Privacy Notice

Medimate Technologies Sdn. Bhd.  ·  Effective 1 July 2026

English | Bahasa Malaysia

1. About This Privacy Notice

This Privacy Notice explains how Medimate Technologies Sdn. Bhd. (Company No. 202501049808 (1651216-A)) collects, records, holds, stores, uses, discloses, transfers, protects and otherwise processes personal data in connection with the Medimate Platform and Companion Services, in accordance with the Personal Data Protection Act 2010 (Act 709) and its subsidiary legislation, as amended from time to time.

This Privacy Notice applies when you:

• Visit or use the Medimate website or download, access or use the Medimate mobile application
• Create or manage a User Account
• Make or manage a Booking, or receive Companion Services
• Make a Booking on behalf of another person or act as a Booking Recipient
• Provide information as an Emergency Contact
• Communicate with Medimate, submit an enquiry, complaint or incident report
• Participate in a survey, promotion, pilot or early-access programme
• Otherwise interact with Medimate

This Privacy Notice should be read together with the User Terms of Service, the Medical Disclaimer, the Refund and Cancellation Policy, and any other legal document applicable to the relevant service or Platform feature.

2. About Medimate and Its Role

Medimate Technologies Sdn. Bhd. operates a technology platform that facilitates non-medical appointment companion services. For Personal Data processed in connection with the Platform, Medimate will ordinarily act as the data controller where Medimate determines the purposes and manner in which the Personal Data is processed.

Only Verified Companions — individuals who have completed the Medimate Medical Appointment Companion Training Programme and been activated on the Platform — may perform live Bookings.

Medimate may appoint service providers to process Personal Data on Medimate's behalf as data processors. Certain third parties, including payment providers, healthcare providers, insurers, application-store providers and government authorities, may process Personal Data as independent data controllers under their own legal responsibilities and privacy notices.

3. Meaning of Personal Data

For this Privacy Notice, "Personal Data" means information that relates directly or indirectly to an individual who is identified or identifiable from that information or from other information available to Medimate, as defined under the Personal Data Protection Act 2010 (Act 709).

Personal Data may include information supplied directly by an individual, information generated through use of the Platform, information received from another authorised person, technical and device information, Booking and transaction records, communications, location information, photographs and documents, and other information capable of identifying or relating to an individual.

4. Sensitive Personal Data and Biometric Data

Certain Personal Data may be classified as sensitive personal data under the Personal Data Protection Act 2010 (Act 709). Depending on the Booking or Platform feature, this may include information concerning physical or mental health, medical conditions, disabilities, mobility or accessibility needs, appointment purposes, medication-related information, behavioural or safety risks, political opinions, religious beliefs or requirements, biometric data, and other information classified as sensitive personal data under applicable law.

Medimate will process sensitive personal data and Biometric Data only where the processing is reasonably necessary for an identified purpose, an appropriate legal condition applies, express consent has been obtained where required, access is appropriately restricted, and reasonable security measures have been implemented.

5. Persons Covered by This Privacy Notice

This Privacy Notice may apply to Users, Booking Recipients, persons making Bookings on behalf of another individual, Emergency Contacts, family members or authorised representatives, prospective Users, website visitors, persons submitting enquiries or complaints, persons whose information appears in Booking-related documents or communications, and other individuals whose Personal Data is processed through the Platform.

A separate Companion Privacy Notice or Companion Agreement governs Personal Data processed in connection with Companion onboarding, verification, training and service performance.

6. Booking on Behalf of Another Person

Where you provide Personal Data relating to a Booking Recipient, Emergency Contact or another person, you confirm that:

• The information is accurate and relevant
• You are authorised to provide the information
• You have informed the person where reasonably practicable that their information will be provided to Medimate
• You have obtained any permission or consent required by law
• You will not provide information that is excessive or unrelated to the Booking
• You will notify Medimate where the information becomes inaccurate or should no longer be used

7. Updates to This Privacy Notice

Medimate may update this Privacy Notice where reasonably necessary to reflect changes to the Platform or Companion Services, new features or processing activities, changes to service providers, changes to legal or regulatory requirements including updates to the Personal Data Protection Act 2010 (Act 709) and its subsidiary legislation, or improvements to privacy or security practices.

The latest version will state its version number and effective date. Where a change is material, Medimate will take reasonable steps to notify affected individuals through the Platform, email, notification or another appropriate communication channel.

8. Account and Identity Information

When you register, manage or use an Account, Medimate may collect full name, preferred name, date of birth, age, gender where relevant and voluntarily provided, profile photograph, mobile telephone number, email address, residential or correspondence address, nationality, identification type and number, copies or images of identification documents where verification is required, Account username or internal identifier, login and authentication information, language and communication preferences, accessibility preferences, and information used to verify your identity, age or eligibility.

9. Booking and Appointment Information

When a Booking is created, managed or completed, Medimate may collect Booking reference number, Booking date and time, requested Session duration, appointment date and time, healthcare facility or destination, meeting and completion locations, appointment department or purpose, requested Companion support, communication requirements, mobility and accessibility information, preferred language, Companion preferences, notes or instructions supplied for the Booking, changes, cancellations and rescheduling information, Session check-in and completion records, waiting and additional-time records, and information reasonably required to assess whether the Booking is suitable for Companion Services.

10. Information About a Booking Recipient

Where a Booking is made for another person, Medimate may collect information about the Booking Recipient including name, age or date of birth, contact details, relationship to the person making the Booking, appointment and location information, preferred language and communication needs, mobility and accessibility requirements, relevant health or safety information, required Companion support, Emergency Contact details, consent or authority information, and other information reasonably required to facilitate the Booking.

11. Health, Mobility and Safety Information

Because Medimate facilitates appointment-related Companion Services, Medimate may collect limited health, mobility and safety information relevant to the suitability and performance of a Booking. This may include:

• Physical or mental health information voluntarily disclosed for the Booking
• Disability or mobility limitations, use of a wheelchair or other mobility aid
• Hearing, speech, vision or communication needs
• Allergies or infectious-disease risks relevant to safety
• Risk of falls, wandering, confusion, aggression or distress
• Information indicating that clinical, nursing, personal-care or emergency support may be required
• Medication-related information where relevant to identifying service boundaries
• Appointment purpose or medical department and emergency information

Medimate does not generally require complete medical histories or full medical records. Where required by the Personal Data Protection Act 2010 (Act 709), Medimate will obtain express consent before processing sensitive personal data.

12. Payment and Transaction Information

Medimate may collect information necessary to process payments, including payment method details, billing information, transaction records, refund and adjustment records, and information used to detect and prevent fraud. Payments are processed through authorised third-party payment service providers. Medimate does not store full credit card or debit card details on its servers.

13. Location and Session Information

Where location features are enabled, Medimate may collect location information for matching and assigning a Companion, identifying the agreed meeting location, supporting Session check-in and completion, displaying permitted Session progress, supporting safety or emergency response, investigating incidents or disputes, detecting fraud or misuse, and improving Platform operations.

14. Communications and Support Information

Medimate may collect communications made through Platform messaging features, enquiries and support requests, complaints and incident reports, feedback and survey responses, and records of Medimate's responses and actions.

15. Device and Technical Information

When you use the Platform, Medimate may collect device type and model, operating system and version, application version, device identifiers, IP address, browser type, network and connectivity information, application log and error data, and usage and interaction data relating to the Platform.

16. General Processing Purposes

Medimate may process Personal Data where reasonably necessary to provide and operate the Platform, create and verify and manage Accounts, receive and assess and confirm and administer Bookings, match Users and Booking Recipients with suitable Verified Companions, facilitate and support Companion Services, process payments and refunds and transaction records, communicate with Users and Booking Recipients and Companions, assess service suitability and safety, provide accessibility and communication support, respond to emergencies and complaints and incidents, prevent fraud and misuse and security threats, comply with legal and regulatory requirements including the Personal Data Protection Act 2010 (Act 709), establish and exercise or defend legal rights, improve Platform performance and service quality, and perform other purposes described in this Privacy Notice or notified at the point of collection.

17. Grounds for Processing Personal Data

Depending on the circumstances, Medimate may process Personal Data with the individual's consent, where processing is necessary to take steps requested before entering into an agreement, where processing is necessary to perform a Booking or another agreement, where processing is necessary to comply with a legal obligation under the Personal Data Protection Act 2010 (Act 709) or other applicable Malaysian law, where processing is necessary to protect a person's vital interests, where processing is necessary for legal proceedings or the exercise or defence of legal rights, or on another basis permitted under applicable data-protection law.

18. General Disclosure Principles

Medimate may disclose Personal Data only for a purpose described in this Privacy Notice, to a person or class of persons identified in this Privacy Notice, with the individual's consent, where the disclosure is reasonably necessary to perform a Booking or provide a requested Platform feature, where the disclosure is necessary to protect a person's safety or vital interests, where the disclosure is required or permitted by applicable law including the Personal Data Protection Act 2010 (Act 709), or on another lawful basis.

Medimate does not sell or rent Personal Data to third parties for their independent and unrelated commercial marketing.

19. Verified Companions

Medimate may disclose relevant Personal Data to a prospective or assigned Verified Companion for purposes including allowing the Companion to assess whether to accept a Booking, preparing for the Session, identifying the User or Booking Recipient, locating the agreed meeting point, understanding permitted communication or accessibility needs, understanding relevant mobility or safety information, providing the approved Companion Services, communicating permitted progress updates, responding to an emergency or incident, confirming the start and completion of the Session, and resolving a complaint or service dispute.

Companions must use Personal Data only for authorised Booking and Platform purposes, keep Personal Data confidential, avoid copying or retaining information unnecessarily, protect information against unauthorised access, comply with Medimate's data-handling requirements, and report suspected loss, misuse or unauthorised disclosure promptly.

20. Other Disclosure Recipients

Personal Data may also be disclosed to:

• Users, Booking Recipients and Authorised Representatives
• Emergency Contacts, Emergency Services and Healthcare Personnel
• Healthcare Facilities and Healthcare Providers where relevant to the Booking
• Payment and Financial Service Providers for processing transactions
• Technology and Operational Service Providers supporting the Platform
• Insurers and Takaful Operators where applicable
• Professional Advisers and Business Support Providers
• Authorities, Regulators and parties in Legal Proceedings where required or permitted by law
• Corporate Transaction parties in connection with a lawful business transfer or restructure

Cross-border processing and transfers are conducted in accordance with the Personal Data Protection Act 2010 (Act 709) and its subsidiary legislation.

21. Protection of Personal Data

Medimate will take reasonable and appropriate technical and organisational measures intended to protect Personal Data against loss, misuse, accidental or unauthorised access, accidental or unauthorised disclosure, alteration, destruction, corruption, unlawful processing, and other security risks reasonably relevant to Medimate's operations, in accordance with the Personal Data Protection Act 2010 (Act 709).

Security measures include Account authentication and verification controls, password and credential-management requirements, role-based access controls, encryption during transmission and where appropriate storage, secure hosting and database configurations, application and infrastructure monitoring, logging and audit trails, malware and intrusion-protection measures, vulnerability assessment and security testing, system updates and security patches, backup and recovery procedures, and incident-response procedures.

22. Data Retention

Medimate maintains an internal data-retention schedule identifying applicable retention and disposal requirements for different categories of Personal Data. Personal Data will be retained only for as long as necessary to fulfil operational, legal, accounting, regulatory, and business requirements.

23. Personal Data Breaches

Where a Personal Data breach satisfies the applicable notification requirements, Medimate will notify the Personal Data Protection Commissioner of Malaysia as soon as practicable and within the period prescribed by applicable law or official requirements.

24. Privacy Governance

Medimate will comply with all applicable registration and regulatory requirements under the Personal Data Protection Act 2010 (Act 709). Where registration as a data controller is required by law, Medimate will complete the applicable registration and publish the registration details in this Privacy Notice once available. Until a formal Data Protection Officer is required or appointed under applicable law, Medimate has designated an internal privacy contact to receive and coordinate privacy matters. Privacy questions and requests may be directed to Medimate at support@medimate.com.my.

25. Overview of Your Rights

Subject to the Personal Data Protection Act 2010 (Act 709), identity verification and any lawful exceptions, you may have the right to:

• Be informed about how Medimate processes your Personal Data
• Request access to Personal Data held about you
• Request correction of inaccurate, incomplete, misleading or outdated Personal Data
• Withdraw consent where processing is based on consent
• Request that certain processing likely to cause damage or distress be stopped
• Prevent the use of your Personal Data for direct marketing
• Request data portability where applicable
• Request closure of your Account
• Ask Medimate to delete or restrict Personal Data where appropriate and legally permitted
• Submit a privacy complaint to Medimate or the Personal Data Protection Commissioner of Malaysia

26. Exercise of Rights and Privacy Requests

You may request access to, correction of, or deletion of your Personal Data by contacting Medimate at support@medimate.com.my. Medimate will respond within the period required by the Personal Data Protection Act 2010 (Act 709). Identity verification may be required before Medimate responds to a privacy request.

27. Privacy Complaints

You may submit a privacy complaint where you believe that Medimate has collected Personal Data unfairly or unlawfully, used Personal Data for an unauthorised purpose, disclosed Personal Data without an appropriate basis, failed to protect Personal Data, failed to correct inaccurate information, failed to respond appropriately to a privacy request, continued direct marketing after a valid objection, or otherwise failed to comply with the Personal Data Protection Act 2010 (Act 709).

Nothing in this Privacy Notice prevents an individual from submitting a complaint to the Personal Data Protection Commissioner of Malaysia or another competent authority where permitted by law. Information concerning the Commissioner, complaint procedures and current contact channels is available through the official website of the Personal Data Protection Department (www.pdp.gov.my).

28. Children and Persons Below Eighteen

Medimate's initial Companion Services are intended for adults who are at least eighteen (18) years old. For the initial service launch, a person below eighteen (18) years old may not create a User Account and may not be registered as a Booking Recipient. Where Medimate becomes aware that Personal Data relating to a minor has been submitted contrary to the applicable eligibility requirements, Medimate may suspend or cancel the affected Booking, restrict further processing, and delete or anonymise the information where appropriate.

29. Cookies and Similar Technologies

The Medimate website and Platform may use cookies, software development kits, pixels, local storage, device identifiers or similar technologies to enable essential Platform functions, maintain login sessions, remember language and accessibility preferences, protect Account and Platform security, prevent fraud and misuse, understand Platform performance, diagnose errors, measure website and feature usage, support authorised analytics, and provide marketing features where permitted.

Where non-essential analytics, advertising or marketing technologies require consent under applicable law, Medimate will provide an appropriate choice before activating them. Users are advised to review the applicable third-party SDK and service provider privacy notices, including those of Google Firebase, Google Cloud Platform, and other technology providers used in the Platform.

30. Language and Accessibility

This Privacy Notice will be made available in Bahasa Malaysia and English. Medimate may also provide a Chinese translation or another language version to improve accessibility. To the extent permitted by applicable law, the English version will be used as the reference version where an inconsistency between translations cannot reasonably be resolved.

31. Contact Us

Privacy questions, requests, consent withdrawals, Personal Data breach reports and complaints may be directed to:

Medimate Technologies Sdn. Bhd.
Medimate Technologies Sdn. Bhd. (Company No. 202501049808 (1651216-A))
Privacy Email: support@medimate.com.my

Registered Office (Statutory — Not for Legal Correspondence)
Level 10-01, Menara TH Uptown, No. 3, Jalan SS 21/39,
Damansara Utama, 47400 Petaling Jaya, Selangor, Malaysia

32. Effective Date and Version

Document Version: 1.0
Effective Date: 1 July 2026
Last Updated: 1 July 2026

This Privacy Notice applies from the Effective Date stated above. Earlier versions may be retained for compliance records, consent and notice evidence, complaint or dispute handling, audit purposes, and legal or regulatory requirements.