1. Scope
This document covers health information handled during your care: what you tell us in assessment, your WhatsApp conversation with the programme, your measurements, and the care events we exchange with the partner clinic. It applies to Mesura's programme record — held by Vast Dynamic Ltd (Hong Kong), trading as Mesura Health, and therefore controlled from outside Malaysia (see the PDPA Data Protection Notice §3). The partner clinic's medical record — consultation notes, prescriptions, dispensing records — is held by the clinic under its own statutory obligations and its own notice.
2. How health information is used in your care
- Assessment. Your intake answers and BMI form an eligibility packet reviewed by a partner clinic doctor. The system never auto-declines; only a doctor decides, in the doctor's own words.
- Care coordination. We book your consultations, and send the doctor a clearly-labelled AI-prepared summary of your intake — marked "AI-prepared draft — for doctor review; not a clinical record". The doctor's record is authored at the clinic; our packet is input, never record.
- Treatment and dispensing. The clinic sends us the care facts the programme needs — consultation outcome with the doctor-approved patient summary (never the clinical note), prescription-issued and dispensed events, and lab results only after a doctor has reviewed them.
- Ongoing monitoring. Your check-in replies are recorded as measurements; side-effect reports are logged for your care team.
- Clinical safety. Every inbound message is screened by a deterministic safety layer before any AI sees it, in English and Bahasa Malaysia, for red-flag symptoms (severe abdominal pain, allergic reaction, persistent vomiting, sudden vision change, low blood sugar, severe dehydration, gallbladder pain, suspected pancreatitis, self-harm). A hit locks AI replies and pages your human care team; emergencies page a doctor.
- Billing uses payment status only — your health information is not shared with payment providers.
3. The role of AI — and its limits
Software, including AI, helps draft routine replies, route your messages, and prepare summaries. Its limits are enforced in code, not just policy: it never diagnoses, never prescribes, never states or changes doses, never names medications in messages to you, has no access to the clinical record, and cannot move your care forward on its own. Medication and dose questions are always routed to your care team. Message text is processed by our AI providers named in the PDPA Data Protection Notice §3.
4. Who sees your health information
Your care team at the partner clinic (doctors, care coordinators, pharmacist) on a need-to-know basis; Mesura programme staff operating the service; and the service providers named in the PDPA Data Protection Notice §3, to the extent needed for their task. Access is role-based and every access-relevant action is written to an append-only audit log identifying who (or what system) acted, when, and on whose record.
5. Disclosures without your consent
Malaysian law permits or requires disclosure without consent only in narrow circumstances, and we hold to the narrow list: notifiable disease reporting required of the treating clinic under the Prevention and Control of Infectious Diseases Act 1988; a court order or other legal compulsion; and preventing a serious threat to your life or safety or another person's (for example, our escalation of a red-flag message to your care team, or to emergency services where warranted). We will tell you about any such disclosure unless the law prevents it.
Two more belong on this list, and we would rather name them than leave them implied: regulatory inspection — a healthcare regulator inspecting the partner clinic under the Private Healthcare Facilities and Services Act 1998 may see records held by that clinic in the course of the inspection; and the narrow exceptions in PDPA s.39, which permit disclosure without consent in specific circumstances such as the prevention or detection of crime.
That is the whole list. Its value is that it is short, and we intend to keep it short — if something falls outside it, we ask you.
6. Your choices
- Restrict sharing: care requires the two-way exchange with the partner clinic — that is the consent you give to start. You can withdraw it at any time; we then stop the exchange and your care transitions safely per the Medical Consent §7.
- Marketing and research are always separate. Neither is a condition of care; both are opt-in and withdrawable without affecting treatment.
- How we contact you: care runs on WhatsApp, and you can tell us whether you prefer English or Bahasa Malaysia. Those are the two languages the programme runs in — including the safety screening that reads every message you send — so we do not offer a third we could not screen as carefully.
- Copies of your records: you may request a copy of your programme record from us (PDPA access request — see the PDPA Notice), and of your medical record from the partner clinic.
7. Safeguards
Role-based access, encryption in transit, append-only audit and consent ledgers enforced at the database layer, signed and replay-protected clinic integration, consent-gated data flows (no consent on record → the data does not move), deterministic safety screening before and after AI involvement, secrets management, and no real patient data in test environments.
Breach procedure: contain, assess, notify the Commissioner and affected patients as the PDPA (as amended) requires, and record the incident (breach-response plan: legal/dpo/breach-response-plan.md).
8. Raising a concern
Contact our Data Protection Officer at support@mesura.health, or message us on your programme channel, about any data-handling concern; we will acknowledge within 2 working days and respond within 14 days. You may complain at any time to the Personal Data Protection Commissioner (JPDP) about data handling, or to the Malaysian Medical Council about clinical conduct. For emergencies, always call 999 or attend the nearest emergency department.