Privacy Policy

Last updated: May 2026

AskHEMI (Health & Medical Intelligence) is an AI-powered personal health companion developed by MedPlanner Sdn Bhd ("we", "our", or "us"). We respect your privacy and are committed to protecting your personal and health data. This Privacy Policy explains how we collect, use, store, and share your data when you use the AskHEMI app (the "App"), including through the Personalised Intelligence feature, in compliance with applicable laws in Malaysia, Indonesia, and the United Kingdom.

1. Information We Collect
We collect the following categories of information depending on how you use the App:

1.1 Account & Registration Data
Name, email address, phone number, and demographic details provided during account creation.

1.2 Personalised Intelligence Profile Data (Optional)
Through our Personalised Intelligence feature, you may voluntarily provide:

Biometric data: height, weight, BMI, blood pressure, blood glucose, HbA1c, cholesterol, heart rate, SpO2.
Medical history: chronic conditions, past diagnoses, hospitalisations, surgical history, family medical history.
Medications & supplements: current prescriptions, over-the-counter medications, vitamins, and supplements.
Lifestyle & social data: physical activity levels, sleep patterns, diet type, smoking status, alcohol consumption, occupation, and self-reported stress levels.
Mental & emotional data: mood entries, self-assessed wellbeing, and optional responses to validated mental health screening tools (e.g. PHQ-4).
Connected device data: where you choose to integrate a wearable or health device, we may receive passive data such as step counts, sleep stages, and continuous health metrics.

All Personalised Intelligence profile data is entirely optional. You may use AskHEMI without providing any health profile information.

1.3 Usage Data
App interactions, device type, operating system, IP address, approximate location (if enabled), session duration, and log files.

1.4 AI Interaction Data
Questions, messages, and inputs submitted to AskHEMI, which may be stored and processed to provide personalised responses and improve service quality.

2. How We Use Your Information
We process your information for the following purposes:

To provide personalised health guidance and AI responses tailored to your health profile.
To operate and improve the accuracy, safety, and relevance of AskHEMI's AI engine.
To maintain and update your Personalised Intelligence profile in accordance with your instructions.
To send you notifications, health reminders, or content relevant to your health profile (with your consent).
To comply with legal and regulatory requirements.
For research, analysis, and development of new features, using anonymised or aggregated data only.
To enable longitudinal health tracking, where you have opted into this feature

We will never use your health profile data to make automated decisions that produce legal or similarly significant effects on you without human review.

3. Legal Basis for Processing

Malaysia (PDPA 2010): We process personal data, including sensitive personal data (health data), based on your explicit consent, contractual necessity, or legal obligation. Health data is treated as a sensitive data class under the PDPA and handled accordingly.
Indonesia (PDP Law 2022): We collect and process personal and specific personal data (including health data) with your explicit consent, or as required for fulfilling services and legal compliance.
United Kingdom (UK GDPR / DPA 2018): Our legal bases include explicit consent (Article 9 for special category health data), performance of contract, legitimate interests, and compliance with legal obligations. Where we rely on legitimate interests, we have conducted a balancing test confirming this does not override your rights

4. Data Sharing & Disclosure

We do not sell your personal data. We may share your information with:

Service providers: Cloud hosting, analytics, and AI processing providers who support the App.
Healthcare partners: Only with your explicit consent, when you choose to share data with a healthcare professional.
Regulatory authorities: When required by law or to protect your safety.
All partners are bound by confidentiality and data protection agreements.

Your individual health profile is never shared with employers, insurers, or third parties without your specific, informed consent.

5. Data Storage & Retention

Your data is securely stored on servers located in Singapore and/or the UK, depending on your jurisdiction.
We retain your account and health profile data for as long as your account is active, or as required by applicable law.
You may delete your health profile or specific data categories at any time through the app settings.
Upon account deletion, your personal and health profile data will be permanently deleted within 30 days, except where retention is required by law.
AI interaction logs used for model improvement are anonymised within 90 days of collection.

6. International Data Transfers
As AskHEMI operates globally, your data may be transferred to and processed in countries outside of your home country. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) for UK/EU users, and equivalent mechanisms for other jurisdictions. Health data is treated with enhanced safeguards in all transfer scenarios.

7. Your Rights
Depending on your jurisdiction, you have the right to:

Access a copy of your personal and health profile data.
Correct or update inaccurate data, including your health profile.
Request deletion of your data or specific health profile categories.
Withdraw consent for Personalised Intelligence data processing at any time, without affecting the lawfulness of prior processing.
Restrict or object to certain data processing.
Data portability: receive your health profile in a structured, machine-readable format (UK and Indonesia users).
Lodge a complaint with your applicable supervisory authority.

To exercise any of these rights, please contact us at contact@medplanner.io. We will respond within 30 days.

8. Security Measures
We apply industry-standard and enhanced safeguards for health data, including:

AES-256 encryption for health profile data at rest.
TLS 1.3 encryption for all data in transit.
Role-based access controls limiting staff access to health data.
Regular security audits and penetration testing.
Secure deletion protocols for data removal requests.

No system is 100% secure. While we take all reasonable steps to protect your data, you use the App at your own risk.

9. Children's Privacy
AskHEMI is not intended for users under 16 years of age. We do not knowingly collect personal data, including health data, from children under 16 without verifiable parental consent. If you believe a child has provided health data without appropriate consent, please contact us immediately.

10. Cookies & Analytics
We use cookies and similar tracking technologies to operate the App and understand usage patterns. You may manage your cookie preferences through your device or app settings. We do not use your health profile data for advertising targeting.

11. Updates to This Policy
We may update this Privacy Policy from time to time, including to reflect changes to the Personalised Intelligence feature or applicable law. Significant changes will be notified through the App or by email at least 14 days before taking effect.

12. Contact Us
For any questions or concerns about this Privacy Policy or your data rights, please contact:

MedPlanner Sdn Bhd
Email: contact@medplanner.io
B-09-01, Tower B, Menara UOA Bangsar
5, Jalan Bangsar Utama 1, Bangsar