Privacy Policy

• We collect the information you give us, the health readings you take, and limited technical data needed to run the Services.
• We use your information to provide your health dashboard, AI insights and the features you choose. We do not sell your personal data.
• We do not use your health data for advertising or marketing, and we do not share it with advertisers or data brokers.
• The app does not contain third-party advertising or cross-app tracking.
• Camera video from a face scan is processed on your device and is not uploaded or stored. Only the resulting readings are saved.
• You can access, correct, export or delete your data at any time. See how to delete your account.

a) Information you provide

• Account details: name, email address and password. Passwords are stored only as a one-way hash. If you sign in with Google, we receive your Google account ID, name, email address and profile picture from Google.
• Profile details: gender, date of birth, NRIC/IC or passport number, phone number, location (the state or area you enter, not GPS), emergency contact details, profile photo and preferences.
• Health records you add: lab reports and other medical documents or images you upload, medications, allergies, vaccinations, imaging, family history, care team details and health goals.
• Cycle tracking: if you use the menstrual cycle feature, period dates, symptoms, moods and notes you log.
• Messages to Sihat Chat and the AI health companion: the questions and messages you send, and the responses generated for you.
• Orders and rewards: marketplace orders, shipping address, points balance, rewards redeemed and referral activity. We do not collect or store payment card numbers in the app.
• Appointments: details of teleconsultations or appointments you book.
• Support requests: information you send us when you contact support.

b) Health readings generated by the Services

• Face scan: when you use the camera-based face scan, the app analyses the video on your device to give an indication of vital signs such as heart rate, to complement your daily monitoring. The video frames are not uploaded or saved. We store the resulting readings, the date and time, and scan quality information (for example lighting and signal quality).
• Kiosk readings: when you log in to a Sihat AI health kiosk with your account (for example by scanning the kiosk QR code with the app), the measurements taken at the kiosk, such as weight, height, blood pressure, temperature and other vitals, are added to your account.
• VR wellness sessions: if you pair the app with a Sihat AI VR headset, session summaries and related wellness data.
• AI insights: summaries, scores, nudges and recommendations generated from your data.

c) Information collected automatically

• Technical and security data: IP address, device and browser type, app version, and security logs, used to keep the Services running, prevent abuse (for example rate limiting) and fix errors.
• Data stored on your device: the app stores sign-in tokens and settings locally on your device so you stay signed in and your preferences are remembered. We do not use advertising cookies or advertising identifiers.

The app only asks for a permission when you use the feature that needs it. You can turn permissions off at any time in your device settings.

• Camera: used for the face wellness scan, for scanning kiosk login QR codes, and for taking photos of documents or a profile picture. Scan video is processed on your device and is not stored.
• Microphone:used only when you tap the voice input button in the chat. Your device's built-in speech recognition service (provided by Google on Android or Apple on iOS) converts your speech to text. We receive and store only the text, not audio recordings.
• Passkeys / biometrics: if you enable passkey sign-in, your fingerprint or face is checked by your device. We never receive your biometric data. We store only a public key.
• Location:the app does not access your device's GPS location.

• To create and manage your account, verify your identity and keep your account secure.
• To show your health readings, history, trends and records in your dashboard.
• To generate AI-powered summaries, health coach suggestions, lab report explanations and chat replies that you request.
• To send you service messages such as password resets, verification emails and important account notices.
• To alert our clinical support team if a reading or message suggests a possible urgent health risk, so they can follow up with you where appropriate.
• To process marketplace orders, points and rewards.
• To provide customer support and respond to your requests.
• To maintain and improve the accuracy and quality of the Services. If you choose to contribute calibration data (for example by entering a reading from a clinical device after a face scan), we store it in a de-identified form that is not linked to your name or account.
• To prevent fraud and abuse, and to comply with legal obligations.

We do not use your health data for advertising, marketing or profiling unrelated to the Services, and we do not make decisions with legal or similarly significant effects about you based solely on automated processing.

Some features use artificial intelligence models to analyse the information you provide and generate insights. To do this, the relevant data (for example your readings, basic profile information such as age and gender, the text of your chat message, or a lab report you upload for analysis) is sent securely to an AI provider for processing. Our AI providers process this data on our behalf to return a result to you. We do not permit them to use your data for advertising.

AI-generated content can be incomplete or wrong. It is for general wellness information only and is not a medical diagnosis or a substitute for advice from a qualified healthcare professional.

We do not sell or rent your personal data. We share it only in these cases:

• Service providers who process data on our behalf under contract and only for the purposes in this policy:
  • Amazon Web Services (app and Sihat Chat hosting, file storage and email delivery)
  • MongoDB Atlas (database hosting)
  • Google (Google Sign-In, and the Gemini AI models used for health insights and report analysis)
  • Hugging Face (hosted AI models used to analyse medical images you upload)
  • Jitsi Meet (video calls for teleconsultations you join)
  • Open-Meteo (the area you enter in your profile is used to fetch local weather and air quality for wellness tips; no other personal data is sent)
• Healthcare professionals you choose: when you book a teleconsultation or appointment, or add someone to your care team, the healthcare professional can see the information needed to provide care.
• Health programmes: if you use Sihat AI through a programme run with your employer, agency or another organisation (for example a workplace health screening), that organisation may see only aggregated, de-identified statistics, such as participation numbers and overall wellness trends for its locations. It does not see your name, contact details or individual results. Where a programme needs your individual results to be shared with the organisation, we ask for your separate, explicit consent first (for example during sign-up). This consent is optional unless the programme requires it to take part, and you can withdraw it at any time by contacting us.
• Legal reasons: where required by law, court order or a government authority, or where needed to protect the life, health or safety of you or others.
• Business transfers: if Sihat AI is involved in a merger, acquisition or sale of assets, your data may be transferred, subject to this policy and with notice to you.
• With your consent: in any other case, only when you ask us to or agree to it.

Your data is stored on Amazon Web Services servers in Singapore and in a MongoDB Atlas database hosted in Mumbai, India. Our AI providers (Google and Hugging Face) may process the data sent to them in other countries, including the United States. When your data is transferred outside Malaysia, we take steps required by the PDPA to make sure it receives a comparable level of protection, including contractual safeguards with our providers.

• All data sent between the app and our servers is encrypted in transit using HTTPS (TLS).
• Data is encrypted at rest by our hosting providers. Uploaded health documents are kept in private storage that is not publicly accessible.
• Access to personal data is limited to authorised staff and systems that need it, and is protected by authentication and access controls.
• Passwords are hashed and never stored in plain text.

No method of transmission or storage is completely secure. If we become aware of a data breach that affects you, we will notify you and the relevant authorities as required by law. Please keep your password private and lock your device.

• We keep your account and health data for as long as your account is active.
• When you delete your account, we delete or irreversibly anonymise your personal data within 30 days. Copies in encrypted backups are removed within a further 90 days.
• We may keep limited records longer where the law requires it (for example transaction records for tax purposes) or to resolve disputes. De-identified data that can no longer identify you may be kept to improve the Services.

Subject to the PDPA and other applicable laws, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate or incomplete data. You can update most profile details directly in the app.
• Data portability: ask for your data in a commonly used format.
• Withdraw consent to processing at any time. This may mean some features stop working.
• Limit processing, including opting out of optional data contributions.
• Delete your account and associated data. See Delete your account.

To make a request, email support@sihat-ai.com from the email address linked to your account. We may need to verify your identity before acting on a request. We will respond within 21 days. If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).

The Services are not directed to children under 13, and we do not knowingly collect personal data from them. Users under 18 may use the Services only with the consent and supervision of a parent or legal guardian. If you believe a child has given us personal data without that consent, contact us and we will delete it.

Sihat AI is a wellness app. The camera-based face scan gives an indication of your vital signs to complement daily wellness monitoring. It is not a medical device and does not diagnose, treat, cure or prevent any disease. Any reading or AI insight must be confirmed by a doctor through a proper clinical assessment and diagnosis before you make health decisions. If you feel unwell or think you may have a medical emergency, contact a doctor or call your local emergency number (999 in Malaysia) immediately.

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the "Last updated" date. If the changes are significant, we will notify you in the app or by email before they take effect.

For privacy questions, data requests or complaints, contact our data protection team:

• Email: support@sihat-ai.com
• Address: Centre of Excellence for Extended Reality Technology Sdn Bhd, 16A, Jalan PS 9/1, Prima Selayang, 68100 Batu Caves, Selangor, Malaysia

You can also visit our Support page.