KUALA LUMPUR, April 2 ― News on the government’s alleged plan to sell its Covid-19 tracker app to a private firm is shining a spotlight on MySejahtera and how much protection is given to the private data of millions of its users nationwide.

Following the revelation, many have been pressing the government to end the mandatory use of the application as the country transitions into Covid-19 endemicity.

Even as Malaysians understand the need for a public health info depository, many want guarantees that its security is iron-clad.

With over 38 million registered users including the majority of Malaysia’s overall population due to mandated public check-ins by the government, the app collects one’s personal details such as name, IC number, phone number, email address, gender and address.

But how did the now ubiquitous app come about in the first place and turn into a legal issue? Here’s a look back at how it started, based on publicly available court documents.

June 2005 ― KPISoft Malaysia Sdn Bhd is incorporated.

January 2020 ― Malaysia confirms its first Covid-19 case.

March 2020 ― The Malaysian government initiates containment measures, including a nationwide lockdown known as the movement control order (MCO).

Circa April 2020 ― KPISoft submits a proposal of a mobile-application based solution to the ongoing Covid-19 crisis, which is accepted by the Malaysian government.

Through its software known as KPISOFT Software, the company develops MySejahtera as part of its corporate social responsibility of which the Malaysian government need not make any payment for services rendered for a period of one year.

May 2020 ― KPISoft Malaysia changes its name to Entomo Malaysia Sdn Bhd.

September 2020 ― Revolusi Asia Sdn Bhd and MYSJ Sdn Bhd are incorporated.

Revolusi enters into an agreement with Entomo Malaysia, in which Revolusi holds all the shares in MYSJ as Entomo’s nominee.

MYSJ becomes the special vehicle for the commercialisation of the app, whereby Revolusi ownes all the shares in MYSJ.

October 2020 ― Entomo Malaysia and MYSJ enter into a Licence Agreement. Among other things, the deal sees Entomo Malaysia transfer the intellectual property of the app to MYSJ and grants MYSJ the licence for the software. 

MYSJ also agrees to pay Entomo Malaysia RM 338.6 million, described as the aggregate fees for the transfer of intellectual property of the app and the licensing fees for the software.

Circa November to December 2020 ― Entomo Malaysia submits a proposal and letters in writing to the Malaysian government for the app’s commercial use.

The company’s proposal is outlined by way of either a Public Private Partnership (PPP) or a service contract between the government and MYSJ.

According to its proposal, Entomo Malaysia envisions a digital services ecosystem on MySejahtera, encompassing digital health, digital payments, and a "shared economic model for businesses, tech startups, and gig economy.”

At that time, the Malaysian government led by Tan Sri Muhyiddin Yassin did not agree nor disagree with Entomo"s proposal.

Circa March to April 2021 ― The Cabinet approves the continued use of the app by way of a service contract and delays its full commercialisation.

May 2021 ― The government issues a letter agreeing to enter into a service contract with MYSJ for the continued use of the app.

December 2021 ― Parliament’s Public Accounts Committee (PAC) says the government should not have paid for the MySejahtera smartphone application.

This is after the PAC acknowledged Prime Minister Datuk Seri Ismail Sabri Yaakob’s answer in the Dewan Rakyat that the government will start making payments for use of the MySejahtera app from April 2021.

Present day

March 24, 2022 ― The government’s plan to sell its Covid-19 tracker app to a private firm is disclosed at a PAC hearing.

An official from the Ministry of Health, which operates the smartphone app, tells the PAC inquiry panel that the Cabinet approved the sale to MYSJ on November 26, 2021, via a direct tender.

March 27, 2022 ― Health Minister Khairy Jamaluddin seeks to allay public fears, explaining that the MySejahtera app used for Covid-19 contact tracing has never been sold to any private company.

The same day, Opposition Leader Datuk Seri Anwar Ibrahim raised concerns about the government’s plan to sell the MySejahtera app to a private firm he claimed is owned by known political cronies.

March 28, 2022 ― Khairy reiterates that MySejahtera as a Covid-19 contract tracing mobile app and its data still belongs to the government, despite a previous deal on its intellectual property and software licence.

March 30, 2022 ― Khairy says the government is considering scrapping the check-in feature from the MySejahtera Covid-19 tracker app but adds that it will depend on the infectivity rate after opening the country’s international borders on April 1.

He says the Health Ministry will observe the mobility and infection patterns for several weeks after April 1 before making a decision.

The same day, the PAC announces that it will begin an inquiry into the development and procurement of the MySejahtera application sometime in mid-April.

March 31, 2022 ― Khairy tells the Dewan Negara that a Non-Disclosure Agreement (NDA) had been signed between KPISoft and the National Security Council on April 1, 2020.

Among the terms stipulated was that the ownership of all data and information obtained through the app usage remained the absolute and whole property of the Malaysian government of which their confidentiality and security is guaranteed.

He also says the usage of the MySejahtera app has been vital and proven effective for Malaysia’s Covid-19 management and thus should be maintained.

He adds that the Health Ministry sees the app through existing overlay functionality as a necessity, even as the country transitions towards endemicity.