Final version, in force from 3 November 2026.

Version
v6
Language
English
Size
8495 bytes
SHA-256
1551ace9091be172d467a97f94c0864f956f8218317aedea60d29527817cad29

The canonical text linked below is the document; the SHA-256 identifies its exact bytes. This page shows the same text for reading.

Canonical text (plain text, exact bytes)

Privacy Notice - kliniX

id: privacy | version: v6 | language: en | status: final

1. Who we are and what this notice covers

kliniX is a clinic management system to be provided by KLINIX SYSTEMS SDN. BHD. (Company Registration No. 202601043244 (1705339-P)), with its registered address at No. 23A, Jalan 4/11A, Seksyen 4 Tambahan, 43650 Bandar Baru Bangi, Selangor. This version of the notice takes effect on 3 November 2026.

This notice explains how we handle information relating to clinic representatives for the kliniX website, orders, billing, support and communications. For patient information processed through the system, the Clinic is the data controller and kliniX is the processor under the Data Processing Agreement (DPA). This notice does not replace the Clinic's own privacy notice to patients.

Registered address: No. 23A, Jalan 4/11A, Seksyen 4 Tambahan, 43650 Bandar Baru Bangi, Selangor. Business and correspondence address: No. 9 & 11 (Ground Floor), Jalan Puteri 3A/7, Bandar Puteri Bangi, 43000 Kajang, Selangor. General, support, privacy and incident e-mail: hello@klinix.my. Contact: Dr Muhammad Faiz (Founder), faiz@klinix.my, +60 12-973 7418.

2. Information we collect and why

When a Clinic registers or deals with kliniX, we may collect its legal name and entity type, 12-digit BRN, TIN, SST number where applicable, billing address, business e-mail address and telephone number, MOH clinic certificate number, and the name and role of the authorised Clinic representative. MyKad is requested only where genuinely required for the relevant entity type. Do not use patient details for subscription billing.

We use this information to manage orders, verify representatives, create and manage accounts, administer annual subscriptions and payments, provide support, send service communications, keep evidence of document acceptance, and meet applicable billing or invoicing requirements. Payment references and status may be received from the payment gateway used for the bill (currently toyyibPay, with CHIP as backup).

We keep a record of the document version and acceptance associated with a transaction. Acceptance records are designed so that earlier records are not overwritten.

3. Patient data in kliniX

Patient information entered into kliniX remains under the Clinic's responsibility as data controller. kliniX processes that information to provide the clinic management service and in accordance with the Clinic's instructions and the DPA.

Each Clinic is provided with its own separate database. The database is hosted in Singapore in ap-southeast-1. The Clinic application runs on Hostinger infrastructure in Malaysia. Backup copies of the databases are kept off-site in AWS region ap-southeast-5 (Malaysia), encrypted before upload. If the main application server is unavailable, the Clinic is served for the time being by a standby application server at OVH in Singapore, which uses the same databases. This describes the current architecture; it is not a claim that every isolation control or third-party access path has been independently certified.

4. Service providers

We use the following providers to operate kliniX:

If the Clinic itself connects a Meta channel (WhatsApp, Facebook, Instagram or Threads) to kliniX, that channel's messages and content travel through Meta's platform under the terms between the Clinic and Meta. kliniX processes what it receives from that channel, and what is sent through it, on the Clinic's behalf. A channel that is not connected is not used.

This does not mean every provider receives every category of information. Access depends on the service being provided and is addressed in the DPA and relevant transfer assessment.

5. Important disclosure about payment links

Anyone holding a bill's payment link, including a link shared from Admin › Langganan, can open its payment page, which may show the payer contact details given for that bill. kliniX subscription bills therefore use business contact details only. Do not use patient names, patient contact details or clinical information for subscription payments. Share payment links only with people who need to handle the payment. Shared links expire (7 days by default) and the Clinic can revoke them. The payment gateway used for a bill processes payment data in Malaysia and keeps it for as long as its own terms and the law require.

Every kliniX bill can be paid by FPX. A bill may also offer a one-off card payment; card details are entered only on the gateway's payment page, and kliniX does not receive or store card numbers. There is no automatic charge unless the Clinic's administrator switches it on in Admin › Langganan.

AI features are optional and off by default. kliniX does not process patient data or clinical records with an external AI provider unless the Clinic has opted in under Annex A of the DPA. Annex A names the AI providers, the data each AI feature sends, where it is processed and how long the provider may keep it. A Clinic that has not opted in is not affected by it. A Clinic may withdraw its opt-in at any time, and AI processing for that Clinic stops when the withdrawal is applied.

6. Location and transfers

Clinic databases are hosted in Singapore, with encrypted backup copies in Malaysia. kliniX does not state that Singapore has been conclusively determined to be an adequate destination for every transfer purpose. Where a transfer impact assessment (TIA) is used, it must support the selected transfer basis, remain valid for no more than three years, and be reassessed earlier if there is a material change. For a Clinic that opts in to AI features, Annex A of the DPA describes the transfer of the data those features send to AI providers outside Malaysia and Singapore, and the assessment kliniX has made of that transfer.

7. Retention, subscription end and deletion

The Clinic determines and complies with patient-record retention obligations as data controller. This notice does not state a single medical-record retention period as settled law.

Subscription expiry or access suspension does not delete data. kliniX does not delete Clinic data unilaterally. Deletion takes place only on the Clinic's written instruction and after an export has been provided.

8. Choices, rights and communications

During onboarding, the Terms of Service, DPA and Privacy Notice use three separate boxes that are unticked by default, each linked to the relevant document ID and version. Marketing uses a separate optional opt-in and is not a condition of buying or renewing kliniX.

Clinic representatives may request access to or correction of their business information and manage communication preferences. Requests concerning patient records should be made to the Clinic; kliniX assists the Clinic under the DPA.

Privacy and data-request contact: hello@klinix.my and +60 12-973 7418 (Dr Muhammad Faiz, Founder; faiz@klinix.my).

9. DPO, DPIA and notice changes

kliniX will assess its DPO obligations against any applicable trigger: more than 20,000 personal-data subjects; or more than 10,000 sensitive-data subjects including financial data; or regular and systematic monitoring. kliniX will appoint or register a DPO when required. DPIA requirements will be assessed and kliniX will assist Clinics where required.

The Bahasa Malaysia and English texts are provided together as one Privacy Notice with the ID privacy. When this notice changes, a new version is published. Earlier acceptance evidence remains tied to the version accepted at that time.