Privacy Policy

YMR is NOT a hospital, clinic, doctor, medical practitioner, emergency service, pharmacy, diagnostic laboratory, or licensed healthcare provider.

YMR does NOT provide medical diagnosis, treatment, prescriptions, emergency advice, or clinical decision-making. Any summaries, explanations, trends, extracted values, risk flags, report interpretations, suggested questions, or specialty guidance generated by YMR are provided for general information, record organisation and convenience only.

Always consult a qualified healthcare professional before making any medical, treatment, medication, diagnostic or emergency decision. In an emergency, contact emergency services or attend the nearest hospital immediately.

Where there is any difference between an original medical report and information extracted, summarised, translated or explained by YMR, the original medical report prevails. YMR's AI and OCR outputs may be incomplete, inaccurate, mistranslated, outdated, or inappropriate for your circumstances — verify important information against the original report.

Your personal data is protected under the Singapore Personal Data Protection Act 2012 (as amended) ("PDPA"), our primary governing framework as a Singapore-registered entity.

We have also designed the Service to meet the standards of the EU/UK General Data Protection Regulation ("GDPR"), which may apply if you use the Service from the European Economic Area or the United Kingdom — for example, diaspora users managing a family member's records from abroad.

Where the Sri Lanka Personal Data Protection Act No. 9 of 2022 ("SL PDPA") applies, we comply with its requirements as they come into operative effect. Where these frameworks differ, we apply the one giving you greater protection.

"Personal data" — data from which you can be identified, alone or with other data we hold or are likely to access (name, contact number, email, device identifiers).

"Health data" — personal data about your physical or mental health, including the reports, results, prescriptions, scans and images you send, and the health profile and insights we derive from them. Health data is special category data under the GDPR and warrants the highest level of protection under the PDPA; we apply stronger safeguards to it.

"De-identified data" — data with identifiers removed or altered so it no longer identifies you. "Aggregated data" — de-identified data combined across many users so no individual can be distinguished (see Section 13).

"Process" — anything done with personal data: collecting, storing, organising, analysing, disclosing, deleting.

4.1 Account and contact information. Name, mobile/WhatsApp number, email, country, preferred language, login information, subscription and billing status, customer-support information; and optional profile details you choose to add (such as age, conditions, allergies, or standing instructions for the AI).

4.2 Health and medical information. Medical reports, prescriptions, lab results, scan reports, discharge summaries, vaccination records, chronic-condition information, medication history, allergies, doctor notes, diagnostic information, hospital records, insurance-related health documents, health images, PDFs, photographs, and other health material you provide.

4.3 Messages and conversations. WhatsApp, email and web-chat messages, uploaded files, voice notes and transcriptions where enabled, support requests, feedback and other interactions you submit.

4.4 Extracted and generated information. Information produced when we process your documents — extracted lab values, dates, doctor and hospital names, prescription details, diagnosis terms, test names, report categories, trend summaries, timeline entries, and plain-language explanations.

4.5 Technical, device and usage information. IP address, browser and device type, operating system, approximate location derived from technical data, pages visited, usage, timestamps, error and security logs, referral source, and interactions with our website or dashboard.

4.6 Payment and subscription information. Plan type, payment status, transaction reference, invoice details, renewal status, and payment-provider records. We do not store full card details; these are handled by compliant payment providers.

4.7 Information about family members, dependents or caregivers. YMR may let you manage records for parents, children, spouses, dependents or others. If you provide another person's data, you confirm you have the necessary consent, authority or legal basis to do so and to allow YMR to process it as described here.

We collect personal data: (1) directly from you when you message, upload, complete forms, subscribe or contact us; (2) through WhatsApp or other messaging channels; (3) through email, web upload, dashboard or support; (4) from authorised caregivers, family members or account administrators; (5) from service providers that help us operate YMR; (6) automatically through cookies, logs, analytics and security tools; and (7) from other sources you authorise or where permitted by law.

We only add to a profile documents sent from, or uploaded by, a registered account. Documents from an unregistered number or email are not added to any profile.

YMR is designed to work through WhatsApp and other familiar channels. When you communicate with YMR through WhatsApp, email or another third-party platform, your use of that platform is also subject to that platform's own terms and privacy practices.

YMR does not control how WhatsApp, Meta, email providers, mobile network operators, device manufacturers, app stores or other third parties independently collect, use, disclose or store your data. Your messages to YMR pass through systems we do not own or control. We encourage you to review those platforms' privacy policies and settings.

• Creating, verifying and administering your account
• Receiving, digitising, organising, storing, retrieving your records; extracting information; explaining results; building timelines and trends; answering your questions
• Family/caregiver/dependent record management where enabled
• Service messages (processing confirmations, record-ready alerts, security and account notices)
• Keeping the Service secure; preventing fraud, misuse and unauthorised access
• Administering subscriptions, billing, renewals, refunds
• Improving reliability, usability, security and performance using de-identified or aggregated data
• Meeting legal, regulatory, tax, audit, dispute-resolution and enforcement obligations
• Product improvement across group of companies and related third parties

YMR uses artificial intelligence, OCR and natural-language processing to read and extract text from your documents; identify report types, dates, test names, values and reference ranges; organise records into categories and timelines; generate plain-language explanations; identify changes and trends; retrieve records you request; translate or simplify information; and suggest specialties to discuss with a qualified professional.

To do this, your content is processed by a third-party AI provider (currently [Anthropic, via its Claude API on AWS]) acting as our data processor under a written agreement. Under that agreement, your content is processed solely to generate responses and outputs for you, and is not used by the provider to train its general-purpose AI models.

Unless we clearly tell you otherwise and obtain any required consent, YMR does not use your identifiable medical records to train general-purpose public AI models. Where we use data to improve the Service, we use de-identified or aggregated data (Section 13).

A limited number of authorised YMR personnel, contractors, clinical reviewers, technical or support staff may review limited personal data where reasonably necessary — to correct OCR or extraction issues; handle support requests; check service quality; investigate errors, misuse or security incidents; improve safety and reliability; comply with the law; or provide services you have requested. Access is subject to confidentiality obligations, access controls and logging.

We ask for your explicit, specific, unbundled consent before processing your health data — you do not consent to everything simply by using the Service. You give this consent at onboarding.

You can decline, or withdraw. If you decline at onboarding or withdraw, we will not process your health data and will explain clearly what that means for the Service, including the consequence that we may no longer be able to provide some or all of the Service.

This is central to how YMR works, so we state it plainly:

• You control your records — view, download, correct, and request deletion (Section 19).
• No one can ever buy or see your records, your name, or anything that points explicitly to you. We do not sell, rent or share your identifiable personal data or medical records with anyone for advertising, marketing or commercial profiling.
• We share your data only with the service providers who help us run YMR, and only as needed to deliver the Service to you (Section 14), or where the law requires it.

The one thing we commercialise — strictly on a de-identified, non-identifying basis — is described honestly in the next section.

To sustain and improve the Service, and as part of our business, we may use, analyse and share de-identified and aggregated data for research and development and for commercial purposes — for example, anonymous, population-level health and usage trends.

We only do this with data processed so that it does not identify you and cannot reasonably be linked back to you. It contains no name, contact details, or information that points to you.

We share personal data only with:

• Service providers (data processors), under contract and only to run the Service: [Amazon Web Services] (cloud storage and compute); [Anthropic / Claude] (AI processing, Section 8); [Meta Platforms] (WhatsApp Business API message delivery); [PayHere, LankaQR, Koko, Stripe, PayPal] (payments); and OCR, security, monitoring, analytics and support providers.
• Professional advisers — lawyers, auditors, accountants, insurers and consultants, where reasonably necessary.
• Family members, caregivers or authorised users — where you enable shared-access features. You decide who you authorise and are responsible for that choice; only grant access to people you trust.
• Authorities — regulators, courts, law enforcement or government authorities, where required or permitted by law, or to protect rights, safety, security or legal interests.
• A successor entity — in a merger, acquisition, restructuring, investment, financing, asset sale, insolvency or similar transaction, subject to protections no weaker than this policy, with notice to you where required.

We do not sell or share identifiable personal data for advertising or marketing.

We use providers, infrastructure, staff or systems in Singapore and other countries, so your data may be transferred to, stored in, or accessed from countries outside your own. Your data is stored on [Amazon Web Services in the [SINGAPORE] region].

For transfers outside Singapore, we take reasonable steps to ensure the data receives a standard of protection comparable to the PDPA (Transfer Limitation Obligation). For transfers of GDPR-protected data, we rely on an approved mechanism such as [Standard Contractual Clauses / an adequacy decision].

We use reasonable administrative, technical and organisational measures appropriate to the sensitivity of health data — including access controls, encryption where appropriate, secure cloud infrastructure, authentication, logging, monitoring, data segregation, vendor due diligence, confidentiality obligations and security reviews.

No method of transmission over the internet, WhatsApp, email, mobile networks or cloud systems is completely secure, and we cannot guarantee absolute security. We maintain reasonable security arrangements as required by law and do not contract out of our legal obligation to protect your data.

You are responsible for keeping your phone, WhatsApp account, email, passwords and devices secure. Do not use YMR from a shared or compromised device, and tell us promptly if you believe your account or records may have been accessed without authorisation.

If we become aware of a data breach, we will assess, contain, investigate and remediate it. Where a breach is likely to result in significant harm to affected individuals, or affects a significant number of individuals, we will notify the Personal Data Protection Commission and affected individuals within the timeframes required by law — within 3 calendar days of assessing the breach as notifiable under the PDPA — and will comply with equivalent GDPR and SL PDPA breach-notification requirements where they apply.

YMR is a health record vault, so we retain your records and related data for as long as your subscription provides, according to your tier and our internal policies.

We may retain data longer where necessary for legal, regulatory, tax, accounting, audit, security, fraud-prevention, dispute-resolution, backup or enforcement purposes.

When a subscription ends: if your subscription lapses and is not renewed, we follow a staged process — we notify you, archive your records, and after a defined further period notify you again before deletion. If you do not reactivate, your account is deleted and your records are either deleted or irreversibly de-identified, with de-identified data retained only as described in Section 12.

Deletion requests: you may request deletion at any time. After a valid request, we will delete, anonymise or restrict access to the relevant data within [30 / 60 / 90] days, unless retention is required or permitted by law. Backup copies may persist for a limited period before being securely deleted or overwritten under our backup procedures.

Subject to applicable law, you may:

• access the personal data we hold about you and information about how we use it;
• correct inaccurate or incomplete data;
• withdraw consent to collection, use or disclosure (Section 10);
• download your records (data portability);
• ask questions or complain about how we handle your data; and
• opt out of non-essential marketing (Section 21).

If the GDPR applies to you, you additionally have the right to erasure, to restrict or object to processing, and to lodge a complaint with your supervisory authority (Section 25).

To exercise any right, contact our DPO (Section 27). We will respond within the legally required timeframes and may need to verify your identity first. If you withdraw consent for data necessary to provide the Service, we may be unable to continue providing some or all of it.

Please ensure the information you provide is accurate, complete and current. Because YMR relies on information from you, your family members, caregivers, healthcare providers, uploaded documents, messages and AI/OCR extraction, the accuracy of YMR's outputs depends on the accuracy of the information available. Review extracted information, summaries, timelines and explanations carefully, and notify us or correct any error through available product features.

The Service is intended for adults (18+) or persons with legal capacity to use it. If you upload, manage or access records relating to a child, parent, spouse, elderly person, dependent or other individual, you confirm you are authorised to do so and have obtained any consent required by law. We may request additional confirmation, consent or authority where reasonably necessary.

We may send service-related messages, account notices, security alerts and operational updates at any time. We will send marketing communications only where permitted by law and, where required, with your consent. You may opt out of marketing using the instructions in the message or by contacting us. Even after opting out of marketing, we may still send non-marketing service, account, security and legal notices.

Our website and dashboard may use cookies, pixels, local storage, analytics tools and similar technologies to operate the site, remember preferences, understand usage, improve performance and support security. You can disable cookies through your browser settings, though some features may not function properly.

YMR may link to or integrate with third-party websites, platforms, applications, payment providers, healthcare providers, laboratories or messaging services. We are not responsible for the privacy practices, security or content of third parties we do not control. Review their privacy policies before using them.

We may update this policy to reflect changes to the Service, technology, the law or our operations. Where a change is material, we will notify you (for example, through the Service, WhatsApp, email or dashboard) before it takes effect and, where required, seek your renewed consent. The "last updated" date shows the current version. Continued use after the update takes effect means you acknowledge it.

Please contact our DPO first — we want the chance to put things right. You also have the right to complain to a supervisory authority:

• Singapore: the Personal Data Protection Commission (PDPC).
• Sri Lanka: the Data Protection Authority of Sri Lanka, where the SL PDPA applies.
• EEA/UK: your local data protection authority, where the GDPR applies.

This policy is governed by the laws of Singapore. Any dispute arising from it or from YMR's handling of personal data is subject to [the exclusive jurisdiction of the courts of Singapore / arbitration in Singapore under [rules]], unless otherwise required by applicable law. We encourage you to contact us first to resolve concerns directly.

For any question, request or complaint about this policy or your personal data — including access, correction, deletion, or withdrawing consent — contact our Data Protection Officer using the form below. Choose who your request should go to, tell us what you need, and we'll respond within the timeframes required by law.

You can save a copy of this Privacy Policy for your records. The download includes every section in full. Use the button below, then choose “Save as PDF” as the destination in your browser's print dialog.