Download Here

Sihat Dari Mula Privacy Policy

Last updated: 13 October 2026

1. Introduction

Sihat Dari Mula ("SDM," "we," "us," or "our") is an AI-powered family management service provided by Ultra Works Sdn Bhd ("Ultra Works"). It operates through WhatsApp and a progressive web app (PWA) dashboard. SDM helps families coordinate schedules, set reminders, track wellness goals, plan meals, and stay organised through natural-language interactions.

This Privacy Policy explains what personal data we collect, how we use and share it, and the choices and rights available to you. We aim to collect and use only the data needed to operate, secure, and improve the service, in accordance with applicable data protection laws, including Malaysia’s Personal Data Protection Act 2010 (PDPA), as applicable.

This policy applies to people who use SDM, including family members whose information is added by another user. If you use SDM, please read this policy. Where applicable law requires consent for a particular use, we will request it separately. Using the service does not replace any consent required by law.

Data controller

Ultra Works Sdn Bhd is responsible for the personal data described in this policy.

2. Personal data we collect

The data we collect depends on the features you use and the information you or your family choose to provide.

2.1 Data you provide

  • Account and profile data: phone number used with WhatsApp, name, optional email address for account recovery, and profile picture if provided. If your WhatsApp settings hide your phone number, we may receive a WhatsApp username or business-scoped user identifier (BSUID).
  • Family data: family name and information about family members that users add, such as names and phone numbers.
  • Children’s data: a child’s name and, if provided, age or date of birth.
  • Calendar and activity data: event titles and descriptions, dates, times, locations, recurring-event settings, participants, tasks, reminders, and family activity records.
  • Messages and media: text, commands, requests, images, documents, and emoji reactions you send to SDM. Supported document content may be extracted for event analysis (see Section 4).
  • Wellness data: calorie, water, sleep, fitness, or other wellness information you choose to track.
  • Payment-related data: subscription and billing information. Payment card details are handled by our payment processor where applicable.
  • Voice messages: voice notes and any resulting transcription when you use voice features.

2.2 Data collected through use of the service

  • Usage and interaction data: message and AI interaction counts used for rate limits, feature usage, language preferences inferred from messages, interaction timestamps, and message delivery status (such as sent, delivered, or read).
  • Technical and diagnostic data: WhatsApp message metadata and webhook payloads, error logs, and, if you enable web push notifications, browser and device information needed to manage the notification subscription.
  • IP address and approximate location: our hosting provider may derive an approximate location, such as city, region, country, or time zone, from your IP address. We use this for live-chat context, analytics, or security where enabled. We do not collect precise GPS location through this process.
  • Performance data: website performance measurements, such as page-load times and web vitals. The draft implementation describes these metrics as anonymised and not linked to your identity.

2.3 Data from WhatsApp

When you contact SDM through the WhatsApp Business API, we receive the messages, media, reactions, and message status updates needed to provide the service. We do not receive access to your WhatsApp contacts, status, stories, or unrelated WhatsApp content through this integration.

3. How we use personal data

We use personal data to:

  • create and manage accounts and family profiles;
  • understand and respond to your messages, including processing images, documents, and voice notes where supported;
  • create and manage events, tasks, reminders, and wellness records at your direction;
  • send service messages, reminders, notifications, and important announcements;
  • support language settings and provide relevant responses;
  • process subscriptions, billing, and refund requests;
  • enforce rate limits, prevent abuse, protect the service, and investigate errors;
  • understand usage and improve the service, including developing features;
  • meet legal obligations and establish, exercise, or defend legal claims.

Where data protection law requires us to identify a legal basis, that basis may include providing the service you request, our legitimate interests in operating and securing SDM, compliance with legal obligations, or your consent. The appropriate basis depends on the purpose and your location. You may contact us for more information about processing that applies to you.

4. AI processing

4.1 How your content is processed

SDM uses Google Gemini through an API to interpret messages and generate responses. Depending on what you send, the following may be processed:

  • Text: your message, recent conversation history, and relevant family context may be sent to the AI provider so it can respond or carry out a requested action, such as creating an event.
  • Images: an image received through WhatsApp may be sent to the provider’s vision model to identify event details. We present extracted event details for your confirmation before adding them to a family profile.
  • Documents: for supported PDF, TXT, CSV, HTML, or JSON files, text is extracted locally and up to 8,000 characters may be sent for event analysis. Extracted events are presented for confirmation before being added. DOCX, XLSX, and PPTX files are not supported for this process.
  • Voice notes: where voice features are available, audio may be transcribed to process your request.

4.2 AI limitations and human access

AI responses can be inaccurate or incomplete. Please verify important information. SDM is not a substitute for medical, legal, financial, or other professional advice.

Authorised Ultra Works staff may access conversation logs when reasonably necessary for debugging, troubleshooting, quality assurance, or support, such as investigating an error or responding to an issue you report.

4.3 Use of data to train AI

Ultra Works does not use your personal data to train AI models. The service sends relevant content to Google Gemini through an API for processing. The draft describes the provider’s processing as real-time inference without retention or model training. Because provider terms and settings can change, we will disclose processing in line with the provider’s current contractual terms and configuration.

5. How we share personal data

We share data with service providers only as needed to operate the service, and require them to protect it and use it for the services they provide to us. Providers may include:

  • WhatsApp/Meta: messages, phone numbers or WhatsApp identifiers, media, reactions, and delivery information needed to exchange messages.
  • Google Gemini: message content, relevant conversation history and family context, images, extracted document text, or voice content as described in Section 4.
  • Database and hosting providers: account, family, event, message, and other service data stored or processed to operate SDM.
  • Web hosting, analytics, and monitoring providers: technical, performance, and approximate location data where enabled.
  • Payment provider: subscription status, billing information, and customer identifiers needed to process payments.
  • Email provider: names and email addresses used for password resets, invitations, and welcome messages.
  • Internal communications tools: limited alerts about sign-ups, errors, or service activity. We aim to use anonymised or summarised information in these alerts.

We do not sell or rent personal data, provide it to advertisers for targeted advertising, or share it with third parties for their own marketing.

5.1 Legal requests

We may disclose data when required by applicable law or valid legal process, or when reasonably necessary to protect rights, safety, or security. We review requests, limit disclosures to what is legally required, document requests and responses, and notify affected users where legally permitted.

5.2 Business transfers

If Ultra Works is involved in a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred as part of that transaction, subject to applicable law. We will provide notice where required.

6. Data retention and deletion

We keep personal data only for as long as needed for the purposes described in this policy, while your account is active, or as required or permitted by law. Retention periods can differ by data type and operational need.

6.1 Account deletion

You can request account deletion in the app under Settings → Delete account, or by emailing sdm_app@sihatdarimula.my. The draft service flow removes account and sign-in details when deletion is initiated and schedules associated personal data for purging. Deletion requests submitted by email are intended to be processed within 30 working days.

Some records may first be marked as deleted and remain temporarily in systems until a purge cycle completes. Events and tasks shared with a family may remain available to that family with your name removed. Encrypted disaster-recovery backups may retain data for up to 90 days after deletion, after which they are scheduled for permanent removal.

6.2 Conversation and diagnostic records

Recent conversation history may be retained while your account is active to provide context for responses. A period of inactivity may cause the active session context to expire or reset. Conversation history is deleted as part of account deletion, subject to the deletion and backup processes described above.

Webhook payloads, message metadata, and error logs may be retained for a limited period to investigate issues and maintain service reliability, then periodically purged.

7. Children’s privacy

You must be at least 13 years old to create an SDM account. Users aged 13 to 17 may use SDM with the permission of a parent or guardian. A younger child may be added to a family profile by another family member but cannot create their own account.

SDM is not directed to children under 13. If we learn that a child under 13 has created an account, we will take steps to delete that account. When adding a child’s information, parents or guardians are responsible for ensuring they are permitted to provide it and for choosing what information to share.

Children’s information is visible to members of the family profile. We may process it through service providers as needed to operate SDM. A parent or guardian can request deletion of a child’s information.

Additional Kids Safety features are planned. If introduced, we will explain the relevant features and safeguards before they become available. Any location-sharing feature will require appropriate notice and consent where required by law.

8. Data security

We use technical and organisational measures intended to protect personal data, including:

  • encryption in transit using TLS/SSL;
  • infrastructure-level encryption at rest provided by our database hosting provider;
  • access controls intended to limit employee access to those who need it for their role;
  • cloud infrastructure and service providers with security controls;
  • rate limits to reduce abuse; and
  • dashboard access tokens that, according to the draft implementation, expire after 24 hours for WhatsApp-first users.

No security measure can guarantee absolute security. Please keep your phone and WhatsApp account secure, avoid sharing family access with unauthorised people, and report suspected unauthorised activity to us promptly.

If a personal data breach occurs, we will take steps to contain and address it and provide notices to affected users or authorities when required by applicable law.

9. Your choices and rights

Depending on your location and applicable law, you may have rights to access or correct personal data, request deletion or restriction, object to certain processing, withdraw consent, or receive a portable copy of your data. You may also complain to the relevant data protection authority.

You can update some information by messaging SDM or using available app settings. To make a privacy request, email sdm_app@sihatdarimula.my. We may need to verify your identity before responding. We will respond within the period required by applicable law.

If processing relies on consent, you can withdraw consent at any time. Withdrawal does not affect processing that took place before withdrawal. Stopping use of SDM does not necessarily delete your data; use the account deletion process in Section 6 to request deletion.

Where GDPR applies, you may also have rights under the GDPR, including the right to object to processing based on legitimate interests and safeguards concerning decisions made solely by automated processing. SDM uses AI to assist with family organisation and does not intend to make decisions that produce legal or similarly significant effects on you.

10. International data transfers

Our service providers may process personal data in countries other than your own, including the United States and other countries where providers operate. Where required, we use appropriate safeguards for international transfers, such as contractual data protection commitments or other mechanisms recognised by applicable law. Contact us if you would like more information about relevant safeguards.

11. Cookies and similar technologies

The WhatsApp assistant does not use cookies. The PWA dashboard may use essential cookies for authentication and session management. If performance monitoring is enabled, it may collect page-load times and web vitals; the draft describes these measurements as anonymised and not linked to your identity.

Approximate location may be derived from your IP address for analytics or live-chat context as described in Section 2. You can manage cookies through your browser settings. Blocking essential cookies may affect the dashboard but should not affect the core WhatsApp service.

There is no universally accepted standard for Do Not Track signals, and SDM does not currently respond to them.

12. Third-party links

SDM may link to third-party websites or services. Their privacy practices are governed by their own policies, which we encourage you to review. We are not responsible for third-party privacy practices.

13. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date when we do. For significant changes, we will provide notice through WhatsApp or another appropriate channel where required. Please review this policy periodically.

14. Contact us

For questions or privacy requests, contact:

Ultra Works Sdn Bhd Email: sdm_app@sihatdarimula.my Website: sihatdarimula.my/privacy

We aim to respond within five working days, subject to any verification needed and applicable legal response periods.

15. Language

This policy is provided in English. If we publish a translated version and it conflicts with the English version, the English version will prevail, subject to applicable law.