PRIVACY POLICY
Last Updated: __3 August 2023__
This Privacy Policy (“Policy”) governs your use of the MeMoSA® mobile application and web application at www.memosa.my (the “MeMoSA® App”) that is owned and operated by Cancer Research Malaysia (“CRMY” or “we” or “our” or “us”) with respects to the privacy of our Users . This Policy applies to all of our Services unless specified otherwise. We are committed to complying with the Personal Data Protection Act 2010 (the “PDPA”), in particular, its policies as well as corresponding regulations, guidelines and orders. This Policy explains what information we collect, hold and store, how we collect, process, use, disclose and safeguard your information when you visit or use our MeMoSA® App. Please read this Policy carefully. IF YOU DO NOT AGREE WITH THE TERMS OF THIS POLICY, PLEASE DO NOT REGISTER, OR ACCESS OR USE THE MeMoSA® APP.
Please also read the MeMoSA® App’s Terms and Conditions, which describes the terms under which you use our Services. Any capitalized term, words and expressions used but not defined in this Policy shall have the meaning attributed to it in our Terms and Conditions.
a. CRMY will collect personal information (as hereinafter defined) from you through various means as follows:
i. When you register with us on the MeMoSA® App to create an account. Registration is mandatory in order to be able to access and use the MeMoSA® App and the Services offered through the MeMoSA® App. To complete the registration, you will need to provide us with certain personal information as set forth in Clause 2 below.
ii. When you participate in our surveys, answer questionnaires, or attend interviews with our researchers for us to understand your experience with the MeMoSA® App or when you correspond with us by emails, letters, and telephone calls.
iii. When you provide us with feedback related to your use of our Services, e.g., by sending us emails on any queries or complaints that you may have with the MeMoSA® App. Your emails /online communication with us would include your name and contact particulars for us to be able to contact you to provide the necessary customer support.
iv. Through your continued use of the MeMoSA® App and our Services.
Personal information that we collect from you when you register with the MeMoSA® App. Personal information means any information that can be used to identify you which would include the following:
a. Your Account Information (Healthcare Professionals). When you register with the MeMoSA® App, you will provide your name, dental license or medical license number, scanned copies of your professional certificates which would include Malaysian Medical Council (“MMC”) or Malaysian Dental Council (“MDC”), and Annual Practicing Certificate (“APC”), the name of the specific hospital or clinic that you are currently attached to, your workplace’s email and phone number, and location of your workplace (all of which are mandatory information) to create an account. By registering with us, you explicitly authorize and give informed consent to us to collect, process and disclose your personal information in accordance with this Policy. You represent that you are a Healthcare Professional and that you are duly authorized to disclose all information that you provide to us.
b. Your Account Information (patients and/or Healthcare Volunteers and/or Relevant Persons). When you register with the MeMoSA® App, you will provide your name, NRIC No./identity documentation details, date of birth, age; phone number; home address, state, ethnicity, and gender. If you are a Healthcare Community Volunteer, as a point of contact between patients and Healthcare Professionals, you will also be required to provide the aforementioned information to create a main account to which the subaccounts of patients are tied to. By voluntarily providing us with your personal information to complete the registration of your account for access and use of the MeMoSA® App and the Services offered through the MeMoSA® App, you consent to our collection, processing, and disclosure of your personal information as set forth in this Policy. As a patient, you will be required to upload your signed consent form at the point of registration authorizing the collection of your personal information, processing for the specific purposes as made known to you and disclosure to the specific parties as informed to you by your Healthcare Professional. Healthcare Volunteers and /or Relevant Persons who register on behalf of patients shall likewise be required to upload the patient’s signed consent form to complete the registration on behalf of the patient.
c. Your Content and/or Messages (patients and/or Healthcare Volunteers and/or Relevant Persons). The personal information that we will collect from you at the point of registration and through your continued use of the MeMoSA® App and our Services would include personal health information as listed below:
i. lifestyle habits (smoking, drinking alcohol and chewing betel quid);
ii. any signs of oral cancer (white/red patches, ulcers, swelling in the neck, changes in voice);
iii. clinical information such as any changes at the site of previously treated lesion, increase in size of lesion, new growth, new ulcers, white or red lesions or burning sensation in the mouth
iv. images /photographs of the mouth uploaded by you (right buccal mucosa, upper labial/sulcus and gingiva; left buccal mucosa, upper labial/sulcus and gingiva; lower labial/sulcus and gingiva; floor and ventral tongue with lateral tongue; palate and upper lingual gingiva; dorsum/lateral and tonsil) and lesions inside the mouth;
v. messages between you and your Healthcare Professional (your condition, medical history, diagnosis, referral decisions (if any) and any subsequent follow up consultations, reports
/recommendations on your treatment should you and the Healthcare Professionals continue to use the MeMoSA® App to maintain communications regarding your condition).
Your personal health information falls within the definition of sensitive personal data as defined under the PDPA. By registering for an account and using the MeMoSA® App and the Services provided through the MeMoSA® App, you explicitly authorize /consent to CRMY collecting your personal health information. As part of the registration process, you are required to upload your signed consent form. If the registration of accounts for patients is carried out by Healthcare Volunteers or Relevant Persons, we will be taken to have obtained explicit consent from the patients for the processing of their personal health information by virtue of the uploading of the patient’s signed consent form. You agree that any personal information and/or personal health information you provide to us at the point of registration and through continued use of the MeMoSA® App and the Services will always be accurate, correct and up to date.
d. Your Content and/ or Messages (Healthcare Professionals). We collect the personal health information of patients from you through messages between you and your patients regarding their condition, medical history, diagnosis, instructions, referral decisions (if any) and any follow up consultations, reports /recommendations on the patient’s treatment. You confirm that you have the necessary written consent /authorization from your patients for the disclosure of their personal health information to us and that you can provide copies of the records of consent from the patients to us.
a. Usage and Log Information. We collect service-related, diagnostic, and performance information. This includes information about your activity (such as how you use our Services, how you interact with others using our Services, and the like), log files, diagnostic, crash, website, and performance logs and reports. This information is collected for analysis and evaluation in order to help us to improve the Services we provide. This information will not be used in association with your Account Information and the personal information.
b. Device and Connection Information. We collect device-specific information when you access or use our Services. This includes information such as hardware model, operating system information, browser information, IP address, mobile network information, and device identifiers. We collect device location information automatically when you register your workplace. You do not have a choice to opt out of the location features as it will be used to generate the identification numbers for patients.
a. We may process your Account Information for the following purposes:
i. to conduct teaching, research and publication on early detection of oral cancer, however all the personal information used in the resulting research will be depersonalized and will be in an aggregated, statistical or de-identifiable form and/ or;
ii. to help us operate, provide, improve, customize, fix, and support our Services and/ or;
iii. to understand, analyze and evaluate how you use our Services and/ or;
iv. to develop, and test new services and features, and conduct troubleshooting activities and/ or;
v. to detect, prevent and respond to fraud, abuse, security risks and technical issues that could harm CRMY, our Users, or the public and/ or;
vi. to respond to your enquiries, feedback, and complaints and/ or;
vii. for internal administrative purposes, such as auditing, data analysis, database records; and/or
viii. for and/or in connection with all other purposes necessary and/or incidental to the provision of our Services and all purposes directly related to any of the above purposes, whether at present or in the future. Where your personal information has been anonymized in the form of statistics and/or in a de-personalized, aggregated, or de-identifiable form, you acknowledge that such personal information is no longer personal information and the requirements of the PDPA would no longer apply to such anonymized data.
b. We may process your Content and/ or Messages for the following purposes:
i. to conduct teaching, research and publication on early detection of oral cancer of which all the personal health information used in the resulting research will be de-personalized and will be in an aggregated, statistical or de-identifiable form and/ or;
ii. to evaluate the reliability of the MeMoSA® App for teleconsultation based on the image quality functionality and/ or;
iii. to help us operate, improve, customize, fix, and support the MeMoSA® App and our Services whether in terms of layout, design, content, or functionalities and/ or;
iv. to facilitate a two-way communication between patients or Healthcare Volunteers and Healthcare Professionals for the scheduling of teleconsultation sessions for provision of healthcare services and/ or;
v. to develop, improve, extend, and test the Services by further developing /adding and testing new products, services, and features, conducting troubleshooting activities and improving CRMY’s business activities in order to foster a positive user experience; and/or
vi. for and/or in connection with all other purposes necessary and/or incidental to the provision of our Services and all purposes directly related to any of the above purposes, whether at present or in the future. Where your personal information (which includes personal health information) has been anonymized in the form of statistics and/or in a de-personalized, aggregated, or de-identifiable form, you acknowledge that such personal information is no longer personal information and the requirements of the PDPA would no longer apply to such anonymized data.
c. We may use your Account Information and your Content and/ or Messages for the fulfillment of any legal and regulatory requirements connected with providing you the Services.
d. To communicate with you. We use your personal information such as your Account Information to send you information to promote the use of our Services or send information which we think may be of interest to you, for instance, send you marketing communication relating to our business. Or we may let you know about upcoming changes or improvements to our Services. You may withdraw your consent to receiving marketing, advertising, or promotional communications from us on any new products and services that we may have. You can do so by contacting us at memosa@cancerresearch.my, accessing your account with us or clicking on the “unsubscribe” link in certain electronic communications we may send to you.
We will ask for your consent before using your personal information for a purpose that is not already covered in this Policy.
In connection with the above use of your personal information, we may disclose your personal information to the following:
If you are a patient, we share your personal information which includes the Content and/or Messages comprising your personal health information that you upload to the MeMoSA® App with Healthcare Professionals who will provide you with healthcare services. Such disclosure of your personal information in respect of the healthcare services rendered by the Healthcare Professionals to you will accordingly be subject to the terms and conditions and privacy policies of the clinics and hospitals that the respective Healthcare Professionals are attached to.
We work with other third-parties such as software developers, analytics professionals, research organizations, researchers, scientists, publishers of healthcare, medical, telemedicine and telecare journals, persons from academia /academic institutions, business partners, service providers, vendors, marketing partners and any other third-parties we may work with in the future to help us operate, provide, improve, understand, customize and support our Services.
When we share information with third-parties, we require them to use your personal information in accordance with our instructions and terms and only for the specific purposes as stated in Clause 4 above as informed to you and for which you have authorized disclosure.
c. Regulatory, Governmental and Enforcement Authorities and Agencies. We may disclose personal information to regulatory, enforcement and governmental authorities and agencies as required by law or to comply with requests and/or directives of the authorities or agencies, or any order of court or legal process or to investigate fraud or in order to prevent a threat to life or health, prevent a crime or protect national security and protect our rights or property or our affiliated companies.
All of our rights and obligations under our Policy are freely assignable by us to any of our affiliates, or to any prospective purchaser, transferee or assignee in connection with a merger, acquisition, restructuring, or sale of business or assets, or by operation of law or otherwise, and we may transfer your personal information to any of our affiliates, any successor entities, or new owner. In the event of any such sale or assignment or transfer of all or a substantial portion of our business or assets, you will be notified via email and/or any prominent notice posted on our website, of any change of ownership. The affiliate, successor entity or new owner as the case may be, will have all the rights and be subject to all of the obligations of this Policy and the PDPA including, without limitation, the right to modify or replace this Policy in which case, you will be notified of the uses of your personal information, and the choices you may have regarding your personal information.
We share your personal information with our employees to enable us to provide you with the Services. We also share your personal information with our professional advisors such as but not limited to our auditors, accountants, consultants, lawyers, tax advisors, insurers.
f. Data transfer and sharing. In the ordinary course of our operations, we will transfer personal information to third parties as set out above some of whom may be located outside of Malaysia as well as store and/or process your personal information outside of Malaysia for the purposes as set forth in this Policy. In doing so, we shall take necessary steps to safeguard your personal information and we will comply with this Policy, the PDPA and other applicable data protection and privacy laws.
We have put in place various security procedures, technical and organizational measures to protect your personal information in our possession from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration, or destruction. We protect your personal information by:
a. Verifying accounts and activity such as conducting background checks on information provided
i.e. dental or medical licenses at the point of registration and promoting safety and security on and off our Services, such as by investigating suspicious activity or violations of our Terms, and to ensure our Services are being used legally;
b. Allowing access to your personal information only by a password created or chosen by you where you are responsible for keeping this password confidential and not sharing it with anyone; modification of viewing availability of certain information such as NRIC No., dental or medical license, contact details of Healthcare Professionals by enabling configuration of account settings;
c. Firewall to prevent unauthorized access to Account Information and Content and/or Messages; and
d. Obligating all our authorized personnel and data processors who have access to and are associated with the processing of your personal information to respect the confidentiality of your personal information.
Storage and Back-up of Data. Your personal information will be stored and backed up securely in a
restricted and controlled location. We use AWS cloud server as our
server. Only our authorized personnel
with user ID and password are allowed to access and process your personal
information and they are obligated to respect
the confidentiality of your personal information. Stored data is backed up
securely at an appropriate frequency for disaster recovery. If a
message/submission cannot be delivered immediately (for example, if you are offline/ have no internet
connection), we are not able to retrieve the lost data. Please always
ensure you have secure internet
connection before using the MeMoSA® App. Refreshing
the MeMoSA® App on the browser will also lead to data loss. Please make sure
not to refresh the page while making a submission.
You acknowledge that no method of transmission over the internet or method of electronic storage is fully secured. While we strive to make all efforts to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. In the unlikely event of a data breach, you will be notified as soon as possible, in accordance with applicable law.
We will only retain your information for as long as is necessary to fulfill our contractual obligations to you in providing our Services and we shall take all reasonable steps to ensure that all Account Information and Content and/ or Messages is destroyed or permanently deleted or removed if it is no longer required for provision of our Services (for example if your participation in the MeMoSA® App or account with us has been terminated or suspended for any reason whatsoever in accordance with the Terms and Conditions). We also retain your personal information to comply with legal and regulatory requirements in accordance with the maximum statutory retention periods prescribed and in the event we have to identify any issues or resolve any legal proceedings. Notwithstanding the foregoing, if at all we retain and use your personal information beyond the time required for the aforementioned contractual, legal, regulatory or dispute resolution purposes, e.g., for the purposes of teaching, research and publication purposes as set forth above, we shall do so only in a de-personalized, aggregated, statistical or de-identifiable form.
Under the PDPA, you have the right
to request access to, correct and/or update your personal information subject
to any exceptions under applicable law.
a. Patients, Healthcare Volunteers and Relevant Persons: You can access and update or correct your Account Information anytime by accessing your account after the registration. We only allow you to update your address, phone number and email address. You are responsible for informing us if you need any other changes to your Account Information or in the event you believe that the Account Information we have about you is inaccurate, incorrect, incomplete, misleading or not up-to-date so we can make the changes for you.
b. Healthcare Professionals: You have the right to access your Account Information and request for correction of your personal information. You are responsible for informing us if you need any changes to your Account Information or in the event you believe that the Account Information we have about you is inaccurate, incorrect, incomplete, misleading or not up-to-date so we can make the changes for you.
You can keep updating and submitting your Content and/ or Messages in the MeMoSA® App as long as you use our Services. However, the MeMoSA® App does not allow you to remove, delete, forward, modify the information that you have submitted. It is important for you to submit correct, complete, accurate, and up-to-date Content and/ or Messages.
You may contact us via phone at +603-5650 9797 or email us at memosa@cancerresearch.my in respect of any data access or correction requests.
You also have the right to contact us to exercise your choice, at any time, to limit or to withdraw your consent to our continued use, processing, disclosure and retention of some or all of your personal information which includes requiring us to close your account by emailing us directly at (memosa@cancerresearch.my). However, it will result in us not being able to continuously provide you the Services.
10. Links to Third Party Sites
The MeMoSA® App may contain links to third party sites operated and
maintained by third parties, over which we have no control. We are not
responsible for the privacy practices of these third party sites that are
linked from the MeMoSA® App. You access these third party sites at your own
risk. We recommend that you read the privacy policy of each site that you visit
and contact its owner or operator if you have any questions or concerns.
We reserve the right to make changes to this Policy at any time and for any reason. We will provide you with notice of amendments to this Policy, as appropriate, and update the “Last Updated” date at the top of this Policy. Your continued use of our Services confirms your acceptance of our Policy, as amended after the date such revised Policy is posted. If you do not agree to our Policy, as amended, you must stop using our Services. You are encouraged to review our Policy from time to time.
If you have questions about our Policy or any complaints regarding the MeMoSA® App, please contact us at:
Cancer Research Malaysia 2nd Floor Outpatient Centre, Subang Jaya Medical Centre, No.1, Jalan SS12/1A,
47500 Subang Jaya, Selangor