Final version, in force from 3 November 2026.

Version
v6
Language
English
Size
13120 bytes
SHA-256
4b6e138278fd53b752475a0aa118c09eb0a223aec8e0da44dc7fc73859c3a7ad

The canonical text linked below is the document; the SHA-256 identifies its exact bytes. This page shows the same text for reading.

Canonical text (plain text, exact bytes)

Data Processing Agreement - kliniX

id: dpa | version: v6 | language: en | status: final

1. Parties and roles

This DPA is between the Clinic identified in the order as data controller and KLINIX SYSTEMS SDN. BHD. (Company Registration No. 202601043244 (1705339-P)), with its registered address at No. 23A, Jalan 4/11A, Seksyen 4 Tambahan, 43650 Bandar Baru Bangi, Selangor, as data processor. This version of the DPA takes effect on 3 November 2026.

The Clinic database is created only after the DPA has been accepted.

Registered address: No. 23A, Jalan 4/11A, Seksyen 4 Tambahan, 43650 Bandar Baru Bangi, Selangor. Business and correspondence address: No. 9 & 11 (Ground Floor), Jalan Puteri 3A/7, Bandar Puteri Bangi, 43000 Kajang, Selangor. General, support, privacy and incident e-mail: hello@klinix.my. Contact: Dr Muhammad Faiz (Founder), faiz@klinix.my, +60 12-973 7418.

2. Scope and Clinic instructions

kliniX processes Clinic data to provide the clinic management system, including receiving, storing, managing, retrieving, displaying, printing and exporting data according to the service functions and the Clinic's instructions. Data subjects may include patients, staff, representatives and other individuals whose data the Clinic enters. Data may include identification, contact, billing and sensitive health information.

kliniX does not acquire an independent right to use Clinic data for purposes unrelated to providing the service.

3. Clinic responsibilities

The Clinic is responsible for its processing basis, patient notices, required consents, user authority, instructions given to kliniX and record-retention obligations.

The Clinic must manage its registration as data controller under Circular 1/2026, with one registration for each MOH certificate. The MOH certificate number is requested during onboarding. A kliniX subscription does not itself register the Clinic.

4. Confidentiality and security

kliniX processes data only on the Clinic's instructions and ensures that people authorised to access it for service purposes are subject to appropriate confidentiality obligations. kliniX will maintain technical and organisational measures that are reasonable and appropriate to the nature of the processing and to the Security Principle obligations applicable to processors.

Each Clinic has a separate database in Singapore in ap-southeast-1. The Clinic application runs on Hostinger infrastructure in Malaysia. Backup copies of the databases are kept off-site in AWS region ap-southeast-5 (Malaysia), encrypted before upload. If the main application server is unavailable, the Clinic is served for the time being by a standby application server at OVH in Singapore, which uses the same databases. This describes the architecture used and is not a certification claim or a representation that every isolation control has been independently tested.

5. Sub-processors

The sub-processors/supporting providers used for kliniX are:

Use of these providers does not mean every provider receives every category of information. kliniX will maintain appropriate records of provider roles and access scope and will communicate material changes through an appropriate contractual or service channel.

If the Clinic itself connects a Meta channel (WhatsApp, Facebook, Instagram or Threads) to kliniX, that channel's messages and content travel through Meta's platform under the terms between the Clinic and Meta. kliniX processes what it receives from that channel, and what is sent through it, on the Clinic's behalf. A channel that is not connected is not used.

AI features are optional and off by default. kliniX does not process patient data or clinical records with an external AI provider unless the Clinic has opted in under Annex A (section 11). Annex A names the AI providers, the data each AI feature sends, where it is processed and how long the provider may keep it. A Clinic that has not opted in is not affected by it. A Clinic may withdraw its opt-in at any time, and AI processing for that Clinic stops when the withdrawal is applied.

6. Cross-border transfers

Clinic data is hosted in Singapore, with encrypted backup copies in Malaysia. kliniX does not rely on a statement that Singapore has been conclusively determined to be an adequate destination for every transfer purpose. Where a TIA is used to support a transfer, it remains valid for no more than three years and must be reassessed earlier on material change. kliniX will provide reasonable information to help the Clinic document the relevant transfer assessment. For a Clinic that opts in to AI features, Annex A describes the transfer of the data those features send to AI providers outside Malaysia and Singapore, and the assessment kliniX has made of that transfer.

7. Data breaches

When kliniX becomes aware of a breach involving Clinic data, kliniX will notify the Clinic without undue delay and will target an initial notification within 24 hours where reasonably practicable. The 24-hour target does not alter when the Clinic's legal notification clock begins.

For a breach that must be reported, the Clinic's 72-hour period to notify the Commissioner starts when the Clinic has reason to believe the breach occurred, which may be before kliniX notifies it. The seven-day period for affected data subjects runs from notification to the Commissioner. kliniX will assist with available facts, investigation and follow-up.

Incident contact: hello@klinix.my; +60 12-973 7418 (Dr Muhammad Faiz).

8. Data-subject requests, DPO and DPIA

The Clinic handles patient requests as controller. kliniX will provide reasonable assistance with access, correction, portability and other requests that need to be implemented through the system.

DPO obligations are assessed if any one relevant trigger applies: more than 20,000 personal-data subjects; or more than 10,000 sensitive-data subjects including financial data; or regular and systematic monitoring. kliniX will appoint or register a DPO when required. kliniX will also assist the Clinic with DPIAs where required.

9. Retention, subscription end, export and deletion

The Clinic determines and complies with applicable record-retention periods. This DPA does not state a single medical-record retention period as settled law.

Subscription end follows the T&C: if the renewal bill isn't paid, there is a grace period of 14 days, the Clinic becomes read-only from day 15, and ordinary access is suspended from day 31. During read-only access, records remain viewable and printable, and data can be exported. Subscription end is not deletion.

Clinic data is not deleted unilaterally. Deletion occurs only on the Clinic's written instruction and after an export has been provided. The Clinic may request an export even after ordinary access has been suspended. After instructed deletion is completed, kliniX may provide deletion confirmation limited to the scope actually deleted.

10. Audit, evidence and acceptance

kliniX will provide reasonable information to demonstrate compliance with this DPA, subject to security, confidentiality and protection of other Clinics' data. Any audit requiring direct system access must be coordinated in advance and must not expose another Clinic's data.

This DPA has its own separate acceptance box, unticked by default, linked to ID dpa and the version accepted. Acceptance evidence remains tied to that version.

11. Annex A: optional AI features

A1. When this Annex applies. This Annex is part of this DPA. It applies only to a Clinic whose authorised administrator has opted in to kliniX AI features; accepting this DPA does not switch them on. The opt-in is the Clinic's written instruction for the processing in this Annex. It is given on the opt-in screen in the app where kliniX provides one, or otherwise by e-mail to hello@klinix.my from the Clinic's registered e-mail address. kliniX records who opted in, when, and the version of this DPA that applied, and switches AI features on for a Clinic only after that record exists.

A2. The features and the data they send.

kliniX does not add the patient's name, IC or passport number, phone number, address or date of birth to DDx, referral or paediatric requests. Text that staff type is sent as written, so it should not contain identifiers.

AI output is a suggestion for the doctor. kliniX never saves it to the record by itself; the doctor reviews it and decides. Clinical responsibility stays with the doctor and the Clinic.

A3. AI providers.

Under each provider's current terms, the provider has no right to use the data kliniX sends to train or fine-tune models.

A4. What kliniX does. kliniX sends only the data listed in A2. AI requests from the Clinic's application go through kliniX's own AI gateway in Singapore, which holds kliniX's account with each provider; a Clinic never holds a provider key. kliniX logs only that an AI feature was used, with codes, counts and timings: never the audio, the transcript, the note, the clinical text or the AI's answer. kliniX stops all AI processing for a Clinic when its opt-in is withdrawn or when its subscription no longer includes AI features.

A5. What the Clinic does. The Clinic opts in only through an authorised administrator. It tells its patients that AI may be used in their care and, for the AI Scribe, before the consultation is recorded, using the notice kliniX provides or its own. It lets a patient ask that AI not be used for their consultation, and the doctor then does not use it. It keeps its doctors responsible for every clinical decision.

A6. Transfers. The data in A2 is processed in the United States, and may also be processed in other countries where a provider or its sub-processors operate. Before AI features were made available, kliniX assessed this transfer in writing (assessment dated 22 October 2026). The assessment is reviewed at least every three years, and earlier on any material change, the same rule as section 6. kliniX will give the Clinic reasonable information about it on request, to help the Clinic document its own transfer basis.

A7. Withdrawal. The administrator can withdraw the opt-in in the app where kliniX provides that, or by e-mail to hello@klinix.my. kliniX then switches off the Clinic's access to the AI gateway without undue delay, and at the latest by the end of the next working day, and the AI features stop. Data already sent cannot be recalled from a provider; under A3 the provider does not keep it.

A8. Changes. A change to the AI providers, the data sent or the features is published as a new version of this DPA. When a new version changes Annex A, a Clinic that has opted in must accept it to keep using AI features; until it does, AI features stay off for that Clinic.