Free shipping | Certified Malaysian Doctors | 100% online

Privacy policy

Hairmop Sdn. Bhd. (registration number 202601025051 (1687148-P)) and its parent company Hairmop Pty Ltd (registered in Australia with ACN 609 183 388) (“we”, “us”, “our”, “Mosh” or “Moshy”) are committed to privacy protection.

At getmoshy.com.my (the "Sites"), we understand the importance of keeping Personal Data private and secure. This privacy policy ("Privacy Policy") describes generally how we manage Personal Data and safeguard privacy. If you would like more information, please don't hesitate to contact us.

In Malaysia we operate in cooperation with H Vision Sdn. Bhd. (company number 202501029226 (1630638-D)) (our local partner).

Mosh and Moshy own and operate health platforms (website and mobile applications) through which users can access telehealth services. This includes telehealth consultations with Malaysian registered doctors engaged by our local partner (Doctors) who may be supported by other healthcare professionals (including Malaysian registered nurses and pharmacists) and support staff engaged by us or our local partner (in this Privacy Policy, where the context permits, a reference to a Doctor includes a person acting under the direction and authority of a Doctor). In addition to operating the health platforms via this website, we may supply non-prescription products. Where you receive telehealth services from a Doctor, the Doctor prescribes medication and you opt to have the prescription medication supplied by mail, we facilitate the supply by mail of the prescription medications by our local partner under the authority of your treating Doctor.

We are committed to respecting your privacy. This Privacy Policy serves to inform you that your Personal Data is being processed by us or on our behalf, and provides information about how we collect, use, store and disclose your Personal Data. We are bound by the Personal Data Protection Act 2010 ("PDPA").

By providing Personal Data to us, you consent to our collection, use and disclosure of your Personal Data in accordance with this Privacy Policy and any other arrangements that apply between us. We may change our Privacy Policy from time to time by publishing changes to it on our Sites, and with notice to you. Your continued use of this website, our mobile application or our services after the notice period constitutes your acceptance of the amended Privacy Policy. We encourage you to check our Sites periodically to ensure that you are aware of our current Privacy Policy.

Mosh employees and contractors, as well as Doctors and employees and contractors of our local partner, may also collect, use and disclose your Personal Data (including your health information and other sensitive personal data) in similar ways to those described in this Privacy Policy. Doctors and our local partners' employees and contractors are also required to uphold professional standards for the protection of your Personal Data. While we don't interfere in the way health professionals provide health care services, we require all Doctors and other health professionals who use the platform to comply with applicable privacy-related laws and standards and professional obligations relating to patient confidentiality.

We care about your privacy:

We will never rent, trade or sell your email address or other personal details to anyone.

We will never publicly display your email address or other personal details that identify you.

In the event of any inconsistency between the English version and the Malaysia version of this Privacy Policy, the English version shall prevail over the Malaysia version.

1. Definitions

In this Privacy Policy the following capitalised terms have the following meanings:

  1. Personal Data means any information or an opinion that relates directly or indirectly to a person who is identified or identifiable from that information (or from that and other information in the possession of a person) as described in detail in clause 3, including Sensitive Personal Data. For example, this may include your name, age, gender, postcode and contact details;
  2. Sensitive Personal Data includes any Personal Data consisting of information as to the physical or mental health or condition of a person, that person's political opinions, that person's religious beliefs or other beliefs of a similar nature, the commission or alleged commission by that person of any offence, biometric data or any other personal data as the government may determine;
  3. Site means getmoshy.com.my;
  4. PDPA means the Personal Data Protection Act 2010.

2. How do we collect your Personal Data?

We may collect the Personal Data you directly give us through some of the following means:

  1. when you make an inquiry or order in relation to goods or services through one of our websites located at the Sites or via WhatsApp;
  2. when you attend an online consultation with a Doctor through our Sites (note that your treating Doctor will make, hold and maintain your medical records within our systems. Our local partner and its employees and contractors may also create and hold medical records in their own systems. Any health information held by us will be managed in accordance with the PDPA and any other applicable laws, such as the Private Healthcare Facilities and Services Act 1998 and any other applicable legislation);
  3. in administering and performing any contracts with service providers;
  4. when you contact us, a Doctor or our local partner via telephone, asynchronous text or facsimile (including via WhatsApp);
  5. from any correspondence with us or our local partner (whether in writing or electronically);
  6. through any mobile applications provided by our organisation;
  7. when you post in our official community groups or pages on social media;
  8. when you use or interact with a wearable or other connected device that integrates with our systems;
  9. while conducting customer satisfaction and market research surveys; and
  10. when administering any of our or our local partner's services.

We may also collect Personal Data from publicly available sources and third parties, such as government or health systems, suppliers, recruitment agencies, contractors, our clients and business partners, and your relatives and representatives.

3. What Personal Data do we collect?

The type of Personal Data we may collect can include (but is not limited to), your name, postal address, MyKad or MyPR identification card or passport number, email address, phone numbers, date of birth, billing and shipping information, device-related information (such as your device ID or serial number), IP address, statistics on page views, traffic, standard web log-in information, details of the services and products you make enquiries about, and, if applicable, employment information. We may require photographs of you and/or your photo ID to confirm your identity and your suitability for treatment plans.

We will collect and hold Sensitive Personal Data about you, such as your height, weight and medical history and any information or photographs you provide to a Doctor. Sometimes your medical history and profile may also include information about sexual activity, religious and other beliefs, ethnicity and genetics, where relevant. We only collect Sensitive Personal Data about you with your explicit consent, or otherwise in accordance with this Privacy Policy, PDPA and applicable legislation.

Recordings: we do not record consultations or telephone calls by default. If a recording is ever required (for example, for auditing or quality assurance), we will tell you in advance and you may decline.

Where you do not wish to provide us with your Personal Data or Sensitive Personal Data, we or our local partner may not be able to provide you with requested goods or services or do the other things described in the next section.

4. Why do we collect, use and disclose Personal Data?

We may collect, hold, use and disclose your Personal Data for the following purposes:

  • to enable you to access and use our website and services, including to facilitate payment processing;
  • to assist Doctors and our local partner to arrange and attend consultations with you and provide services and goods to you, including supplying and dispensing medications and other non-prescription goods to you;
  • to communicate with you in the event that any services requested are unavailable or if there is a query or problem with a scheduled consultation or an order for goods, or with your subscription;
  • to operate, protect, improve and optimise our website and services, business and our users' experience, such as to perform analytics, conduct research (including in relation to de-identified Personal Data and in collaboration with third parties), training and quality assurance activities, and for advertising and marketing (see clause 11);
  • to send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you (including via WhatsApp);
  • to maintain and update our records including medical records. We aim to provide users with continuity of care which requires that records from one consultation or order are available to Doctors and our local partner who subsequently provide you with services or goods;
  • subject to our legal obligations and your rights to unsubscribe, to send you marketing messages and other information that may be of interest to you, including information sent by, or on behalf of, our business partners that we think you may find interesting;
  • to comply with our legal obligations, exercise and defend our legal rights, resolve disputes, and perform and enforce our agreements; and
  • to otherwise manage our business and our relationship with our local partner.

We are committed to responsible data handling practices. When we de-identify personal data for research or analytical purposes, we employ robust techniques to ensure that individuals cannot be reasonably re-identified.

5. To whom do we disclose your Personal Data?

We may disclose Personal Data for the purposes described in this Privacy Policy to:

  • our employees, contractors and related bodies corporate;
  • our local partner, and their employees and contractors;
  • Doctors and other healthcare professionals (including Malaysian registered nurses and pharmacists) who support Doctors;
  • third party suppliers and service providers, including messaging providers (including WhatsApp), cloud service providers and AI technology providers, and other providers for the operation of our websites and/or our business or in connection with providing our products and services to you (including for the purposes of delivering goods to you);
  • professional advisers, dealers and agents;
  • payment systems operators (e.g. merchants receiving card payments);
  • anyone to whom our assets or businesses (or any part of them) are transferred, or other parties involved in asset and business transfers (or prospective transfers);
  • specific third parties authorised by you to receive information held by us;
  • should a Doctor form the professional opinion that a user is at imminent risk of harm, including self-harm, and where it is consistent with his or her professional and ethical obligations to do so, to contact emergency services (such as an ambulance service) to request a welfare check or similar intervention; and/or
  • other persons, including government agencies, regulatory bodies and law enforcement agencies, or as required, authorised or permitted by law.

6. Prescriptions

Where a prescription is issued to you by a Doctor, Mosh and Moshy may offer a range of options for facilitating the dispensing to you of the relevant medications. The Doctor may send the prescription to you, your nominated pharmacy or to our local partner, as directed by you and as permitted by applicable law. Where the option is available to send directly to another pharmacy, you must provide accurate pharmacy details. The form and manner in which the prescription is shared will depend on the option you select, and any applicable legal requirements. Prescriptions will always be transmitted through secure, official channels.

7. Using our website and cookies

We may collect Personal Data about you when you use and access our website or our mobile applications.

While we do not use browsing information to identify you personally, we may record certain information about your use of our website, such as which pages you visit, the time and date of your visit and the internet protocol address assigned to your computer.

We may also use 'cookies' or other similar tracking technologies on our website that help us track your website usage and remember your preferences. Cookies are small files that store information on your computer, TV, mobile phone or other device. They enable the entity that put the cookie on your device to recognise you across different websites, services, devices and/or browsing sessions. You can disable cookies through your internet browser but our websites may not work as intended for you if you do so.

In some cases, third parties may place cookies through this Site. For example:

  1. Google Analytics, one of the most widespread and trusted website analytics solutions, may use cookies de-identified data about how long users spend on this Site and the pages that they visit;
  2. Google AdSense, one of the most widespread and trusted website advertising solutions, may use cookies to serve more relevant advertisements across the web and limit the number of times that a particular advertisement is shown to you;
  3. Segment, one of the most widely used customer data platforms, may use cookies to ensure that we can understand how long users spend on the site, and the pages they visit; and
  4. third party social media applications (eg, Facebook, X, LinkedIn, Pinterest, YouTube, Instagram, etc) may use cookies in order to facilitate various social media buttons and/or plugins in this Site.

8. Security

We are committed to protecting the security of your information. In order to mitigate against unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online. We store data online and use Secure Sockets Layer to provide users secure and private access.

9. Overseas Disclosure

Our parent company is located in Australia. As such, data we collect in Malaysia is primarily hosted in Australia. You consent to the provision of such information to Mosh in Australia and acknowledge that Australian incorporated Mosh entities may not be bound by the PDPA.

From time to time we may also engage an overseas recipient to provide services to us, such as cloud-based storage solutions or a Malaysian registered Doctor who is travelling overseas. Please note that the use of overseas service providers to store Personal Data will not always involve a disclosure of Personal Data to that overseas provider. However, by providing us with your Personal Data, you consent to the provision of such information to overseas recipients (such as servers located in the United States of America) and acknowledge that overseas recipients may not be bound by the PDPA, and you may not be able to seek redress under the PDPA from them or us.

We will only disclose your Personal Data overseas, for example, to a third-party service provider or to cloud servers which are based outside of Australia or Malaysia, in accordance with the PDPA. Where we do transfer your Personal Data to another country, we will ensure certain conditions are met, for example:

  • the receiving person or organisation is subject to a binding agreement to protect that information in accordance with Australian standards; or
  • the receiving person or organisation is subject to a law or a scheme substantially similar to the Australian Privacy Act 1988 (Cth), including mechanisms for enforcement; or
  • have provided your prior consent to the disclosure.

Where we do this, we will take reasonable steps to ensure these parties take appropriate measures not to breach the Australian Privacy Act 1988 (Cth).

10. Links

Our Sites may contain links to websites operated by third parties. Those links are provided for convenience and may not remain current or be maintained. Unless expressly stated otherwise, we are not responsible for the privacy practices of, or any content on, those linked websites, and have no control over or rights in those linked websites. The privacy policies that apply to those other websites may differ substantially from our Privacy Policy, so we encourage individuals to read them before using those websites.

11. Use of artificial intelligence (AI)

From time to time, we may offer optional AI-powered features to assist your experience (for example, an assistant for managing your subscription or guiding you on your health or wellness journey). If you choose to use these features:

  • we may engage third-party partners to provide AI technology. We contractually require these partners to access, use and retain your information only to the extent necessary to provide services to us (including to maintain and improve those services over time) or as otherwise permitted by law;
  • our AI partners are expressly prohibited from using your information to train, fine-tune or otherwise improve any models not used to provide services to us, such as publicly available large language models; and
  • we may access, use and retain information relating to your use of the features or other interactions with us to provide the features, support our services, comply with legal obligations or otherwise for the purposes described in this Privacy Policy.

12. Accessing or correcting your Personal Data

You can access the Personal Data we hold about you by contacting us using the information below. Sometimes, we may not be able to provide you with access to all of your Personal Data and, where this is the case, we will tell you why. We may also need to verify your identity when you request your Personal Data.

If you think that any Personal Data we hold about you is inaccurate, please contact us and we will take reasonable steps to ensure that it is corrected.

You can also contact us to limit the processing of your personal data, withdraw your consent to the processing of your personal data or request for the transmission of your personal data to another data controller.

13. Do we use your Personal Data for direct marketing?

We and/or our carefully selected business partners may send you direct marketing communications and information about the services offered on our Sites. This may take the form of emails, SMS, mail or other forms of communication, in accordance with the PDPA. We may use Personal Data you provide to us for this purpose. Receiving marketing communications is not a condition of any purchase or service with us. You may withdraw your consent and opt-out of receiving marketing communications from us by contacting us using the information below, or by using the opt-out facilities provided in such marketing communications (e.g. an unsubscribe link).

14. Retention

We may retain your Personal Data for as long as is reasonably necessary for the purposes described in this Privacy Policy or as permitted or required by law. You may close your account by contacting us. However, certain Personal Data (such as health records) may need to be retained for a period required under applicable laws even after your account is closed.

Once Personal Data is no longer needed for a permitted purpose or required to be retained, we will take reasonable steps to destroy or de-identify such information. Personal Data may persist on backup or archival media for an additional period of time for legal, tax or regulatory reasons or for legitimate and lawful business purposes.

15. Making a complaint

If you think we have breached the PDPA, or you wish to make a complaint about the way we have handled your Personal Data, you can contact us using the details set out below. Please include your name, email address and/or telephone number and clearly describe your complaint. We will acknowledge your complaint and respond to you regarding your complaint within a reasonable period of time. If you think that we have failed to resolve the complaint satisfactorily, we will provide you with information about the further steps you can take.

If you are dissatisfied with our response, you may contact the Department of Personal Data Protection via https://www.pdp.gov.my/ppdpv1/en/main-page/.

16. Contact Us

For further information about our Privacy Policy or practices, or to access or correct your Personal Data, make a complaint or unsubscribe from marketing communications, please contact us at privacy@getmosh.com.

Last updated: 28th July 2026