) are located in the United States. Where we transfer personal data outside Malaysia or Bangladesh, we ensure adequate protections are in place through:
Health data is not transferred to any country without an adequate level of data protection unless covered by one of the above safeguards.
The MigrantCare mobile app does not use browser cookies. The app uses Firebase Analytics to collect anonymised, aggregated usage statistics (e.g., feature usage rates, session lengths). You can opt out of analytics data collection in Profile → Settings → Privacy.
We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification and email at least 14 days before the change takes effect. Continued use of the app after the effective date constitutes acceptance of the updated policy. Previous versions are available on request.
MigrantCare.
Email: support@migrantcare.com.my
Data rights / deletion requests: https://request.migrantcare.com.my
Privacy Policy URL: https://privacy-policy.migrantcare.com.my
If you are unsatisfied with our response, you may escalate to the Personal Data Protection Commissioner of Malaysia at www.pdp.gov.my or the relevant authority in Bangladesh.