Privacy Policy

Effective date: 22 July 2026

This Privacy Policy explains how MyDiri collects, uses, discloses, and protects your personal data, in accordance with Malaysia's Personal Data Protection Act (PDPA) 2010. We are committed to protecting your privacy, because your mental health journey is personal.

1. Who We Are (Data User)

MyDiri is developed and operated by Hikmah Vision Sdn. Bhd. (Company Registration No. 200601015941 / 735693-T), a company incorporated in Malaysia.

Registered address: No 31-2, Jalan Medan PB3, Seksyen 9, Bandar Baru Bangi, 43650 Bandar Baru Bangi, Selangor.

For any privacy-related questions or personal data requests, please contact us at support@mydiri.com.

2. Consent & Sensitive Personal Data

Information relating to your mental and physical health — including your screening responses and assessment results — is classified as sensitive personal data under the PDPA. We process such data only with your explicit consent, which you provide before starting a screening or assessment. You may withdraw your consent at any time (see Section 8). Taking a screening requires you to sign in to an account; however, crisis and emergency resources are always accessible without signing in.

3. Information We Collect

• Registered users: your name, email address, the demographic data you provide (such as age range and gender), your responses to the screening and assessment questionnaires, and your assessment history. Taking a screening requires a registered account.
• Business (B2B) accounts: for members who join through a sponsoring organisation, we process your membership and participation information. Your clinical results remain private (see Section 5).
• Payment information: processed securely via a third-party payment gateway; we do not store your full card details.
• Technical data: basic device information and essential cookies needed for the platform to function (see our Cookie Policy).

4. How We Use Your Data

We use your data strictly to: provide personalised mental wellness insights; generate your personal reports; operate your account and payments; deliver support; and improve our clinical algorithms and services in aggregate. We do not sell your personal data to any third party.

5. Disclosure & Third Parties

We share data only with trusted service providers necessary to operate the platform, namely: cloud hosting providers (Amazon Web Services), email services (Amazon SES), payment gateways, and AI providers (such as Google Gemini, OpenAI GPT, and Anthropic Claude) to generate insights. These providers are bound by confidentiality obligations and are not permitted to use your data for any other purpose.

Employers and sponsoring organisations (B2B) never receive any individual's clinical results, answers, or scores. Paying for the screening service does not grant an employer access to any individual's results. A sponsoring organisation receives only aggregated, de-identified participation statistics, which are suppressed when the number of participants is too small to preserve anonymity.

6. Cross-Border Data Transfer

Your data may be processed and stored on servers located outside Malaysia, specifically on Amazon Web Services infrastructure in Singapore. We ensure that any such transfer is subject to protections equivalent to those required by the PDPA.

7. Data Security & Retention

All data transmitted between your browser and our servers is encrypted using industry-standard SSL/TLS protocols. Our database is encrypted at rest as a standard feature of our managed database hosting. We retain your personal data only for as long as necessary for the purposes for which it was collected, or until you withdraw consent or request deletion.

8. Your Rights Under the PDPA

You have the right to: access your personal data; correct inaccurate data; withdraw your consent; and limit or object to the processing of your data. To exercise any of these rights, please email us at support@mydiri.com. We will respond within a reasonable time as required by law.

9. AI-Generated Insights

Some insights and chat responses are generated by artificial intelligence systems. These insights are for self-awareness only and are not a medical diagnosis. Please see our Terms of Service for the full disclaimer.

10. Children & Minors

MyDiri is intended for individuals aged 18 and above. Minors may only use the platform with the consent and supervision of a parent or legal guardian.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date.

12. Contact Us

If you have any questions about this Privacy Policy or your personal data, please contact us at support@mydiri.com.