Skip to main content
Klinikfy
Back to KlinikfyLegal

Privacy

Privacy Policy

Last updated: 1 January 2026

Klinikfy ('we', 'us', 'our') provides an online booking and clinic-management platform. This policy explains what data we collect, why we collect it, how we protect it, and the rights you have over it.

1. What we collect

We collect information you provide directly, data generated by your use of Klinikfy, and a small amount of technical data needed to operate the service securely.

Account information

  • For clinic owners: name, email, password (hashed), clinic name, clinic URL, address, phone, NRIC (optional, for verification).
  • For patients: name, email, password (hashed), WhatsApp number, NRIC (optional).

Booking & appointment data

  • Appointments you book or receive: clinic, doctor, service, date and time, status, notes you choose to share.
  • Medical history fields you fill in (e.g. allergies, current medications) — only when you submit them and only visible to the clinic you book with.

Communications

  • WhatsApp messages between you and clinics routed through Klinikfy (content, timestamps, delivery status).
  • Email notifications and in-app messages we send on your behalf.

Technical data

  • IP address, browser type, device type, operating system, referring URL.
  • Server logs, error reports, and aggregated usage analytics.

2. How we use your data

We use your personal data to:

  • Create and maintain your account.
  • Operate the booking flow: matching you to clinics, holding slots, sending confirmations and reminders.
  • Display your public booking page (clinic name, address, opening hours) — clinic owners only.
  • Send transactional notifications (appointment confirmations, reminders, cancellations) via WhatsApp and email.
  • Detect and prevent fraud, abuse, and security incidents.
  • Improve Klinikfy through aggregated, de-identified analytics.
  • Comply with our legal obligations.

We do not sell your personal data. We do not use medical data for advertising.

3. Legal basis (PDPA 2010)

Under the Malaysian Personal Data Protection Act 2010 (“PDPA”), we process your data on the following bases:

  • Consent — for processing medical/health data, marketing communications, and non-essential cookies. You can withdraw consent at any time (see Your rights).
  • Performance of a contract — to provide the booking and clinic-management service you signed up for.
  • Legal obligation — to comply with applicable Malaysian laws and regulations.
  • Legitimate interest — to keep the service secure, prevent fraud, and improve the product, balanced against your rights and freedoms.

4. Sharing & disclosure

We share your data only as described below:

  • With clinics you book with: your name, contact details, appointment info, and any medical fields you fill in are visible to that clinic so they can deliver care.
  • With service providers: vetted vendors who help us run Klinikfy — hosting (AWS / Neon), email delivery (Resend), WhatsApp delivery (WasenderAPI), error monitoring. These vendors are bound by confidentiality and data-processing terms.
  • For legal reasons: if compelled by Malaysian law, court order, or to protect the rights, property, or safety of Klinikfy, our users, or the public.
  • Business transfers: if Klinikfy is acquired or merged, your data may be transferred — you will be notified in advance.

We never share your medical data with advertisers.

5. Data retention

We keep your personal data only as long as necessary for the purposes described in this policy, or as required by law:

  • Account data: while your account is active, plus up to 12 months after deletion for recovery.
  • Booking records: up to 7 years for clinics (to comply with Malaysian medical record-keeping norms), and at least 3 years for patients.
  • WhatsApp messages: up to 24 months, then anonymised for analytics.
  • Server logs: up to 90 days.

6. Your rights

Subject to PDPA 2010, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
  • Delete your account and associated data, subject to our retention obligations.
  • Opt out of marketing communications — use the unsubscribe link or email us.

To exercise these rights, email privacy@klinikfy.com. We will respond within 21 days, as required by PDPA.

7. Cookies

Klinikfy uses a small number of cookies and similar technologies:

  • Strictly necessary — authentication session cookie (better-auth). Cannot be disabled.
  • Functional — remembers your timezone, last-clinic preference, and onboarding phase.
  • Analytics — only with your consent. We use privacy-respecting analytics that do not identify you personally.

You can clear cookies in your browser at any time.

8. Security

We protect your data with industry-standard safeguards: encryption in transit (TLS 1.2+), encryption at rest for sensitive fields, role-based access controls, audit logs, and regular vulnerability scanning. Access to medical data is restricted to the clinic you book with and authorised Klinikfy staff with a documented business need.

No system is 100% secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by Malaysian law.

9. Children's data

Klinikfy is not directed at children under 18. Patients under 18 should only use Klinikfy with the consent and supervision of a parent or legal guardian. We do not knowingly collect personal data from children without verifiable parental consent.

10. International transfers

Klinikfy is operated from Malaysia. Some of our service providers (for example, our cloud hosting and email delivery vendors) may store or process data outside Malaysia, including in Singapore, the United States, or the European Economic Area. When we transfer your data internationally, we do so under contractual safeguards that ensure your data remains protected to PDPA-equivalent standards.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where the changes are material, notify you by email or through an in-app notice.

12. Contact us

Klinikfy operates under Malaysian law. For any questions, complaints, or data requests:

If you are unsatisfied with our response, you may lodge a complaint with the Jabatan Perlindungan Data Peribadi (JPDP) — the Malaysian Department of Personal Data Protection.