KUALA LUMPUR, April 25 – The Health Ministry is negotiating a MySejahtera contract for direct award to MySJ Sdn Bhd that extends until March next year, Health Minister Khairy Jamaluddin said.
After that, operations of the MySejahtera mobile app can either be transferred to the Ministry of Health (MOH) or to other private companies in an open tender process.
In an interview with Mingguan Malaysia, the Sunday edition of Malay daily Utusan Malaysia published yesterday, Khairy said MOH asked for new modules on the MySejahtera app after the free corporate social responsibility (CSR) initiative from March 27, 2020 to March 31, 2021 by app developer KPISoft Malaysia Sdn Bhd (now Entomo Malaysia Sdn Bhd).
MOH had also asked the company to continue operating MySejahtera after the end of the CSR period.
“So, to me, we need to pay them. It doesn’t matter that they were appointed in 2020 based on CSR. But from the aspect of services provided after the CSR period and module development, the operation and maintenance of the app must be resolved. Those are costs that were borne by the company. So, to be fair to them, we need to pay,” Khairy told Mingguan Malaysia in the interview held last Thursday.
“That is the issue I want to resolve so that we’ll have an agreement with them until March 2023 and after that, the app, which is the absolute right of MOH, at that time, operations can either be transferred to the ministry or we can open a tender to anyone for operations.”
According to court documents disclosed in a lawsuit by a MySJ shareholder, P2 Asset Management Sdn Bhd, Entomo Malaysia sold MySejahtera’s intellectual property and a non-exclusive software licence for the app to MySJ in a five-year licence agreement until end 2025 for RM338.6 million. Both Entomo Malaysia, which is fully owned by Singaporean company Entomo Pte Ltd, and MySJ share the same office in Kuala Lumpur.
If Khairy’s proposed deal for MySJ goes through and if MOH intends to use MySejahtera after March 2023, it is unclear how an open tender process will work, since Entomo Malaysia’s licence agreement with MySJ indicates that MySejahtera was developed using Entomo Malaysia’s “proprietary” KPISoft software.
Khairy did not indicate to Mingguan Malaysia if the government is also planning to purchase a software licence from Entomo Malaysia to use its KPISoft software for MySejahtera.
An open tender process may inevitably favour MySJ as a licensee of the MySejahtera software.
In a public-private partnership (PPP) proposal made to the government in November or December 2020, Entomo Malaysia proposed a 15-year PPP until December 2036 for MySejahtera, using MySJ as a special purpose vehicle to commercialise the app with digital health, commerce, and payment functions.
Khairy told Mingguan Malaysia that he is against commercialising the MySejahtera app that has more than 38 million registered users.
“We have rejected such requests and we will not consider any requests to use MySejahtera commercially, whether it’s to sell products, insurance, and the like. Cannot. MySejahtera data is collected and controlled under the Prevention and Control of Infectious Diseases Act 1988 and the Medical Act 1971. So, it can’t be used for commercial purposes.”
Government Maintains Ownership Over MySejahtera Data, App
The health minister maintained that the government owns the personal data collected on MySejahtera and the app itself, citing a non-disclosure agreement (NDA) between KPISoft Malaysia and the National Security Council (MKN).
“The main terms of the NDA are that the Malaysian government holds the right to ownership of the data and also of the application. Therefore, it’s absolutely clear and sufficient for us to undertake whatever MySejahtera matters to date. But for us to ensure that our liabilities to the company can be resolved, we need a new contract.”
Khairy said if the app developer or operator tries to access the MySejahtera database or uses the data for other purposes besides those authorised by MOH, the government can take legal action against the company.
“The NDA is still in force until a new contract is signed and that is being negotiated between MOH and the company. This new contract will replace the NDA.”
Khairy said the NDA was used to enable the development of 15 modules on the MySejahtera mobile application beyond the original three, such as on the Covid-19 vaccine, vaccination appointments, and travel, all of which were developed after the end of Entomo Malaysia’s CSR period.
“So, to me, it’s only appropriate that we pay the company for their services provided to us.”
Khairy also said the only other Covid-19 app comparable to MySejahtera was perhaps the UK’s NHS app with plenty of modules.
“The rest only has half or a part of the modules on MySejahtera. I’m not trying to defend MySejahtera. I wasn’t involved in the selection of MySejahtera. This happened before I became health minister. I’m just trying to explain why MOH is using MySejahtera now. It’s more than QR code scans.”
When Mingguan Malaysia asked why MOH staff can’t manage MySejahtera on their own, Khairy said the government currently may not have capacity in terms of developers or operators to develop new app modules, operate, and maintain the facility or the app.
“We’ll do that later. Right now, I want to clear our debts and I want to ensure that until 2023, we have a clear contract so there’s no dispute in terms of contracts between the Malaysian government and KPISoft.”
Parliament’s Public Accounts Committee (PAC) said in a statement Saturday that the government should not make any decision on MySejahtera involving financial implications before it tables its report on the development and procurement of the app in the next Dewan Rakyat meeting in July.
The PAC also confirmed that no contract was ever signed between the government and KPISoft Malaysia for MySejahtera, nor was there a letter of appointment for the company.
MySejahtera Governance Structure, Consent For Post-Covid Use
Khairy acknowledged public concerns about the lack of regulations that protect people’s personal data collected on the ubiquitous MySejahtera app.
He explained that the Personal Data Protection Act (PDPA) 2010, which is exempted for the government, does not regulate MySejahtera because data collected on the app is not meant for commercial transactions.
“However, because we understand sensitivities about this issue, I have asked that MOH and the Communications and Multimedia Ministry discuss creating a clear governance structure for MySejahtera, so that the people can see that it complies with important elements from the PDPA – which is that the data is safe, it’s not abused, and it won’t be used for other purposes besides purposes consented to by the user themselves for public health purposes,” said Khairy.
“In the future, should we use MySejahtera for public health reasons, we will ask users again on whether or not they consent to their data being used for purposes other than the pandemic. For example, to manage non-communicable diseases like cholesterol, diabetes, and health screenings.”
MySejahtera’s 38 million user database, however, was mainly obtained through a government mandate for the Malaysian population, as the government imposed legal penalties for not checking in with the contact tracing app at public premises and used the app to, in some cases, send people to jail for breaking movement restrictions.
Khairy said MOH could use MySejahtera as a platform for people’s personal digital health records, as the country currently lacks an electronic health record system.
“If we discard MySejahtera, we’ll have to come up with a new app. Is there a guarantee that we’ll get more than 38 million users? I think not,” he said.
“Because of the opportunity from the pandemic, we will ensure that the personal data of Malaysians is secure, as guaranteed. We will ensure that the ownership of MySejahtera is clearly MOH’s.
“We will complete whatever agreements with KPISoft or MySJ Sdn Bhd so that there is no longer any dispute in terms of contracts, which I have already testified to the Public Accounts Committee. And we will inform the people that now, MySejahtera may be used for another purpose – public health only, not for commercial reasons. We reject this absolutely.”
