Privacy Policy

Last updated: July 9, 2026

This privacy policy ("Privacy Policy") explains how MedBay Care Sdn Bhd [Registration No. 202601011604 (1673702-D)] and its affiliates ("MedBay," "we," "us," or "our") collect, use, process, disclose, and protect the Personal Data you provide through the mobile Application, MedBay website, third-party applications (including but not limited to WhatsApp, Instagram, or Facebook Messenger) where interactions are conducted with an Account or Group Chat managed by MedBay, and/or other platforms (collectively, the "Platform").

This Privacy Policy applies to all Users ("You") and is an integral part of the MedBay Terms and Conditions of Use. MedBay processes personal data in accordance with Malaysia's Personal Data Protection Act 2010 ("PDPA") and other applicable laws and regulations.

If you use the Platform on behalf of another individual, you represent that you are authorised to act on their behalf and that such individual acknowledges the practices outlined herein.

This Privacy Policy provides notice of how MedBay collects, uses, discloses, stores, transfers, and otherwise processes your personal data. Where consent is required under applicable law, MedBay will obtain such consent separately through appropriate mechanisms.

1. Your Information

MedBay collects User information to provide services, manage and facilitate Platform use, and for other purposes permitted by applicable laws and regulations. Information collected includes data submitted when you:

Consult with MedBay or Service Providers to obtain doctor, procedure, or healthcare facility recommendations, or cost estimates — including: name, date of birth, email address, mobile phone number, photo, known health conditions, medications, allergies, vaccinations, medical history, health journals, prescriptions, reports, medical files, and other information you submit.
Make a doctor or procedure reservation — including: passport number, national ID, patient identity, medical history, information of accompanying family members (next of kin), payment information, travel plan information, insurance information, and other information required by the Service Provider or MedBay.
Access and/or use the Platform — including: IP address, browser type, device information, Wi-Fi location, geo-location, GPS coordinates, interactions while using the Platform, saved preferences, usage patterns, and selected settings. This data may be collected using cookies, pixel tags, and similar tracking technologies.
Perform activities on the Platform, including registration, conversations, payments, and other usage activities.
Use consultation services. By using the Platform, you acknowledge that conversation history in text and image format may be collected, stored, used, and/or disclosed by MedBay in accordance with this Privacy Policy.

We also collect the following Sensitive Personal Data, subject to your explicit consent:

Medical history and health conditions
Medical records and test results you choose to upload
Copies of your passport, national ID, or other identity or travel documents you choose to upload for identity verification and to facilitate appointments, hospital admission, or travel arrangements
Treatment preferences and requirements

Where certain personal data is mandatory for booking, verification, identity validation, or transmission to selected healthcare providers, failure to provide such data may prevent MedBay from processing your enquiry, facilitating a booking or providing parts of the Platform.

2. Accuracy of Information

Information you provide must be accurate and not misleading. You must update your information if there are any changes. MedBay shall not be liable for any failure of services caused by inaccurate information you provide.

If you provide information relating to another individual (such as a spouse or family member), you must ensure you are authorised to do so and that the relevant individual has been informed of this Privacy Policy and where required, has provided valid consent.

3. Consent

By using our Platform and submitting personal data through our enquiry forms, you consent to:

The collection and processing of your personal data as described in this Privacy Policy
The sharing of your personal data with healthcare providers you choose to enquire with
Receiving service-related communications regarding your enquiries and appointments

For sensitive personal data (such as medical information), we obtain your explicit consent before processing.

Marketing communications

We will only send you marketing communications (including promotional offers, vouchers, surveys, and advertisements) where you have given separate, explicit consent to receive them. You may opt out of marketing communications at any time by contacting us at hello@medbaycare.com or using the unsubscribe mechanism in any marketing message.

You may withdraw your consent for any processing at any time by contacting our Data Protection Officer. However, withdrawal of consent may affect our ability to provide certain services to you.

4. Purpose of Data Collection

Your personal data is collected and processed for the following purposes:

Identifying and verifying you as a User and for administrative processes
Conducting Know Your Customer (KYC) processes as required before service provision
Facilitating medical appointment bookings and enquiries
Connecting you with appropriate healthcare providers
Providing personalised hospital and doctor recommendations
Processing and managing your account
Processing or facilitating payments
Communicating with you about services and appointments
Providing information about Platform updates or changes to services
Maintaining, developing, testing, improving, and personalising Platform products and services
Monitoring and analysing activities, behaviour, and demographic data to improve user experience
Processing and responding to enquiries and feedback
Sending marketing communications where you have opted in
Generating statistical and analytical data for research, product development, and commercial purposes
Preventing, detecting, and investigating prohibited, illegal, or fraudulent activities
Complying with legal and regulatory requirements under Malaysian law, including the PDPA

We will not process your personal data for purpose incompatible with those stated in this Privacy Policy unless permitted by applicable law or with your consent where required.

5. Disclosure of Information

MedBay is committed to maintaining the confidentiality of your information. We will not disclose, sell, transfer, distribute, or lend your information to third parties, except in the following circumstances:

To partners or third parties assisting MedBay in providing services or processing Platform activities, including transaction processing, payment verification, promotions, and service provision
Healthcare Providers: Hospitals, clinics, and doctors you choose to enquire with will receive relevant personal data required to facilitate your enquiry or booking
Service Providers: Our technology and infrastructure partners who assist in operating the Platform
Business partners in accordance with your consent, including API-integrated applications or partners involved in promotions, contests, or special services
MedBay's subsidiaries and affiliates for the purpose of providing or processing services on MedBay's behalf
Vendors, consultants, marketing partners, and research firms for marketing, service quality improvement, and publication activities
Law enforcement, courts, or authorised government agencies where required by law or court order

All third parties who receive your personal data are required to be bound by appropriate confidentiality obligations and to process data in accordance with applicable laws and regulations, including the PDPA.

6. Data Security

MedBay takes the security of your personal data seriously. We implement appropriate technical and organisational measures designed to protect your information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

These measures include, where applicable and proportionate to the nature of the data:

Use of encryption for data transmission (TLS/SSL)
Access controls limiting internal access to personal data, with access logged and audited
Password protection and authentication requirements
Regular review of our security practices

The specific security measures we employ are continually reviewed and may be updated as our platform evolves and as technology changes. All internal access to personal data is restricted to authorised personnel with a legitimate business need, and any unauthorised internal access or misuse is subject to disciplinary action.

No Security Guarantees

While we strive to protect your personal data using commercially reasonable means, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee absolute security.

Breach Notification

In the event of a data breach, MedBay will assess the incident and take such notification and response steps as are required under applicable law, including notification to the relevant data protection authorities where required by applicable law (including the Personal Data Protection Commissioner of Malaysia) and affected data subject where required.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations:

Active account data: Retained while your account is active and for a reasonable period following last activity
Enquiry and booking records: Retained for the period required under applicable Malaysian laws and regulations
Uploaded medical records: Retained until you request deletion

After the applicable retention period, your personal data will be securely deleted or anonymised. Please note that due to technical constraints, residual copies of your data may persist in encrypted backup archives for a limited recovery period (not exceeding 12 months) in accordance with our disaster recovery and legal hold policies. Where your data is shared with authorised government agencies, such data may be retained in accordance with the respective retention policies of those agencies.

8. Your Rights

Under the Personal Data Protection Act 2010 and subject to applicable laws and regulations, you have the following rights regarding your personal data:

Right of Access: You may request access to the personal data we hold about you
Right of Correction: You may request correction of inaccurate or incomplete personal data
Right to Withdraw Consent: You may withdraw consent for processing at any time
Right to Limit Processing: You may request that we restrict how we process your data

To exercise any of these rights, please contact our Data Protection Officer at hello@medbaycare.com. We will respond to your request within the timeframe required under the PDPA. Please note that an administrative fee may be charged for access requests as permitted under applicable laws, and we will notify you of any such fee before processing your request.

9. Cookies and Tracking Technologies

Cookies are small files stored on your device that retain your preferences or configuration settings during Platform visits. They are not used to access other data on your device beyond what you have agreed to submit.

We use cookies and similar tracking technologies to:

Remember your preferences and settings
Analyse Platform usage and performance
Provide personalised content and recommendations

You may modify your cookie preferences through your browser settings by choosing to refuse cookies. Please note that disabling certain cookies may affect the functionality of the Platform.

Third-party analytics and advertising

We use Google Analytics to collect data such as age, gender, interests, and usage patterns to improve Platform features and content. We may also use features provided by third parties to assess, adjust, and present relevant advertisements based on your interests or visit history. You may opt out of Google Analytics data collection by visiting the Google Analytics Opt-out page. Please refer to the respective privacy policies of these third parties for further information.

10. Cross-Border Data Transfer

MedBay may transfer personal data to service providers, infrastructure providers, communications providers, analytics providers or selected healthcare related recipients located outside Malaysia where necessary for the purposes stated in this Privacy Policy. Where such transfers occur, MedBay will ensure that the transfer is carried out in accordance with applicable legal requirements and subject to appropriate safeguards.

11. Limitation of Liability

MedBay takes all reasonable steps to protect your personal data in compliance with the PDPA and applicable regulations. Subject to the rights and remedies available to you under applicable law, MedBay shall not be liable for:

Unauthorised access, data loss, or breach that occurs despite implementation of reasonable security measures
Actions of third parties, including healthcare providers, after your data has been lawfully shared with your consent
Data breaches caused by your failure to safeguard your account credentials
Technical failures or circumstances beyond MedBay's reasonable control

Nothing in this section limits any rights you may have under the PDPA applicable law.

12. Age Restriction

By accessing the Platform and/or using the Services, you represent and warrant that you are an individual legally entitled to enter into a binding agreement under applicable law. If you are below the age of majority under applicable law, you must obtain the consent of a parent or legal guardian before using the Platform. By accessing the Platform, you are deemed to represent that you meet the applicable age of majority or have obtained the required parental consent.

Where personal data relating to a minor or person under guardianship is submitted, MedBay may require confirmation that a parent, legal guardian, or authorised representative has provided the necessary consent.

13. Governing Law

This Privacy Policy is governed by and shall be construed in accordance with the laws of Malaysia. You agree to submit to the exclusive jurisdiction of the courts of Malaysia in relation to any dispute arising out of or in connection with this Privacy Policy.

14. Privacy Policy Updates

MedBay may update this Privacy Policy from time to time to reflect changes in law, regulation, or internal practices. Any updates will be published on the Platform with a revised "Last Updated" date. For material changes, we will provide reasonable notice via the Platform or by direct communication where required. By continuing to use the Platform following any update, you are deemed to have read, understood, and agreed to the revised Privacy Policy.

MedBay Care Sdn Bhd

Email: hello@medbaycare.com