Privacy Policy

Effective date: 1 August 2026

This Privacy Policy explains how MyDiri collects, uses, discloses, and protects your personal data, in accordance with Malaysia's Personal Data Protection Act (PDPA) 2010. We are committed to protecting your privacy, because your mental health journey is personal.

1. Who We Are (Data User)

MyDiri is developed and operated by Hikmah Vision Sdn. Bhd. (Company Registration No. 200601015941 / 735693-T), a company incorporated in Malaysia.

Registered address: No 31-2, Jalan Medan PB3, Seksyen 9, Bandar Baru Bangi, 43650 Bandar Baru Bangi, Selangor.

For any privacy-related questions or personal data requests, please contact us at hello [at] mydiri [dot] com.

2. Consent & Sensitive Personal Data

Information relating to your mental and physical health — including your screening responses and assessment results — is classified as sensitive personal data under the PDPA. We process such data only with your explicit consent, which you provide before starting a screening or assessment. You may withdraw your consent at any time (see Section 8). Taking a screening requires you to sign in to an account; however, crisis and emergency resources are always accessible without signing in.

3. Information We Collect

• Registered users: your name, email address, the demographic data you provide (such as age range and gender), your responses to the screening and assessment questionnaires, and your assessment history. Taking a screening requires a registered account.
• Business (B2B) accounts: for members who join through a sponsoring organisation, we process your membership and participation information. The results and reports of tests your organisation sponsors are shared with that organisation (see Section 5); anything you do personally stays private.
• Payment information: processed securely via a third-party payment gateway; we do not store your full card details.
• Technical data: basic device information and essential cookies needed for the platform to function (see our Cookie Policy).

4. How We Use Your Data

We use your data strictly to: provide personalised mental wellness insights; generate your personal reports; operate your account and payments; deliver support; and improve our clinical algorithms and services in aggregate. We do not sell your personal data to any third party.

5. Disclosure & Third Parties

We share data only with trusted service providers necessary to operate the platform, namely: cloud hosting providers (Amazon Web Services), email services (Amazon SES), payment gateways, and AI providers (such as Google Gemini, OpenAI GPT, and Anthropic Claude) to generate insights. These providers are bound by confidentiality obligations and are not permitted to use your data for any other purpose.

Sponsoring organisations (B2B) receive the results and reports of the screenings and assessments they pay for. This visibility is stated to every member before they accept an invitation, applies only to tests taken under the organisation's sponsorship, and is limited to the organisation's designated owners and admins, with every report access logged. Tests you take personally — outside your organisation's sponsorship — are never shared with any organisation. Group statistics shown to organisations remain aggregated and are suppressed when the number of participants is too small to preserve anonymity.

6. Cross-Border Data Transfer

Your data may be processed and stored on servers located outside Malaysia, specifically on Amazon Web Services infrastructure in Singapore. We ensure that any such transfer is subject to protections equivalent to those required by the PDPA.

7. Data Security & Retention

All data transmitted between your browser and our servers is encrypted using industry-standard SSL/TLS protocols. Our database is encrypted at rest as a standard feature of our managed database hosting. We retain your personal data only for as long as necessary for the purposes for which it was collected, or until you withdraw consent or request deletion.

8. Your Rights Under the PDPA

You have the right to: access your personal data; correct inaccurate data; withdraw your consent; and limit or object to the processing of your data. To exercise any of these rights, please email us at hello [at] mydiri [dot] com. We will respond within a reasonable time as required by law.

9. Location

Sharing your location is entirely optional. The professionals and facilities directory works fully without it, and declining changes nothing except the order the results are listed in.

If you choose to share it, your device's coordinates are used once, at that moment, to sort the directory by distance — and then discarded. We do not store your location. There is no record of it in your account, in your screening data, or in our logs, and nothing about your location is ever shared with a sponsoring organisation or any third party.

10. AI-Generated Insights

Some insights and chat responses are generated by artificial intelligence systems. These insights are for self-awareness only and are not a medical diagnosis. Please see our Terms of Service for the full disclaimer.

11. Children & Minors

MyDiri is intended for individuals aged 18 and above. Minors may only use the platform with the consent and supervision of a parent or legal guardian.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date.

13. Contact Us

If you have any questions about this Privacy Policy or your personal data, please contact us at hello [at] mydiri [dot] com.