Privacy Notice

Vytae · CityMedic Sdn Bhd · Last updated 2 August 2026

The short version. You need a Vytae account to use the app, made with Google or with an email and password. Your readings are stored on your phone, and are copied to our server only if you turn on backup — a separate choice, off unless you switch it on. There is no analytics, and no third party receives your health data. The Home screen carries some advertising, marked AD, but everyone is shown the same cards and none of them are chosen using anything about you. You can delete your account and everything in it from inside the app at any time.

This notice is issued under section 7 of the Personal Data Protection Act 2010 (“PDPA”), as amended by the Personal Data Protection (Amendment) Act 2024. It explains what personal data Vytae processes, why, and what rights you have over it.

The data controller is CityMedic Sdn Bhd (928171-W), of No. 3, Jalan Lagenda 3, Taman 1-Lagenda, 75250 Melaka, Malaysia.

1. Health data is sensitive personal data

Section 4 of the PDPA defines sensitive personal datato include information about a person’s physical or mental health. Blood glucose, blood pressure and cholesterol results are all sensitive personal data. Under section 40 we may only process them with your explicit consent.

You give that consent by entering or importing a reading, and — for your readings to be kept on our server — by turning on backup. You can withdraw it at any time (see section 7). Turning backup off, or never turning it on, leaves the app fully usable.

2. What is collected, and where it goes

Held on your phone only

Unless you turn on syncing, everything below stays in the app’s private storage on your device. It is not transmitted anywhere, and we cannot see it.

Data	Source	Why
Blood glucose readings, with date, time and meal tag	Read from your glucose meter over NFC, or typed in	To show your logbook, trends and time in range
Blood pressure and pulse, with the meter’s irregular heart rhythm and possible atrial fibrillation flags, and whether your arm moved during the test	Received over Bluetooth from your paired INNOMED blood pressure meter, or typed in. Movement is worked out by the app from the pressure the meter sends during a test	To classify readings and feed the heart risk estimate
Cholesterol results	Typed in from your laboratory report	To track lipids and calculate heart risk
Year of birth, sex, smoking status, diabetes diagnosis, blood pressure medication	Entered by you	Required inputs to the Framingham cardiovascular risk score. Used for nothing else.
Glucose meter serial number	Read from the meter	To recognise your meter, and to detect when a different person’s meter is scanned so their readings are not mixed into your record
App settings — units, targets, appearance	Chosen by you	To display the app as you prefer

Your account

An account is required to use Vytae. It holds only what is needed to sign you in, and no health data:

Your email address — to identify your account and, if you forget your password, to send you a reset code.
If you use email: a bcrypt hash of your password. The password itself is never stored and cannot be recovered from the hash.
If you use Google:Google confirms who you are and tells us your email address and Google’s identifier for your account. We keep those two things only — not your name, photo, or anything else from your Google account — and we never see your Google password.
Password reset codes, stored only as a hash, valid for 15 minutes and deleted once used. The email carrying the code is sent through our email delivery provider, which receives your email address for that purpose only.

Sent to a server, only if you turn on backup

Backup is off unless you turn it on — you are asked when you first sign in on a phone, and can change it any time in Settings. If you turn it on, the measurements above are sent to our server so that your record survives losing your phone and can be restored on another one.

Backup is voluntary. Without it the app works fully; you simply have no off-device copy, and if the phone is lost or reset the readings are lost with it.

Content and advertising on the Home screen

The Home screen shows a small carousel. Some cards are health information written by us; others are paid advertising, and those are marked AD. Fetching the carousel makes an ordinary web request to our server, which — like any web request — reveals your device’s IP address and the time of the request. That happens whether or not you have an account.

Nothing about you is sent with that request, and everybody receives the same cards in the same order. They are not selected using your readings, your age, your sex or anything else about you. No advertising network, tracking pixel, advertising identifier or analytics code of any kind runs in the app, and we do not tell advertisers who saw a card or who tapped one — we do not know ourselves.

Some cards carry artwork. It is stored in our own file storage, provided by our hosting company Vercel, and loading it makes a request to blob.vercel-storage.com which — like the request above — reveals your IP address to that server. It is not an advertising network and receives nothing about you beyond that: no identifier, no readings, nothing that says which card was drawn. Advertisers do not host their own images and never see a request from your device unless you tap.

Tapping an advertisement opens that company’s website in your browser. From that point you are on their site and their privacy policy applies, not ours. Like any website they will see your IP address and whatever your browser sends; we pass them nothing about you, and no information about your health travels with the tap.

Not collected at all

No name, address, telephone number, identity card number, location, contacts, photographs or advertising identifier. No analytics or crash-reporting service. No third-party advertising or tracking components of any kind are present in the app.

3. Disclosure to third parties

We do not sell, rent or trade your personal data, and we do not disclose it for advertising, marketing or profiling. Your health data may be disclosed only:

to the hosting and database providers that operate our server, acting solely as data processors under contract;
where we are required to by Malaysian law, or by a court order; and
to anyone you send it to yourself, using the export feature.

Export is entirely under your control.When you export a CSV or JSON file, it leaves the app through your phone’s share sheet and goes wherever you send it — email, cloud storage, a messaging app. Once it leaves, this notice no longer governs it, and the receiving service’s own terms apply.

4. Where your data is stored, and transfer outside Malaysia

If you enable syncing, your data is stored on servers located in Singapore. This means your personal data is transferred outside Malaysia.

Section 129 of the PDPA, as amended in 2024, permits such a transfer where the destination has data protection laws substantially similar to the PDPA, or otherwise ensures an equivalent level of protection. Singapore’s Personal Data Protection Act 2012 is the basis we rely on. Our hosting and database providers act solely as data processors under contract, and are not permitted to use your data for their own purposes.

If you would rather your health data never left Malaysia, do not turn on backup. The app is fully functional without it, and in that case your readings never leave your phone; only your account details are held on our server. We will update this notice before the hosting location changes again.

5. Security

Data on your phone is held in the app’s private storage, isolated from other apps by the operating system.
Your sign-in token is stored in the device keychain, not in the app database — so it is not included in any export.
Passwords and reset codes are hashed with bcrypt at cost 12 and are never stored or logged in readable form.
Google sign-in is verified on our server against Google’s published keys; a sign-in Google has not confirmed is refused.
Traffic to our server must use HTTPS.
Each account’s records are isolated; one account cannot read another’s.

No system is perfectly secure. If a personal data breach occurs we will notify the Personal Data Protection Commissioner, and affected individuals, as required by the PDPA following the 2024 amendment.

6. How long data is kept

On your phone, readings are kept until you delete them or uninstall the app. Your account details, and any backed-up readings, are kept on our server for as long as your account exists. Deleting your account removes your account record and every reading, blood pressure entry, cholesterol result and meter serial attached to it, immediately and permanently. Deleted entries are retained only long enough to tell your other devices that they were deleted.

7. Your rights

Right	How to exercise it
Access your data (s.30)	Everything is visible in the app. Settings → Export produces a complete copy.
Correct inaccurate data (s.34)	Edit or delete any entry in the app. Meter readings are shown as the device recorded them.
Withdraw consent (s.38)	Turn off backup in Settings, delete your account, or uninstall the app.
Data portability (2024 amendment)	Settings → Export as JSON gives a complete, machine-readable copy including the raw meter bytes.
Delete your data	Settings → Delete account. This cannot be undone.
Limit processing, or complain	Contact us below. You may also complain to the Commissioner at pdp.gov.my.

8. Children

Vytae is not directed at children under 18. Where a parent or guardian manages a child’s diabetes using this app, the parent or guardian is responsible for the consent required under the PDPA.

9. Not a medical device

Vytae displays results your meter and your laboratory already produced. It is not a registered medical device, the NFC protocol it uses to read the meter was reverse-engineered rather than published by the manufacturer, and the figures shown have not been validated against laboratory standards. The heart risk score is a population estimate and is known to overstate risk in Asian populations. Always treat your meter and your doctor as the authority, and never make a treatment decision based on this app alone.

10. Contact

Data Protection Officer: Matthew Ong
Email: privacy@citymedic.com.my
Post: CityMedic Sdn Bhd, No. 3, Jalan Lagenda 3, Taman 1-Lagenda, 75250 Melaka, Malaysia

We will respond to any access or correction request within 21 days, as required by the PDPA.

11. Changes

If this notice changes materially we will say so in the app before the change takes effect. The date at the top always shows the current version.

Issued in English and Bahasa Malaysia in accordance with section 7(3) of the PDPA. Versi Bahasa Malaysia.