Privacy Policy

Medify ("we", "us", "our", or "Application") is operated by an individual developer in Malaysia. We are committed to protecting your privacy.

By using Medify, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

We collect information that you provide directly, and information collected automatically when you use the Application.

We use your personal data solely to:

Medical billing data constitutes sensitive personal data under Section 40 of Malaysia's Personal Data Protection Act 2010. Processing this data requires your explicit consent.

At account creation, you will be asked to provide explicit consent via a checkbox: "I consent to Medify processing my personal data, including health-related billing data, for bill extraction, analysis, and related service operations as described in the Privacy Policy."

At each document upload, a contextual notice explains that Medify processes the document for bill extraction and analysis and that eligible data-minimised bill-line observations contribute to public price evidence.

The upload notice and this Policy also explain that eligible bill-line descriptions, hospital context, dates, package details, currency, and charges contribute to Medify's public price evidence. Direct patient and account identifiers are excluded.

You may withdraw your consent at any time by contacting privacy@medify.my or by deleting your account. Because Medify requires health-related bill processing to provide its core service, withdrawal of consent may limit or prevent continued use of the Application. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Extraction accuracy varies by document quality, format, and complexity. Well-formatted digital bills typically yield higher accuracy than scanned, handwritten, or non-standard formats. You should always verify extracted information against your original bill before taking any action.

Medify does not routinely conduct manual review of uploaded bills. However, where necessary to provide support, troubleshoot technical issues, investigate suspected abuse, maintain security, or improve extraction quality, the operator may access limited portions of uploaded documents, extracted text, or processing outputs. Any such access is limited to what is reasonably necessary for the specific purpose.

We do not use your uploaded bills, extracted bill text, or identifiable personal data to train third-party AI models. We do not use identifiable personal data to train Medify's own models. Eligible data-minimised bill-line observations may contribute to public price evidence as described in Section 10. If we intend to use identifiable personal data for model training in the future, we will update this Privacy Policy and seek separate explicit consent before doing so.

To operate Medify, we engage trusted third-party service providers. We take reasonable steps to ensure subprocessors handle your data appropriately and only for the purposes described in this Policy.

Your data may be processed and stored across infrastructure located in the United States, the European Union, and Asia-Pacific, depending on service provider capacity, availability, and operational requirements. Where available, this may include regions such as US East, EU Central, and APAC Southeast Asia.

Where your personal data is transferred outside Malaysia, we apply contractual, technical, and organisational safeguards intended to protect your data in accordance with applicable Malaysian data protection requirements.

By using Medify, you consent to the transfer and processing of your data in these jurisdictions for the purposes described in this Policy. We take reasonable steps to ensure your data is protected in transit and at rest in all jurisdictions where it is processed.

If you upload or manage medical bill information relating to another person, including a child, spouse, parent, or other family member, you confirm that you have the consent, parental or guardian authority, or other lawful authority required to submit and manage that information through your account.

Medify accounts are for adults aged 18 and above. Dependants are not users of the Application; their data is managed by and attributed to the adult account holder. We are not responsible for data submitted without appropriate authorisation.

We retain your data while your account is active. When you delete your account, the following applies:

Eligible bill-line observations from submitted documents contribute to Medify's public price evidence. Publication is limited to bill-line descriptions, hospital context, dates, package details, currency, and charges needed for price transparency.

Direct account and patient identifiers are excluded from the public price API. Rows that may contain identifiers are withheld by publication safety filters.

Deleting a document or account excludes its linked observations from future public observations and comparison aggregates, subject to the retention and backup schedule in Section 9.

We are mindful that medical billing data can sometimes remain indirectly identifying even after removal of direct identifiers. We apply reasonable safeguards and data minimisation measures before retaining data long-term, and we do not attempt to re-identify de-identified records.

Public observations are supporting information, not proof that a hospital charge is inappropriate. Raw entries are not represented as accepted item identities.

To exercise these rights, you may submit a privacy request through the Application or contact us at privacy@medify.my. We may need to verify your identity before processing your request.

For users in Malaysia, we process your personal data in accordance with the Personal Data Protection Act 2010 (PDPA).

If we become aware of a personal data breach affecting your data, we will assess the breach and notify the relevant Malaysian authorities and affected users where required by applicable law. We maintain internal processes to detect, investigate, and respond to suspected data security incidents in a timely manner.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date at the top of this document and, where appropriate, by notice within the Application. Continued use of Medify after any changes constitutes your acceptance of the updated Policy.

For privacy enquiries, data access requests, or concerns:

Medify

Email: privacy@medify.my

Support: support@medify.my