Privacy Policy

Effective date: [20 Oct  2026]

Last updated: [20 Oct  2026]

Website: [https://mymental.pphealthmalaysia.com/]

Operator: [MyMental by PP Health Malaysia (PPHM)]

This Privacy Policy explains how MyMental by PP Health Malaysia (PPHM) (“we”, “us” or “our”) collects, uses, discloses, stores and protects personal data when you use [Website Name], including its website, applications, search tools, directory, provider profiles, enquiry features and related services (collectively, the “Services”).

We intend this Privacy Policy to comply with applicable Malaysian privacy and data-protection law, including the Personal Data Protection Act 2010 (Act 709), as amended, and relevant regulations, standards and guidance issued by the Personal Data Protection Commissioner.

This Privacy Policy applies to:

- visitors to the Website;

- people searching for mental health services;

- people who contact or review providers;

- mental health professionals and organisations listed in the directory;

- representatives and staff of listed organisations;

- people who create an account;

- people who submit forms or enquiries; and

- people who communicate with us.

This Privacy Policy does not necessarily apply to the independent privacy practices of providers, advertisers, booking platforms, payment providers or other third parties linked to or accessible through the Services. Those organisations are responsible for explaining their own data practices.

For personal data that we collect and use for operating the directory, we generally act as the data controller under applicable Malaysian law.

This may include information collected to:

- operate and secure the Website;

- create and manage provider listings;

- provide search and directory functions;

- respond to enquiries;

- moderate reviews and content;

- administer accounts;

- provide customer support;

- improve the Services;

- send permitted communications; and

- comply with legal obligations.

A provider listed on the Website may separately act as a data controller for information it collects directly from you, including information collected during an appointment, consultation, booking or treatment relationship.

Where we process personal data solely on behalf of a provider under its instructions, we may act as a data processor or service provider. The provider’s own privacy policy and instructions may then also apply.

The personal data we collect depends on how you use the Services.

You may provide:

- full name;

- preferred name;

- username;

- email address;

- telephone number;

- postal or business address;

- account login details;

- organisation name;

- professional title;

- qualifications and registration details;

- business and provider information;

- payment and billing details;

- information submitted through contact forms;

- information submitted in a listing;

- review or rating content;

- photographs, logos and other media;

- preferences and communication choices;

- information in support requests; and

- information in correspondence with us.

- the type of support you are seeking;

- general wellbeing concerns;

- preferred service type;

- language, cultural or accessibility requirements;

- age range or age-related service needs;

- location or preferred treatment area;

- whether you are seeking online or in-person support; and

- information included in a message or enquiry.

Please provide only the information necessary for your enquiry. Do not submit detailed medical histories, diagnoses, medication records, trauma details, information about self-harm or suicide risk, or other highly sensitive information unless it is necessary and the relevant feature specifically requests it.

Information about a person’s physical or mental health may constitute sensitive personal data under Malaysian law. We will handle such information with additional care and process it only where we have an appropriate legal basis and where permitted by applicable law.

2.3 Provider and organisation information

If you create or manage a provider listing, we may collect:

- your name and contact details;

- job title and relationship to the organisation;

- organisation name and registration details;

- professional qualifications and registration information;

- licences, certificates and insurance information;

- areas of practice and specialisms;

- service locations;

- languages offered;

- accessibility information;

- fees and payment arrangements;

- appointment and availability information;

- website and social-media links;

- photographs, logos and other profile materials;

- verification documents;

- billing and subscription information; and

- communications about the listing.

Some provider information may be displayed publicly. We will identify, through the listing interface or related instructions, the information intended for public display.

When you use the Website, we may collect:

- IP address;

- device type and identifiers;

- browser type and version;

- operating system;

- language and time-zone settings;

- approximate location derived from IP address;

- pages and listings viewed;

- search terms;

- links clicked;

- referring and exit pages;

- date and time of visits;

- session information;

- error logs;

- security and fraud indicators; and

- cookie and similar technology information.

We may associate technical information with an account or enquiry where necessary to provide, secure or administer the Services.

We may receive information from:

- providers and organisations;

- authorised representatives;

- public professional registers;

- business directories;

- regulatory or licensing bodies;

- referral partners;

- booking or payment platforms;

- identity or verification services;

- analytics and security providers;

- social-media platforms, where you interact with us there;

- other users who report a listing or content; and

- public sources.

Where we receive personal data from another person, you confirm that you are authorised to provide it or that the disclosure is otherwise lawful.

You should not provide personal data about another person unless:

- you have their permission;

- you are authorised to act for them; or

- the disclosure is otherwise permitted by law.

This is particularly important for:

- children;

- patients;

- clients;

- family members;

- employees;

- people receiving mental health support; and

- people at risk.

Do not include another person’s diagnosis, treatment details, crisis information, contact details or other sensitive information in a public review or enquiry unless there is a lawful and necessary reason to do so.

If you submit information about another person, you should ensure that they have been informed about this Privacy Policy where required by law.

We may collect and use personal data for the following purposes.

4.1 Providing the directory

We may use personal data to:

- operate and maintain the Website;

- display provider listings;

- allow users to search for services;

- provide filters and location-based results;

- facilitate contact between users and providers;

- process listing submissions;

- publish provider information;

- manage provider accounts;

- provide enquiry and messaging features;

- provide appointment or booking links;

- administer subscriptions and paid listings; and

- provide customer support.

We may use information to:

- verify a provider’s identity;

- check qualifications, registration or business information;

- review listing submissions;

- detect false or misleading claims;

- moderate reviews and other content;

- investigate complaints;

- prevent impersonation;

- detect fraud and abuse;

- protect vulnerable users; and

- enforce our Terms of Service.

Verification does not necessarily mean that we independently guarantee a provider’s qualifications, safety, quality or suitability.

We may process personal data to:

- protect the Website and users;

- detect malicious activity;

- prevent unauthorised access;

- investigate security incidents;

- identify spam and automated abuse;

- prevent account takeover;

- enforce access controls;

- maintain audit logs; and

- comply with security requirements.

We may use contact details to:

- respond to enquiries;

- provide requested information;

- confirm or administer an account;

- send service notices;

- notify you about changes to the Website;

- respond to complaints;

- request clarification;

- send provider-listing reminders; and

- provide support.

Where required by law, we will obtain consent before sending direct marketing communications.

Subject to applicable law and your choices, we may use personal data to:

- send information about our Services;

- promote relevant directory features;

- measure the effectiveness of communications;

- understand how people use the Website;

- improve search functionality;

- analyse trends;

- conduct surveys; and

- develop new features.

We will not use sensitive mental health information to send targeted marketing unless we have a lawful basis and any required consent.

We may process personal data to:

- comply with Malaysian law;

- comply with court orders or lawful requests;

- respond to regulators, authorities or law-enforcement agencies;

- establish, exercise or defend legal claims;

- investigate suspected unlawful conduct;

- maintain required business records; and

- protect the rights, safety and property of users, providers and the Operator.

Depending on the circumstances, we may rely on one or more of the following grounds:

- your consent;

- the performance of an agreement with you;

- steps taken at your request before entering into an agreement;

- compliance with a legal obligation;

- protection of vital interests, where legally applicable;

- legitimate business purposes that do not override your rights and interests; and

- another lawful basis permitted by Malaysian law.

Where we rely on consent:

- you may withdraw it at any time;

- withdrawal will not affect processing carried out before withdrawal;

- some Services may not be available without the relevant information; and

- withdrawal may not require us to delete information that we must retain for legal, security or other lawful purposes.

For sensitive personal data, including health-related information, we will seek explicit consent or rely on another lawful condition where permitted by applicable law.

You may browse much of the Website without creating an account or providing personal data.

However, some information may be necessary to:

- create an account;

- publish or manage a provider listing;

- respond to an enquiry;

- process payment;

- verify a provider;

- investigate a complaint;

- provide a requested feature; or

- comply with legal requirements.

If you do not provide required information:

- we may be unable to provide the requested feature;

- an enquiry may not be delivered;

- a listing may not be published;

- a transaction may not be completed; or

- we may be unable to investigate a complaint.

Where practical, we will identify mandatory fields in forms or explain the consequences of not providing requested information.

Some information submitted by providers is intended to be publicly available, including:

- provider or organisation name;

- professional description;

- service category;

- location;

- business contact details;

- qualifications and registration information;

- languages;

- accessibility information;

- fees or fee ranges;

- opening hours;

- website links;

- photographs and logos; and

- other listing content.

Before submitting information, providers should consider that public information may be:

- viewed by anyone;

- copied or indexed by search engines;

- stored in archives;

- shared through social media;

- accessed from outside Malaysia; and

- difficult to remove completely after publication.

Do not submit personal information that is not necessary for a public listing.

We may retain copies of removed or amended information where necessary for legal, security, fraud-prevention, dispute-resolution or record-keeping purposes.

If you submit a review, rating, comment, photo or other content:

- your chosen display name may be shown;

- the content may be publicly visible;

- the content may be indexed by search engines;

- we may moderate or edit it;

- we may contact you about it;

- we may share relevant details with a provider when investigating a complaint; and

- we may retain records of moderation decisions.

Do not publish:

- another person’s personal or health information;

- confidential client information;

- detailed clinical information;

- allegations that you cannot reasonably support;

- information that identifies a child or vulnerable person unnecessarily; or

- content that could place someone at risk.

Reviews do not create a professional, therapeutic or confidential relationship with the Operator.

When you use an enquiry, contact or booking feature, we may collect and share the information necessary to deliver the communication.

This may include:

- your name;

- contact details;

- selected provider;

- message;

- preferred appointment information;

- location;

- accessibility or language preferences; and

- technical and delivery information.

The provider may become an independent controller of the information after receiving it. The provider may contact you under its own privacy policy and professional obligations.

We do not guarantee that a provider will:

- respond;

- accept your enquiry;

- maintain confidentiality in the same way as a regulated clinical service;

- have current availability; or

- be suitable for your needs.

Do not use ordinary directory messaging for emergencies.

We may use cookies, pixels, local storage and similar technologies.

These may be required to:

- keep the Website secure;

- maintain sessions;

- remember account settings;

- process forms;

- provide essential functions;

- prevent fraud; and

- manage consent choices.

With appropriate consent where required, we may use analytics tools to understand:

- which pages are visited;

- how users navigate the Website;

- which searches are performed;

- technical errors;

- general usage trends; and

- the effectiveness of improvements.

If used, these technologies may help us or advertising partners:

- measure campaigns;

- limit repeated advertisements;

- understand interactions;

- provide relevant communications; or

- measure conversions.

We will not knowingly use advertising technology to target individuals based on sensitive mental health information without a lawful basis and any required consent.

You can manage cookies through:

- our cookie banner;

- the Website’s privacy settings;

- browser controls; and

- device settings.

Blocking some cookies may affect Website functionality.

We may disclose personal data to the following categories of recipients.

We may share information with a provider or organisation where you:

- contact it;

- submit an enquiry;

- request a booking;

- ask us to forward information;

- submit a review requiring investigation; or

- otherwise choose to interact with it.

We may use suppliers that provide:

- hosting;

- cloud storage;

- software;

- customer support;

- email delivery;

- messaging;

- payment processing;

- identity verification;

- directory management;

- analytics;

- security;

- fraud prevention;

- data backup;

- professional advice; and

- technical maintenance.

These parties may access personal data only as necessary to provide services to us and must comply with appropriate confidentiality and security obligations.

We may disclose information to:

- lawyers;

- accountants;

- auditors;

- insurers;

- consultants; and

- other professional advisers.

We may disclose personal data to:

- the Personal Data Protection Commissioner;

- courts and tribunals;

- law-enforcement bodies;

- professional regulators;

- safeguarding authorities;

- emergency services; and

- government agencies,

where permitted or required by law.

If we sell, restructure, merge, finance or transfer all or part of our business, personal data may be disclosed to prospective or actual purchasers, advisers and successor entities.

The recipient will be expected to use personal data consistently with this Privacy Policy or provide a legally required updated notice.

We may disclose information for another purpose where you have given consent or requested the disclosure.

We do not sell personal data as a standalone data product. If this changes, we will update this Privacy Policy and obtain any consent required by law.

Some recipients, service providers or systems may be located outside Malaysia. As a result, personal data may be transferred to, stored in or accessed from another country.

Possible locations include:

- countries where our hosting or software providers operate;

- countries where a provider or organisation receiving an enquiry is located; and

- countries used by support, security, analytics or payment suppliers.

Before making a cross-border transfer, we will take steps required by applicable Malaysian law. Depending on the circumstances, this may include:

- assessing the level of protection available in the destination;

- using contractual protections;

- conducting a transfer impact assessment;

- applying encryption and access controls;

- limiting the data transferred;

- obtaining consent where appropriate;

- ensuring that the transfer is necessary for a contract or requested service; and

- relying on another permitted legal exception.

We will maintain appropriate records of relevant overseas recipients and safeguards.

You should understand that data protection laws in another country may differ from Malaysian law. By using a feature that requires an overseas transfer, you acknowledge that the transfer may occur, subject to applicable legal requirements.

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

- provide the Services;

- maintain provider listings;

- manage accounts;

- respond to complaints;

- meet legal and regulatory obligations;

- establish or defend legal claims;

- prevent fraud and abuse;

- maintain security records; and

- resolve disputes.

Retention periods vary according to the type and purpose of the information.

When personal data is no longer required, we will securely delete, anonymise or de-identify it, subject to technical, legal and backup limitations.

Backups may retain information for a limited period after deletion. Where immediate deletion is not practical, we will restrict access and delete the information during the next applicable backup cycle.

We use reasonable and appropriate technical, organisational and administrative measures to protect personal data from:

- loss;

- misuse;

- unauthorised access;

- unauthorised disclosure;

- alteration;

- destruction; and

- other unlawful or accidental processing.

Measures may include:

- access controls;

- role-based permissions;

- authentication;

- encryption in transit;

- encryption at rest where appropriate;

- secure hosting;

- vulnerability management;

- malware and intrusion monitoring;

- logging and audit trails;

- staff confidentiality obligations;

- staff training;

- supplier due diligence;

- secure deletion;

- backups;

- incident-response procedures; and

- regular review of security controls.

No online service is completely secure. You are responsible for:

- keeping account credentials confidential;

- using a secure device;

- avoiding public or compromised networks for sensitive information;

- logging out where appropriate; and

- notifying us of suspected unauthorised access.

A personal-data breach may include:

- unauthorised access;

- accidental disclosure;

- loss or theft;

- hacking;

- ransomware;

- misuse by an employee or supplier;

- accidental publication; or

- destruction or alteration of personal data.

If we reasonably believe a breach has occurred, we will:

1. contain and investigate the incident;

2. assess the nature and extent of the affected data;

3. identify potentially affected individuals;

4. assess the likelihood and seriousness of harm;

5. notify the Personal Data Protection Commissioner where required;

6. notify affected individuals where required;

7. take remedial steps; and

8. document the incident and response.

Notifications may be delayed or limited where permitted by law, including where necessary to prevent further harm or protect an investigation.

If a provider or service provider experiences a breach involving information processed for us, it must notify us promptly and provide reasonable assistance with investigation, notifications and remediation.

Where required by Malaysian law, we will appoint a Data Protection Officer and notify the relevant authority within the required period.

Our DPO or privacy contact is:

Email: [editor@pphm.life]

The DPO or privacy contact may:

- advise on privacy compliance;

- handle data-subject requests;

- receive complaints;

- coordinate breach responses;

- monitor data-protection practices;

- communicate with the Personal Data Protection Commissioner; and

- advise on processing risks and safeguards.

Where we are not legally required to appoint a DPO, we will still maintain a designated privacy contact.

Subject to applicable Malaysian law and any relevant conditions or exemptions, you may have the right to:

You may request access to personal data that we hold about you.

We may need to:

- verify your identity;

- clarify the scope of your request;

- charge a permitted fee;

- refuse or limit access where legally permitted; or

- redact information relating to another person.

You may ask us to correct personal data that is inaccurate, incomplete or out of date.

You should also update your account or provider listing where self-service editing is available.

Where processing is based on consent, you may withdraw consent by contacting us or using the relevant account or communication setting.

Withdrawal may not affect processing based on another lawful basis and may prevent us from providing certain Services.

You may opt out of direct marketing by:

- selecting the unsubscribe link;

- changing account preferences;

- contacting us; or

- following the instructions in the message.

We may continue sending essential service and legal notices.

Where applicable and technically feasible, you may request that certain personal data be transmitted to you or another organisation in a commonly used format.

This right may be subject to:

- identity verification;

- legal conditions;

- technical feasibility;

- protection of another person’s rights;

- security concerns; and

- exemptions under applicable law.

Malaysian law may not provide an unlimited right to deletion in every circumstance. However, you may ask us to delete, anonymise or restrict use of personal data where:

- it is no longer necessary;

- it was processed unlawfully;

- consent has been withdrawn and no other lawful basis applies; or

- another legal ground applies.

We may retain information where required for legal, security, fraud-prevention, dispute-resolution or other lawful purposes.

You may object to processing in circumstances permitted by law, including certain direct-marketing activities.

We may continue processing where we have compelling lawful grounds or need the information to establish, exercise or defend legal claims.

Submit a request using:

Email: [editor@pphm.life]

Please include:

- your full name;

- contact details;

- the nature of your request;

- the account email or listing details, if relevant;

- the personal data or processing concerned;

- your preferred response method; and

- documents reasonably needed to verify your identity.

We may request further information to prevent unauthorised disclosure.

We will respond within the period required by applicable law or, where no specific period applies, within a reasonable period. If we cannot comply, we will explain why, subject to legal restrictions.

We may charge a reasonable fee where permitted by law or refuse a request where legally allowed. We will not refuse a request unreasonably.

The Website is not intended to collect detailed health information from children through public forms or reviews.

A parent, guardian or authorised adult should assist a child or young person where appropriate.

If you submit information about a child:

- provide only what is necessary;

- ensure that you are authorised to do so;

- avoid public disclosure of identifying health information; and

- use a provider or service that is appropriate for the child’s age and needs.

If we learn that we have collected personal data from a child in circumstances where collection was not appropriate or lawful, we may delete it or take other steps required by law.

The Website is not an emergency service and does not continuously monitor enquiries, reviews or messages.

Do not use the Website to report an immediate risk of:

- suicide;

- self-harm;

- violence;

- abuse;

- medical emergency; or

- immediate danger.

Contact local emergency services, a hospital or an appropriate crisis service.

If we receive information suggesting a serious and immediate risk to life or safety, we may disclose relevant information to emergency services, safeguarding organisations, healthcare providers or authorities where permitted or required by law.

We will disclose no more information than we reasonably consider necessary for the relevant purpose, where practicable.

We may use automated tools to:

- detect spam;

- identify malicious activity;

- moderate content;

- classify listings;

- improve search results;

- identify duplicate content;

- analyse technical performance; and

- assist customer support.

Automated tools may produce errors. Where required by law or where appropriate, we will provide a method for human review or reconsideration.

We will not make decisions about diagnosis, treatment or a person’s mental health condition through the Website.

If we use automated decision-making that has legal or similarly significant effects, we will provide any notices and rights required by applicable law.

The Website may contain links to:

- provider websites;

- booking systems;

- payment platforms;

- maps;

- social-media pages;

- crisis services;

- government websites;

- professional registers; and

- other third-party services.

When you leave our Website, the third party may collect and use personal data under its own policies.

We do not control or accept responsibility for:

- third-party privacy practices;

- security;

- accuracy;

- availability;

- confidentiality;

- data retention; or

- the suitability of a third-party service.

You should read the relevant third party’s privacy policy before submitting information.

We may send service-related messages that are necessary to:

- administer your account;

- operate a listing;

- respond to an enquiry;

- provide security notices;

- notify you about important changes; or

- manage payments.

Where required by law, we will obtain consent before sending promotional communications.

You may stop receiving marketing messages at any time by:

- clicking “unsubscribe”;

- changing your account settings;

- contacting us; or

- replying according to the instructions provided.

Stopping marketing communications will not stop essential service messages.

You should provide accurate and current information.

You may ask us to correct information that is inaccurate or incomplete. Providers are responsible for keeping their listings current.

We may update this Privacy Policy to reflect:

- changes to law;

- regulatory guidance;

- new Services;

- changes in technology;

- changes to suppliers or transfer destinations; or

- changes to our data practices.

When changes are material, we may notify you by:

- posting the revised policy;

- changing the “last updated” date;

- displaying a Website notice;

- sending an email; or

- using another legally permitted method.

Where required, we will obtain fresh consent or provide another legally compliant notice.

If you have a concern about our handling of personal data, contact us first:

Privacy email: [editor@pphm.life]

Please include:

- your name;

- the nature of your concern;

- relevant dates;

- the account or listing involved;

- supporting documents, where appropriate; and

- the outcome you are seeking.

We will investigate and respond within a reasonable period or within any period required by applicable law.

You may also contact the Personal Data Protection Commissioner or another relevant Malaysian authority where you believe your rights have been infringed.

Current authority contact details should be checked at:

Personal Data Protection Commissioner / Jabatan Perlindungan Data Peribadi:

• https://www.pdp.gov.my/

• Commissioner / Director General: Shariffah Rashidah Binti Syed Othman

• Address: Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Precinct 4, 62100 Putrajaya, Malaysia

• Phone: 03-8000 8000 (MyGCC) or 03-7456 3888 (JPDP Call Center)

• Email: aduan@pdp.gov.my

For privacy questions, data-subject requests, complaints or security concerns:

Operator: [PP Health Malaysia (PPHM)]

Email: [editor@pphm.life]

Website: [https://pphealthmalaysia.com/]

For an emergency, do not use this contact information. Contact your local emergency service or an appropriate crisis service immediately.