Privacy Notice
Lyraa Care Sdn Bhd | Last updated 16 October 2026
At Lyraa Care, we are committed to protecting your Personal Data. This Privacy Notice ("Notice") sets out what Personal Data we collect and for which purposes, where we collect your Personal Data from, to whom your Personal Data is disclosed to, how long we hold your Personal Data for, how to access and update your Personal Data, as well as your rights.
This Notice applies to our customers, prospective customers, users of our digital application, and visitors of our website, including but not limited to www.lyraacare.com.
Our website and digital application may contain links to third-party websites. In this regard, we do not endorse nor are we responsible for the content of the third-party websites or resources, and our Notice does not apply to any sites which are not affiliated with Lyraa Care, even if you access them via a link on our site. You have the responsibility to review the privacy policies of any third-party site before providing any information.
For the purposes of this Notice:
- "Lyraa Care", "us" or "we" or "our" refer to Lyraa Care, the platform operated by Lyraa Care Sdn Bhd [Company No. 202601041819 (1703914-A)], which is the data controller for the purposes of the Personal Data Protection Act 2010 (the "PDPA"), our subsidiaries and other affiliates;
- "Personal Data", "data" or "personal data" refers to any information about an identifiable individual or any equivalent definition of personally identifiable information under any other applicable law; and
- "Sensitive Personal Data" refers to any Personal Data consisting of information relating to physical health or mental health or condition of an individual, his or her political opinions, religious beliefs or other beliefs of similar nature, the commission or alleged commission by him of any offence, his or her biometric data or any other Personal Data specified by law from time to time.
A. What Personal Data do we collect?
We may collect the following Personal Data from you:
Full name, date of birth, age, gender, nationality, national identification numbers (such as NRIC or passport details where required by law), email address, telephone numbers, residential address, relationship status, profile imagery, and emergency contact details.
Physical or mental health conditions, clinical histories, medical diagnoses, medication schedules, daily living assistance needs, and manually logged physiological vitals.
Voice messages and text notes you share in your Care Circle's Family Stream.
Daily log entries, care tracking records and health trend summaries generated by the Platform from information you log.
The Anchor's device location, used to detect when they arrive at or leave places set up by their Care Circle (such as home), and to alert the Care Circle.
Usernames, encrypted account credentials (passwords), device access tokens, and customizable preferences or security permissions established for your Care Circle.
Internet Protocol (IP) addresses, unique device identifiers, hardware models, operating system variants, browser configurations, and cookie data.
Testimony, feedback, opinions, app reviews, and comments. This includes any information you may share with us via email, customer support channels, interactive chat tools, our social media platforms, or any other internal or external communication tools connected to our Platform.
Device permissions. With your permission, the app may access your device's microphone (to record voice messages in the Family Stream), location (to detect when an Anchor arrives at or leaves places set up by their Care Circle, and to alert the Care Circle), camera and photos (to add a profile picture, share photos or upload documents), and notifications (to send care alerts and reminders). Where location alerts are turned on, location may be collected even when the app is closed or not in use. Location is only used for the Anchor's safety alerts and is never used for advertising. You can change these permissions at any time in your device settings.
Biometric login. Face ID and fingerprint login are handled entirely by your device. We do not collect, receive or store your biometric data.
B. How do we collect your data?
We may collect your data directly from you when:
- You create an account, register an account profile on our Platform, or submit any digital form to utilize or benefit from our services.
- You disclose your personal data through any form of communication with our team, including email messages, telephone conversations, in-app customer support chats, or virtual meetings.
- You interact with our Platform features, including recording voice messages, logging information or turning on location alerts through your device.
- You volunteer and consent to participate in any consumer research, feedback loops, or innovation initiatives conducted by us.
- You sign up for our marketing materials, operational updates, and promotional communications.
- You provide testimony, feedback, comments, questions, ratings, or reviews on our digital applications, websites, or official social media channels.
- You interact with any of our digital infrastructure, interfaces, or systems.
- You make your personal data available to us for any other explicit reason.
We may also collect your data indirectly through other sources such as:
- When we seek and receive your data from authorized entities in connection with your relationship with us.
- If you act as an intermediary, family coordinator, or guardian supplying us with information regarding a third-party individual (such as a relative, parent, family member, or care-recipient). In this regard, you undertake and guarantee that you have obtained all necessary, explicit consents from such third-party individuals for the processing of their personal data and sensitive personal data by us.
Personal Data of Vulnerable Persons or Minors
The Platform is intended for use by adults. Our website and application are not designed for use by children under the age of 18, and we do not knowingly collect Personal Data from a child under 18 without the consent of a parent or guardian. If you believe a child has provided us with Personal Data, please contact us and we will take reasonable steps to delete it.
The Platform is designed to support older adults and others who may be in a position of vulnerability (an "Anchor"), often with the help of a family member or carer (a "Guardian"). We recognise the responsibility this carries, and we handle an Anchor's Personal Data and Sensitive Personal Data with particular care.
Where an Anchor is able to understand and make the decision, we seek the Anchor's own consent to the collection, use and sharing of their Personal Data and Sensitive Personal Data within their care group (a "Care Circle"). Where possible, we seek this consent when the account is first set up. We provide this information to the Anchor in a clear and accessible form, and we respect any objection an Anchor expresses, even where a Guardian holds or manages the account. Where an Anchor has capacity, the Anchor's wishes about their own information take precedence, including over a Guardian.
Where an Anchor is unable to give consent (for example, by reason of a medical condition affecting capacity), the account may be managed, and consent given on the Anchor's behalf, by a Guardian who is a close family member or a person responsible for the Anchor's care and who confirms that they are acting in the Anchor's best interests. We may ask a Guardian to confirm their relationship to, and responsibility for, the Anchor. In all such cases, we use the Anchor's information only for purposes connected with their care and well-being.
If we become aware that a person does not hold the authority they claimed, or that continued processing is not in an Anchor's interests, we may suspend or restrict access pending verification.
C. Why do we collect your data?
We may collect, use, process or transfer your data for one or more of the following purposes ("Purposes"):
Your data may be used to:
- facilitate conclusion and execution of agreements with you;
- verify your identity in order to provide you with any of our products and/or services;
- administer and manage the products and/or services you have requested;
- provide you customer service and support with regards to our products and/or services.
Your location data may be used to detect when an Anchor arrives at or leaves places set up by their Care Circle, and to alert the Care Circle.
To monitor diagnostic logs, systems performance, and user-experience trends to maintain platform security and prevent unexpected service downtime.
Your data may be used for:
- marketing, sales, and promotions including, but not limited to, direct marketing purposes via SMS, phone call, email, social media and/or any other appropriate communication channels;
- research and development, for instance, analytics to provide better products and services;
- business process execution and internal management and control;
- management of investor relations;
- external communications, interactions with authorised service providers;
- government and legal affairs;
- alliances, ventures, mergers, acquisitions, and divestitures;
- intellectual property and standards management;
- any other activity related to the purposes set out above.
Your data may be used to:
- verify your identity when you request access to your account and for general account management purposes;
- protect and prevent your account from unauthorized access, fraud, misuse, or damage to our services;
- prevent illegal activities, suspected fraud, and potential threats to our services or products;
- protect our and/or your data in relation to life, death and/or security, which may be deemed as our and/or your vital interests; and/or
- detect and stop cyber security threats to our internal systems and services.
Your data may be used to:
- investigate and resolve any issues or disputes you have with us, including to defend claims made against, or otherwise involving us;
- for the administration of justice;
- for the exercise of any functions required or permitted by or under any law, regulations, guidelines and/or relevant regulatory authorities; and/or
- fulfill any other related or incidental purpose directly or reasonably related in order to operate, maintain and better manage the provision of our websites, digital application, products and/or services to you.
Your Sensitive Personal Data may be processed:
- where you have explicitly consented to the processing;
- where you voluntarily participate in a research project or product test;
- as required by or allowed under applicable data protection related laws;
- to establish, exercise or defend a legal claim;
- to prevent, detect or prosecute (including cooperating with public authorities) suspected fraud, contract breaches, violations of law, or other breaches of the terms of access to our sites or assets.
We process your Personal Data on the basis of your consent. In limited circumstances permitted by law, we may also rely on other bases, namely where processing is necessary to perform a service you have requested, to comply with a legal obligation, or to protect the vital interests of an Anchor (for example, in an emergency). For Sensitive Personal Data, including health data, we rely on your explicit consent, save where the law allows another basis such as the protection of vital interests. Where we collect demographic information such as sex or gender, we do so because it is clinically relevant.
D. Who do we share your Personal Data with?
We may share your data with the following parties, for the Purposes set out in this Notice:
- Related or affiliated companies.
- Data Processors: We may engage third parties to process your Personal Data on our behalf and on our instructions, such as IT vendors.
- Researchers: We may share de-identified or aggregated data, which cannot identify you, for research or statistical purposes.
- Professional Advisors: We engage professional advisors on matters relating to our services, including legal advisors, accountants, and auditors.
- Fraud Management: We will release information if it is reasonable for the purpose of protecting us against fraud, defending our rights or property, or to protect the interests of our customers.
- Law Enforcement: We may also need to release your information to comply with our legal obligations and to respond to the authorities' lawful demands. Your Personal Data shall only be provided in good faith, when we are obliged to do so in accordance with the law.
- The Care Circle: The Platform is built around shared care. With consent, an Anchor's Personal Data and relevant Sensitive Personal Data (such as health information, vitals, medication records and location alerts) are made available to the members of their Care Circle, namely their Guardian(s) and Helper(s), each according to the role-based level of access applicable to them.
- Other Organisations: If our company is reorganised or sold to another organisation, we will provide your information to that organisation.
In sharing your Personal Data, we will take steps to ensure that the recipient will protect your privacy, keep your Personal Data secure, and process it in accordance with applicable law and this Notice.
We do not sell your Personal Data, and we do not share it with marketing or advertising partners. We never use health data, location data or Sensitive Personal Data for advertising or marketing.
E. Cross-Border Data Transfer
We store Personal Data primarily on cloud infrastructure located in Malaysia, with a failover facility in Singapore to maintain continuity of service. Certain of our data processors may also process limited Personal Data outside Malaysia in order to fulfil the Purposes described in this Notice.
We transfer Personal Data outside Malaysia only where one or more of the conditions under Section 129 of the PDPA is satisfied, including where: (a) the place to which the data is transferred has in force a law substantially similar to the PDPA, or ensures a level of protection in relation to the processing of personal data that is at least equivalent to that afforded under the PDPA (which we consider to include Singapore); (b) the transfer is subject to appropriate contractual safeguards with the recipient; (c) the data subject has consented to the transfer; or (d) the transfer is necessary for the performance of a contract, to protect the data subject's vital interests, or is otherwise permitted under the PDPA. Where appropriate, we assess the risks of a cross-border transfer before effecting it.
Your Personal Data may be transferred to an authorised external party, located internationally, only if we believe it is necessary or appropriate to:
- ensure compliance with applicable data protection related laws, which may include responding to requests from public and government authorities, cooperation with law enforcement agencies or other legal reasons; and/or
- satisfy purposes for which Personal Data has been collected by us or to carry out our contractual obligations.
F. How long do we retain your data?
Your data will be retained only for as long as the information is necessary for the purposes for which it was collected and processed, or to comply with any legal, regulatory or internal requirements. We will take all reasonable steps to ensure that all Personal Data is permanently destroyed or permanently deleted if it is no longer required for the purpose for which it was collected and processed.
Where an Anchor passes away, the information relating to them ceases to be "personal data" under the PDPA. We will nonetheless treat such information sensitively and, so far as practicable, in accordance with the wishes of the family, and we will delete it once it is no longer required for any lawful purpose.
Deleting your account. You can delete your account at any time in the app under [Settings > Delete My Account]. Your account and all associated Personal Data, including health records, voice messages, location data and care records, are permanently deleted from our systems immediately, and from our secure backups within thirty-five (35) days. You can also request deletion of your account and data by emailinghello@lyraacare.com, and we will process your request within twenty-one (21) business days.
G. How do we secure your data?
To protect your Personal Data, we take appropriate measures, and we also require any external parties to protect the confidentiality and security of your Personal Data. Depending on the state of the art, the cost of implementation, and the nature of data/information to be protected, we have implemented physical, technical, and organisational measures to prevent risks such as destruction, loss, misuse, alteration, and unauthorised disclosure of or access to your Personal Data. If you have any reason to believe that your interaction with us is no longer secure, please contact us through the details provided below.
H. What happens if there is a data breach?
A personal data breach means any breach, loss, misuse, or unauthorised access of Personal Data. Where a personal data breach occurs that causes, or is likely to cause, significant harm to a data subject, we will notify the Personal Data Protection Commissioner as soon as practicable and, in any event, within seventy-two (72) hours of becoming aware of the breach. Where the breach is likely to cause significant harm, we will also notify the affected data subjects without unnecessary delay, and no later than seven (7) days after notifying the Commissioner, including information on the nature of the breach, its likely consequences, and the measures taken or proposed. Given the health information held on the platform, a breach involving such information will, in most cases, meet the threshold for notification. We maintain an internal data breach response plan, and we require our data processors to report any personal data breach to us promptly so that we can comply with these obligations.
I. What are your rights?
Personal Data you provide us must be accurate, complete and up-to-date, and you must inform us of any significant changes to your Personal Data. With respect to the processing of your Personal Data, you may:
- obtain information on the processing of your Personal Data;
- ask questions about how we handle your Personal Data;
- request to review, correct, update, suppress, or restrict the use of your Personal Data;
- request your Personal Data to be removed;
- withdraw your consent to use of your Personal Data, or to the use of your Personal Data for particular purposes. Withdrawing your consent may hinder our ability to provide you our products and/or services, and your access to our website or digital application may be denied;
- object to the use of Personal Data for our legitimate business interests;
- object to the processing of your Personal Data for direct marketing purposes. When you withdraw your consent, we will stop processing your Personal Data for direct marketing purposes; however, we may still send you non-marketing communications that relate to the products and/or services which you subscribed for; and/or
- ask us to send your Personal Data to another provider, where this is technically possible (data portability).
To exercise your rights, please contact us via the contact details provided below. We will respond to requests to access or correct your Personal Data within twenty-one (21) days.
J. Cookies Policy
Your Personal Data may be collected using cookies whenever you access our websites or digital application. We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system. Cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. In our mobile application we use similar technologies, including software development kits and analytics tools, that perform comparable functions to cookies in order to operate the application and understand how it is used.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline if you prefer. This may prevent you from taking full advantage of the website. For further information visit www.aboutcookies.org or www.allaboutcookies.org.
K. Automated Decision-Making
We may utilise automated tools to process your Personal Data and/or make decisions about you, and human intervention may be involved in the automated decision-making.
Some features work automatically to support an Anchor's safety, such as the daily check-in, which can alert the Care Circle if an Anchor does not respond, and location alerts, which notify the Care Circle when an Anchor arrives at or leaves a place set up by their Care Circle. Where a decision about you is made solely by automated means, you can ask for an explanation and human review.
The Platform is not an emergency response provider. The SOS feature opens your phone's dialler with the emergency number pre-filled, ready for you to call. It does not contact the emergency services on your behalf, and we cannot guarantee any response.
To the extent permitted by law, we may undertake automated decision-making if:
- the decision is made by us for purposes of entering or performing a contract, provided that the underlying request leading to a decision by us was made by you;
- you have provided explicit consent; and/or
- the use of automated tools is otherwise required.
We are committed to protecting your legitimate rights and interests. Should you want to provide your opinion or contest our decision based on automated processing, including profiling, please contact us (contact details provided below).
L. Updates to the Privacy Notice
We reserve the right to amend, modify, vary or update this Notice, at our sole discretion from time to time, as and when the need arises. Any changes will be published here, and where the changes are significant, we will notify you through the app or by email.
M. Privacy Contact
If you have any question, request or complaint about your Personal Data, please contact us at hello@lyraacare.com.
N. Contact Us
If you have any complaints, questions or enquiries about this notice, our privacy and/or our information handling practices, kindly reach out to us through hello@lyraacare.com.
O. Version info
This notice was published and last updated on 16 October 2026.