Privacy Notice

Who is responsible for your information

First Experts Sdn. Bhd. (registration 202401037996 / 1583843-M) is the data user under Malaysia’s Personal Data Protection Act 2010. It is the company answerable in law for what happens to your personal information.

Purple Door (M) Sdn. Bhd. (registration 201901042984 / 1352314-H) produces the event, and PPCN builds and runs its websites and systems. Both handle your information on First Experts’ instructions.

A copy of your information, a correction, a deletion or a complaint goes to our data protection officer at dpo@mymithackmed.com, or through the form at apply.mymithackmed.com/your-data.

MIT Hacking Medicine provides the programme, the method and the mentors. For the newsletter, if you ask for it, its own privacy statement applies.

What we collect

If you apply for the hackathon. Your name, email addresses, mobile and WhatsApp numbers, the country you are travelling from and your city, age group, gender, ethnicity, whether you study or work, your organisation, your job title or degree programme, your professional field, LinkedIn and any CV, photograph, website or social links you give us, the languages you work in, your shirt size, whether you need a letter for a Malaysian visa, the themes that interest you, your four written answers, any MIT connection, whether you have been to one of these before, how you heard about us, and any allergy you tell us about.

Once you have a place. On your own page you can correct these details and add one emergency contact, a name and a number.

If you ask for a visa letter. The name on your passport, your nationality and country of residence, your passport number with its issue and expiry dates, your date of birth, your travel dates, your organisation and your job title. Only the event’s administrators can see it. We never ask for a copy of your passport.

If you offer to mentor. The same kind of details as an application, with a short biography and a photograph for the mentor book given to participants.

If you propose a speaker. The speaker’s name, title, organisation, country, work email, phone, LinkedIn, topic, biography and CV, and your own name and email if you are proposing somebody else. Please ask them first.

If you ask about sponsoring. Your organisation, name, work email, phone and message.

If you buy a ticket. Your name, work email, phone number, job title, organisation, LinkedIn and sector, the names and emails of the other people on your booking, and any allergy you tell us about. For a student ticket, your university, student number and a picture of your proof. For an invoice, the company, tax number, address and purchase order. Payment is taken by Billplz. We never see or hold your card details.

If you write to us by email, the contact form or WhatsApp. Whatever is in your message, and the address or number you sent it from.

If you ask the website assistant. What you type. See below.

If you make a share picture. The photograph you choose is sent to our server, drawn into your picture and thrown away. It is never stored.

If you only visit the website. The ordinary records a web server keeps: the page you asked for, when, and the address you asked from. Our host, Vercel, counts visits so we know how many people came and which pages they read. It sets no cookie and stores nothing on your device, and the code it counts with changes every day. There is no Google Analytics, no advertising pixel and no session recording. Our typeface is served from our own sites, so nothing about your visit goes to Google.

The website assistant

The Ask box on this site and on the hub is answered by an AI service run by Anthropic, in the United States. What you type is sent to Anthropic so it can write the answer.

We keep your questions and the answers for 90 days, so the team can see what people ask and correct a wrong answer, and then delete them. If you ask for a person to reply, we also keep the name and email you give us.

Please do not type health details or anything private into it. For anything that matters, write to the team.

Cookies and what is kept in your browser

mymithackmed.com sets no cookies. If you ask the assistant a question, your browser keeps a random number so your questions stay in one conversation. It is made at your first question and never before.

The forms at apply.mymithackmed.com and the hub use these:

• A sign-in cookie keeps you signed in to your own page, for 30 days.
• A second cookie remembers which address your sign-in code went to, for 30 minutes.
• A conversation cookie on the hub’s Ask page keeps one conversation together, for 30 days.
• Form drafts in your browser keep what you have typed, so a closed tab loses nothing. They go when you send the form.
• Remembered details in your browser (your name, email, phone, organisation, job title, city and country) fill in the next form for you. They are forgotten after 90 days, or at once with Forget me on this device under each form.
• Team sign-in cookies on the hub, for the people who run the event.

Each of these does something you asked for, so we do not ask for agreement first. None is used for advertising or for tracking you across other sites. Clearing your browser data removes them all.

The questions you do not have to answer

Some of what we ask is what the Act calls sensitive personal data: information about your physical or mental health, your religious or political beliefs, or offences. We use it only with your explicit agreement, and you are free not to answer.

• Allergies. This can reveal a health condition. If you tell us about one, a box beside it asks your agreement that we use it for catering and first aid during the event. Without that tick, the note is not kept.
• Ethnicity. Asked so we can see whether the room reflects the country. You can answer Prefer not to say. Malaysian law does not class ethnicity as sensitive personal data. European law does, and we treat it that way for anybody in the EEA or the UK.

Your emergency contact is somebody else’s information. Please ask them before you give us their number. By entering it you are telling us they agreed.

Why we use it

Malaysian law works mainly on your agreement. You give it when you send the form, and you can take it back at any time. We use your information to:

• decide who gets a place, and put balanced teams together;
• run the four days: badges, catering, teams, certificates, and a letter for a visa if you need one;
• take payment for tickets and keep proper accounts;
• tell you what is happening by email, and on WhatsApp only if you said yes;
• write to you about future events, only if you ticked the box for it;
• report attendance and outcomes to partners, as totals;
• answer you when you write to us;
• meet our legal, tax and audit obligations.

We do not use your information to make an automated decision about you. A person reads every application.

Who else sees it

• Sponsors, only for the people who ticked “May sponsors contact you about opportunities?” on the form. Nobody else’s details reach a sponsor, and we never hand over the whole list. A sponsor receives your name, role, organisation and the contact details you gave us. Your application, CV and written answers are not shared.
• MIT Hacking Medicine, in the United States, receives a record of each participant and mentor, with the answers given on the form, to run the programme and its mentor network, and your email for the newsletter if you asked for it.
• Suppliers working on our instructions: Supabase (the database, Singapore), Vercel (the websites), Resend (email, United States), Anthropic (the website assistant, United States), Billplz (payments, Malaysia), Meta Platforms (WhatsApp messages), Google (documents) and Titan (our mailboxes).
• The venue, for catering and access to the building, and only what it needs.
• Anybody the law requires us to tell.

We do not sell your personal information and we do not rent lists.

Where your information is kept

The database is hosted by Supabase in Singapore. The websites are served by Vercel from servers in several countries. Email is sent through Resend, the website assistant runs on Anthropic, and MIT Hacking Medicine works from the United States. WhatsApp messages pass through Meta.

Your information therefore leaves Malaysia, under the conditions the Act sets for transfers abroad.

How long we keep it

Every morning a job deletes what has reached its date:

• applications, mentor and speaker records and attendee records: 24 months after the event, so the next edition can invite people back;
• passport details given for a visa letter: 30 days after the event;
• pictures of student proof: 30 days after the event;
• your emergency contact: 7 days after the event;
• questions to the website assistant: 90 days;
• WhatsApp conversations: 12 months;
• emails and contact-form messages: 24 months;
• accounting and payment records: 7 years, as Malaysian tax law requires;
• anything you ask us to delete: within 30 days, except what the law obliges us to keep.

What you can tell us to do

Under the Act you may:

• ask for a copy of what we hold about you;
• have that copy in a form you can take to somebody else;
• have anything wrong corrected;
• take back your agreement, at any time;
• tell us to stop sending you things;
• ask us to limit how we use your information;
• complain to Malaysia’s Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

Write to dpo@mymithackmed.com or use the form at apply.mymithackmed.com/your-data. We answer an access request within 21 days, which is the period the Act allows, and we do not charge for it. If you have a place, you can correct your own details on your page at any time.

Taking back your agreement does not undo what we already did with your information while it stood, and it may mean we cannot keep you in the event.

Keeping it safe

Access to the hub requires a sign-in, and every table in the database is restricted to the people whose job needs it. Card details never reach us. Documents live on a company drive with named members.

If your information is lost or reached by somebody who should not have it, and it could harm you, we tell Malaysia’s Personal Data Protection Commissioner within 72 hours and we tell you.

If you are in Europe or the United Kingdom

Your rights under the GDPR are broadly those above, and also include the right to object. Where MIT Hacking Medicine is the party responsible, for its newsletter and its own events, MIT’s statement applies and names its representatives in Paris and London. Write to us first and we will point you to the right place.

This notice in Bahasa Malaysia

The Act requires this notice in both the national language and English. The two say the same thing; use the language switch at the top of the page to read the other.

Changes

If we change anything that matters, we will say so on this page and, where it affects you directly, write to you.

Written 12 September 2026. Updated 22 October 2026.