Privacy Policy

This Privacy Policy explains how Zen Integrated Sdn. Bhd. ("JagaU", "we") collects, uses, discloses and protects your personal data when you use the JagaU app, website and services, in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This policy also serves as our Personal Data Protection Notice under Section 7 of the PDPA.

From patients and caregivers

• Identity and contact data: name, phone number, email, NRIC/passport number (where required for B40 verification or insurance), addresses.
• Health data (sensitive personal data): patient medical conditions, allergies, medication records, vital signs, visit reports and notes entered by you or by Providers. We only collect this with your explicit consent and to deliver care.
• Location data: the address of the visit and, with your permission, your device location to match you with nearby Providers.
• Transaction data: booking history, orders, payment status and amounts. We do not store full card numbers — these are handled by Curlec (Razorpay).
• Household income documents (e.g. STR/BSH statements) if you apply for the B40 programme.
• Device and usage data: device type, app version, log data, push notification tokens.

From providers and suppliers

• Identity documents, professional registration certificates, photographs, bank account details for payouts, location while on duty, ratings and complaint records.

• To create and manage your account and patient profiles.
• To match your request with suitable nearby Providers and let them deliver the service safely, which includes sharing the patient's relevant health information with the assigned Provider.
• To process payments, refunds, deposits and Provider payouts.
• To maintain the patient's care record (vitals, medication, visit reports) so caregivers and Providers have continuity of care.
• To send booking updates, reminders, receipts and service notifications.
• To investigate complaints, prevent fraud and enforce our Terms.
• To verify eligibility for the B40 affordability programme.
• To comply with legal obligations, including tax (e-Invoice) and regulatory requirements.
• With your consent, to send you promotions and information about new services. You may opt out at any time.

We may share personal data with:

• Providers assigned to your request — only the information needed to deliver the service (patient name, address, contact, relevant health notes). Providers may only view history of patients they have been assigned to.
• Equipment suppliers fulfilling your order — name, delivery address and contact number.
• Payment processors — Curlec (Razorpay) and your bank, for payment processing.
• Service providers who host our infrastructure (cloud servers, object storage, SMS/email/push notification providers, customer support chat).
• Zakat/CSR sponsors of sponsored care packages — aggregated or anonymised reporting only, unless you consent otherwise.
• Regulators, law enforcement or courts where required by law.

We do not sell your personal data.

Some of our service providers (e.g. cloud hosting) may store data outside Malaysia. Where this occurs we ensure appropriate contractual safeguards are in place.

We use encryption in transit (TLS), encrypted storage, role-based access controls, audit logs and regular reviews to protect your data. Health records are accessible only to you, the assigned Provider and authorised JagaU staff. See our Security Policy.

We retain personal data for as long as your account is active and as needed to fulfil the purposes above. Transaction and tax records are kept for at least 7 years as required by Malaysian law. Health records are retained in line with Malaysian medical record-keeping guidelines. You may request deletion of your account; we will delete or anonymise data that we are not legally required to keep.

Under the PDPA you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Withdraw consent to processing (which may mean we cannot provide certain services);
• Opt out of marketing communications;
• Request deletion of your account.

To exercise these rights, contact our Data Protection Officer at zen.integrated@gmail.com. We will respond within 21 days.

Accounts may only be created by adults. Patient profiles for minors must be created by a parent or legal guardian.

Our website uses only essential cookies. The app may use analytics tools to understand usage and improve the service; this data is aggregated and does not include health data.

We may update this policy from time to time. Material changes will be notified in the app. The effective date at the top indicates the latest revision.

Data Protection Officer, Zen Integrated Sdn. Bhd.
[Registered business address], Kuala Lumpur, Malaysia
Email: zen.integrated@gmail.com · Phone: +60 19-541 9491