This Privacy Policy explains how OC Global Technology Sdn Bhd ("O’Care", "we", "us", or "our") collects, uses, discloses, retains, and protects personal data of students, parents, teachers, school coordinators, and administrators who use the O’Care platform (the "Service"). We act as a data processor on behalf of participating schools (the "School", which is the data controller for student, staff, and parent records) and as an independent data controller for the limited operational data we collect directly (account credentials, support requests, technical logs).
1. Scope & Roles
This policy covers personal data processed through the O’Care iOS and Android applications, the O’Care administration dashboard, the O’Care API, and the O’Care AI content-moderation service.
For data uploaded or generated by School users in the course of using the Service, the School is the data controller and O’Care is the data processor under a written Data Processing Addendum (DPA). For account-level data (login credentials, audit logs, support correspondence), O’Care is the data controller.
2. Data We Collect
The categories below align with Apple App Privacy and Google Play Data Safety disclosures.
| Category | Examples | Linked to identity? |
|---|---|---|
| Contact Info | Name, email, school affiliation, role | Yes |
| Identifiers | User ID, device ID (for push), session tokens | Yes |
| User Content | Diary entries, posts, chat messages, attachments, mood check-ins, SOS alerts | Yes |
| Health & Wellbeing | Self-reported mood scores, distress indicators from AI moderation | Yes |
| Sensitive Info | Emergency contacts, AI-derived safety risk levels | Yes |
| Location | When you trigger an SOS, O’Care attaches your device’s location to that alert so responders can find you. We request the lowest accuracy that still serves that purpose. Location is stored only with the SOS alert and any case opened from it, is visible only to the responders your School has authorised, and is retained for as long as that alert or case is retained — see the retention schedule in Section 10. | Yes |
| Contact Info (device) | When you choose to add an emergency contact by importing it, O’Care reads your device’s contact list on your device to show you a picker. Only the contact you select is saved to your account. You can add emergency contacts by typing them instead, and you can revoke contacts access in your device settings at any time. | Yes |
| Photos & Media | Avatar uploads, post and message attachments, voice notes | Yes |
| Usage Data | Screens viewed, feature interactions, crash logs, performance metrics | Yes |
| Diagnostics | App version, OS, device model, error stack traces | Yes |
| Administrative & audit data | Role, permissions, school affiliation, alert review actions, case escalation status, timestamps, IP/device/session logs, communications with support | Yes |
We do not collect: precise GPS coordinates outside SOS, calendar, microphone or camera streams (only user-initiated captures), browsing history, or financial data.
3. Sources of Data
- From you — content you submit, profile edits, support tickets.
- From your School — initial account provisioning, class assignments, parent–student links, date of birth verification.
- From a parent — where a parent creates their own account, the parent supplies the child code and the child’s full name that establish the parent–student link.
- Automatically — device identifiers, crash reports, push tokens, audit logs.
4. Purposes & Legal Bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide and operate the Service (accounts, feed, chat, diary) | Performance of a contract; legitimate interests |
| Safety features — SOS, emergency contacts, AI moderation | Vital interests of the data subject; legitimate interests of the School |
| Wellbeing analytics for schools and parents | Performance of a contract; legitimate interests |
| Authentication, audit logging, abuse prevention | Legitimate interests; legal obligation |
| Push notifications for messages, alerts, and announcements | Performance of a contract; consent (where required) |
| Service improvement, debugging, security monitoring | Legitimate interests |
| Comply with court orders, regulators, child-protection law | Legal obligation; vital interests |
Where processing relies on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Health and wellbeing data
O’Care processes wellbeing-related data, such as mood check-ins, distress indicators, SOS alerts, and AI-derived risk signals, solely to provide school safeguarding and wellbeing support. O’Care does not provide medical diagnosis, treatment, or clinical decision-making, and does not use or share wellbeing data for advertising, marketing profiling, or any unrelated purpose.
5. Device Permissions
O’Care requests the following device permissions on a strict need-to-use basis. Each can be revoked from the operating system's settings.
| Permission | Why | When asked |
|---|---|---|
| Camera | Profile photo, posts, chat attachments | When you tap the camera button |
| Photo Library | Upload media to posts, chat, profile | When you tap the gallery button |
| Microphone | Voice notes in chat | When you start a voice recording |
| Notifications | Deliver messages, SOS responses, and admin alerts | At first launch |
| Location | Attach your location to an SOS alert so responders can find you | When you trigger SOS |
| Contacts | Import an emergency contact without retyping it | When you tap to import a contact |
6. AI Content Moderation
To support safeguarding, O’Care runs automated content moderation on diary entries, posts (including any images attached to a post), chat messages (including any attachments), and status/story content. The AI service is operated by us on infrastructure we control. User content is not used to train any third-party model.
Whose content is moderated. Content authored by students and by teachers is screened. Teachers are data subjects in their own right: posts and chat messages you author as a teacher run through the same distress, toxicity and cyberbullying classifier as a student’s, and are subject to the same automated withholding described below. Content authored by parents, coordinators and administrators is not screened by this pipeline.
How it works
- Text and any attached images are assessed by a self-hosted vision-language model (currently the Qwen3-VL family) running on infrastructure we control. It classifies text for distress, toxicity, and cyberbullying signals, and screens images for sexual or otherwise objectionable content. Images attached to posts and to chat messages are both screened.
- The model is multilingual, so content written in languages such as Malay or Indonesian is assessed directly without sending it to any external translation service.
In-app disclosure
This Privacy Policy is the disclosure, and it is reachable in the app from Settings → Privacy Policy. In addition, every diary entry, post and message you author carries an AI badge showing the risk level the analysis assigned and a short machine-generated reason, and the badge opens a sheet explaining what the assessment does and does not do. From that sheet you can submit "Tell us this is wrong" feedback. AI scores do not automatically create disciplinary action or formal cases.
What we send and what we keep
- Original text, and any images attached to a post, are sent to the AI service for classification and are processed in memory only — the AI service does not write the content to durable storage.
- The original diary entry, post, or chat message itself continues to live in the user's account in our main content database. When an authorised coordinator opens an alert, the dashboard reads the original content from that primary store — not from a separate review copy.
- Where the analysis indicates an elevated risk level, an alert is created for review by authorised school coordinators or administrators. Lower risk levels are not surfaced individually and contribute only to the aggregated wellbeing summaries described below. The risk levels and how each is handled are set out in the AI risk-tier annex.
- The alert record stores only metadata (risk level, reason, content type, an identifier pointing back to the original record where the content type carries one, and a SHA-256 hash of the analysed text) — the alert record itself does not contain the raw user content.
- Resolved alerts are purged after 90 days; unresolved alerts are retained until reviewed.
- If the underlying diary entry, post, or message is deleted by the user (or anonymised on account deletion), the dashboard view of any related alert loses access to the raw content at the same time, subject to backup overwrite (see Section 10).
Human oversight
Only named school coordinators and O’Care administrators with role-based access can open alerts.
Automated withholding. Where the analysis indicates a high or critical risk, the content is withheld from other users pending human review. This is an automated step, taken to prevent harm while a person assesses the content. It does not by itself create a case, impose any penalty on your account, or result in disciplinary or law-enforcement action — those decisions are always made by a person. You may contest any AI assessment using the "Tell us this is wrong" control in the app, and request human review under Section 11.
Crisis support
When an own diary entry is rated CRITICAL, O’Care surfaces an in-app sheet with crisis resources (Talian Kasih 15999, Befrienders Malaysia +60 3-7956 8145, and a link to your school counsellor) before any other action is taken.
7. User-Generated Content Safety
O’Care hosts user-generated content (posts, diary entries, chat messages, media attachments, and voice notes). To reduce harm we combine automated filtering (see Section 6) with human moderation and in-app safety controls.
- Report. Every post, chat message, and user profile has an in-app Report control. Reports route to your School's coordinators and to O’Care support.
- Block / mute. Users may block or mute other users from chat and feed surfaces where the feature is available; school administrators may also restrict communications between specific users.
- Review timelines. We aim to review reports of self-harm, threats, or sexual content involving a minor within 24 hours of receipt, and all other reports within 7 days. Where a report is confirmed as a violation, we act on it — removing the content and, where appropriate, suspending or removing the account — within 24 hours of confirmation. Content depicting minors in a sexual context is removed immediately and reported to the relevant authorities.
- Escalation. Repeated or serious violations may result in content removal, account suspension, School referral, or law-enforcement referral.
- Identity-linked. O’Care does not provide anonymous public posting or random chat with strangers. All communications are limited to users and roles authorised by the participating School and are subject to School oversight.
For urgent content-safety concerns email support@ocare.ocgt.app.
9. International Transfers
Personal data is primarily hosted in Malaysia. A defined set of sub-processors processes data outside Malaysia: Cloudflare R2 (media storage), Expo Push Service together with Firebase Cloud Messaging and Apple Push Notification service (push delivery), Sentry (mobile crash reporting), AWS Simple Email Service (transactional email), and Google Analytics 4, Google Tag Manager, Google Fonts, Cloudflare Turnstile and the Gmail API (public website only).
The transfer condition we rely on for those recipients is a Transfer Impact Assessment together with contractual safeguards, under the Personal Data Protection Commissioner’s Cross-Border Personal Data Transfer Guidelines. Where a recipient is in the EEA or the United Kingdom, or receives data originating there, transfers additionally rely on Standard Contractual Clauses or another mechanism permitted under the GDPR and the UK GDPR.
10. Retention & Account Deletion
| Data | Retention |
|---|---|
| Active account profile and content | Until account deletion or School termination |
| Deleted account — soft-delete grace period | 30 days, then permanent erasure |
| Diary entries and private messages of a deleted account | Erased at end of 30-day grace period |
| Public posts authored by a deleted account | Deleted at the end of the 30-day grace period, together with the account. |
| Comments left by a deleted account on another user’s post | The link to the account is removed. The comment text and the display name shown with it are kept, so that the post they sit on still reads coherently for the people in that conversation. |
| SOS alerts and SOS status updates, including any location attached to them | Retained with the account, and erased when the account is erased |
| Safeguarding cases, including any location copied into the case record | Retained with the student's account, and erased when that account is erased |
| Resolved admin alerts (AI moderation) | 90 days |
| Unresolved admin alerts | Until reviewed |
| AI alert metadata (linkage to source content) | Resolved alerts purged after 90 days; unresolved retained until reviewed. Raw user content associated with an alert remains governed by the retention period of the underlying diary entry, post, message, media attachment, or voice note — it is not held in a separate review copy. |
| Security audit logs | Audit records tied to a deleted account are erased with the account. Identity-reveal audit records are retained for 12 months in pseudonymised form. |
| Backups | Backup copies, once established, are retained no longer than 35 days and are then overwritten. |
How to delete your account
From the app: Settings → Account → Delete Account. Your account is immediately locked and you are signed out. After 30 days the deletion is irreversible.
To cancel a deletion during the 30 days: open the app and attempt to sign in with your usual password. Sign-in itself is refused while the account is locked — instead the app shows you the date the deletion becomes final and offers a Restore account action. Confirming that action reactivates the account. Signing in does not by itself cancel the deletion; you must confirm the restore.
Certain records survive erasure where the law requires or permits it — see the table above and the safeguarding and legal-retention exceptions in Section 16 of the Terms & Conditions.
From the web: https://ocare.ocgt.app/delete-account. You may also email privacy@ocare.ocgt.app with the subject line "Account deletion request" — we respond within 30 days.
11. Your Rights
Subject to your jurisdiction you may have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion (see Section 10).
- Restriction — limit how we process your data.
- Portability — receive your data in a structured, machine-readable format. This is currently prepared manually on request rather than by a self-service export, so allow the full response time below.
- Object — to processing based on legitimate interests, including automated decision-making.
- Withdraw consent — at any time, where consent is the basis.
- Lodge a complaint — with the Personal Data Protection Department of Malaysia or your local data-protection authority.
To exercise any right, email privacy@ocare.ocgt.app. We verify identity before responding and reply within 30 days (extendable by a further 60 days for complex requests). Student requests are processed in coordination with the School where required by law.
12. Children & Minimum Age
O’Care is intended for users aged 13 and older. We do not knowingly create accounts for, or collect personal data from, children under 13.
O’Care is not intended for Apple's Kids Category and is not marketed as "for kids" or "for children." It is a school-provisioned safeguarding platform for authorised school communities and users aged 13 or older, unless a higher local minimum age applies.
Student accounts are provisioned by the school administrator. Schools are responsible for confirming each student's age before requesting an account, and for obtaining any parental or guardian authorisation their local law requires. Accounts created through our individual-registration flows are checked against this minimum. Every user must confirm they are 13 or older before signing in.
Where local law sets a higher minimum age (for example, GDPR-K in the European Union, where the age may range from 13 to 16 depending on member state), the higher local minimum applies and the School must record appropriate parental authorisation before creating the account.
For US users: O’Care complies with the Children's Online Privacy Protection Act (COPPA). Schools provide consent for student users under applicable school-authorisation provisions. Parents may review, refuse, or request deletion of their child's data by contacting the School or privacy@ocare.ocgt.app.
If you become aware that a child under 13 has been registered, contact us at privacy@ocare.ocgt.app and we will delete the account and associated data promptly.
13. Security
- TLS 1.2+ for all data in transit; HSTS enforced.
- Database credentials and third-party service credentials are encrypted at rest.
- Short-lived JWT access tokens; refresh tokens stored in
expo-secure-store(iOS Keychain / Android Keystore) on device. - Role-based access control with the principle of least privilege.
- Audit logs for all administrative actions.
- Regular automated dependency scanning.
No method of transmission or storage is 100% secure. We continuously improve our controls and invite responsible disclosure at security@ocare.ocgt.app.
14. Data Breach Notification
If we become aware of a personal-data breach likely to result in a risk to the rights and freedoms of natural persons, we will notify the affected School(s) without undue delay and, where required by law, the relevant supervisory authority within 72 hours of becoming aware of it.
Where we are required to notify the Personal Data Protection Commissioner of Malaysia, we will notify the affected individuals within 7 days of that notification. If notice is given late, we will record the reasons in writing. Affected users in the EEA and the United Kingdom are notified directly without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
15. Region-Specific Disclosures
15.1 Malaysia (PDPA 2010)
O’Care is operated by OC Global Technology Sdn Bhd, a Malaysian company, and processing under this policy is subject to the Personal Data Protection Act 2010. You may lodge a complaint with the PDP Commissioner at www.pdp.gov.my.
15.2 European Economic Area & United Kingdom (GDPR / UK GDPR)
Our EU/UK representative can be reached at eu-rep@ocare.ocgt.app. Supervisory authorities: EDPB members (EU) and the Information Commissioner's Office (UK).
15.3 California, USA (CCPA / CPRA)
California residents have the right to know, delete, correct, and limit the use of sensitive personal information, and to opt out of "sale" or "sharing". O’Care does not sell or share personal information as those terms are defined under the CPRA. To exercise California rights, email privacy@ocare.ocgt.app.
15.4 Other US states
Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have equivalent rights and may contact us at the same address.
16. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified in the app and/or by email at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent revision. Continued use of the Service after the effective date constitutes acceptance, except where the law requires your consent — in which case we will ask for it separately.
17. Contact & Complaints
Data controller: OC Global Technology Sdn Bhd
Privacy enquiries: privacy@ocare.ocgt.app
General support: support@ocare.ocgt.app
Security disclosure: security@ocare.ocgt.app
Postal address: OC Global Technology Sdn Bhd, Unit 09-04, Level 9, City Plaza, Jalan Tebrau, 80300 Johor Bahru, Johor Malaysia
If you are not satisfied with our response, you have the right to complain to the Personal Data Protection Commissioner (Malaysia) or your local supervisory authority.