Privacy Policy

MEDeLIFE is a digital healthcare platform that enables patients, doctors, pharmacists, clinics, and administrators to manage appointments, care records, profile verification, and healthcare communications.

This Privacy Policy explains how MEDeLIFE collects, uses, stores, discloses, and protects Personal Data and Sensitive Personal Data, including health information, in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and applicable healthcare obligations.

By creating an account, using the service, or registering as a healthcare professional, patient, or clinic representative, you agree to the terms of this Policy and consent to the processing described herein. If you do not agree, you must not use the service.

This is a general policy draft prepared for operational review and should be reviewed by local counsel before publication in a production environment.

We may collect and process the following categories of information:

• Account information: name, email, mobile number, password hash, profile photos, role (patient, doctor, pharmacist, admin), and account status.
• Identity and verification data: NRIC/passport details, business registration information, professional licence or registration numbers, clinic affiliation, and supporting verification documents where required.
• Health and medical data: appointment history, clinical notes, prescriptions, medical reports, laboratory results, treatment plans, symptom information, summaries, attachments, and other Sensitive Personal Data necessary for care coordination.
• Technical and usage data: IP address, browser type, device identifiers, session IDs, cookie identifiers, login activity, feature usage, and error logs.
• Communications: messages, enquiries, support tickets, appointment notes, and feedback submitted through the platform.

We use your information to:

• create and manage your account and authenticate access;
• facilitate appointments, referrals, medication coordination, and patient-doctor communication;
• maintain clinical records, treatment history, and verification details where necessary for healthcare delivery;
• support care operations, scheduling, reporting, internal audits, and administrative review;
• verify professional credentials of doctors, pharmacists, and clinic staff;
• detect fraud, abuse, security threats, and maintain service integrity;
• comply with legal, regulatory, contractual, and audit obligations;
• provide customer support and improve the usability and reliability of the service.

We will only process Sensitive Personal Data where necessary for treatment, care coordination, verification, legal compliance, or where you have provided explicit consent and the processing is consistent with this Policy.

MEDeLIFE does not sell personal data. We may disclose information only in the following situations:

• to authorized healthcare providers or clinic staff involved in your care or administrative processing;
• to pharmacists, care coordinators, or specialists where a referral or treatment workflow requires it;
• to service providers that support hosting, security, authentication, analytics, communications, or document storage, under confidentiality obligations;
• to regulatory authorities, law enforcement, or courts where required by law or pursuant to a valid legal process;
• to protect the rights, safety, or integrity of users or the platform.

Access control is role-based. Patients, doctors, pharmacists, and administrators only receive access to the information required for their role and authorization. Clinical data is separated from routine administrative data wherever practicable.

We implement reasonable administrative, technical, and organisational safeguards to protect Personal Data and health information from unauthorised access, loss, misuse, alteration, or disclosure. This includes encrypted storage where supported, access restrictions, session controls, audit logs, and secure hosting practices.

However, no system is completely risk-free. We will continue to review and improve our security measures, but users must also protect their own account credentials and notify us without delay if they suspect unauthorised access.

We retain data only for as long as necessary to provide services, meet legal obligations, manage claims, support audits, and maintain the continuity of care. Medical records may be archived in a secure, read-only format where required by applicable regulatory or statutory retention periods. When data is no longer required, it will be securely deleted or anonymised where feasible.

If you request deletion of your account, we may retain certain records where required for legal, regulatory, professional, or medical accountability obligations.

Depending on your jurisdiction and applicable law, you may have the right to:

• access your personal information held by us;
• request correction or updating of inaccurate or incomplete data;
• withdraw consent for certain processing activities, where consent is the legal basis;
• request restriction of processing in limited circumstances;
• request deletion of personal data where lawful and feasible;
• object to direct marketing or processing that is not required for healthcare delivery or legal compliance.

To exercise these rights, please contact our Data Protection Officer using the details below. We may ask for verification of your identity before processing high-risk requests involving health data.

If you have any questions, concerns, or requests relating to this Privacy Policy or your Personal Data, please contact:

Data Protection Officer
MEDeLIFE
Email: privacy@medelife.com
Website: MEDeLIFE