PDPA Policy

We process personal data in line with the seven Personal Data Protection Principles of the PDPA:

• Identity and contact: name, email, phone number, organisation and job title.
• Account data: login details and device identifiers used for secure sign-in to our apps, and your name, email, profile picture and Google account ID if you sign in with Google.
• Commercial data: quotations, invoices, payment records and correspondence.
• Training data: participant details, attendance and certificates, including information needed for HRD Corp claims.
• Usage data: logs of how you use our website, apps and Grouper API.
• Customer Data: clinical and coding data submitted by hospitals and other Customers, which we process on their behalf.

We collect personal data directly from you (for example, when you sign up, contact us or register for training), from your organisation when it gives you access to our Services, and automatically when you use our website and apps.

• To provide, operate and support our software, apps, Grouper API, consultancy and training.
• To create and secure accounts and verify devices.
• To respond to enquiries and manage our relationship with you.
• To issue quotations and invoices and to process payments.
• To issue training certificates and support HRD Corp claims.
• To improve our Services and keep them secure.
• To send you updates about our products and workshops, where you have agreed.
• To comply with legal and regulatory requirements.

Data marked as required in our forms and apps (such as your name, email and organisation) is needed to provide the Services. If you do not provide it, we may not be able to create your account, respond to your enquiry, issue a certificate or deliver the Service you asked for.

Other information, such as marketing preferences, is optional.

• Your organisation, where your account is provided by a Customer.
• Service providers who support our operations, such as cloud hosting, email delivery and analytics, bound by confidentiality and data-protection obligations.
• OpenAI, our AI provider, which receives only de-identified clinical content when you use AI Features, and never your name, contact details or identifiers.
• HRD Corp and training partners, where needed for training claims and certification.
• Our professional advisers, auditors and banks.
• Government, regulators, courts and law enforcement, where required by law.
• A successor entity in a merger, acquisition or restructuring.

Some service providers may store or process personal data outside Malaysia, including OpenAI in the United States for AI Features. Where this happens, we take the steps required under the PDPA so that the data is protected to a standard comparable to Malaysian law.

Under the PDPA, you have the right to:

• Access the personal data we hold about you;
• Correct personal data that is inaccurate, incomplete, misleading or not up to date;
• Withdraw consent to processing, subject to legal and contractual limits;
• Limit processing, including asking us to stop direct marketing;
• Data portability, where applicable, in a commonly used format;
• Delete your account in the app, on our account deletion page or by email.

We will respond to access and correction requests within 21 days, as required by the PDPA. A small fee may apply to access requests, as permitted by law. If you withdraw consent, we may no longer be able to provide some Services.

Send your request in writing to our Data Protection Officer, with enough detail for us to identify you and the data concerned. We may ask you to verify your identity before acting on it.

If your request relates to clinical data held by a hospital or clinic that uses our Services, please contact that organisation directly. We will support them in responding to you.

We only send marketing about our products and workshops with your consent. You can opt out at any time using the unsubscribe link in our emails or by contacting us.

We use technical and organisational safeguards, including encryption in transit, access controls, device-bound authentication and staff confidentiality obligations.

If a personal data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected individuals as required by the PDPA.

We keep personal data only for as long as needed for the purposes in this Notice, or as required by law (for example, tax and accounting records). After that, we securely delete or anonymise it.

Notis ini dikeluarkan di bawah Akta Perlindungan Data Peribadi 2010 (APDP). Casemix Solutions Sdn. Bhd. memproses data peribadi anda (seperti nama, e-mel, nombor telefon, organisasi, data akaun, rekod latihan dan rekod bil) untuk menyediakan perisian, aplikasi, API, perundingan dan latihan kami, mengurus akaun dan pembayaran, serta mematuhi undang-undang.

Data peribadi anda boleh didedahkan kepada organisasi anda, pembekal perkhidmatan kami, HRD Corp, penasihat profesional dan pihak berkuasa jika dikehendaki oleh undang-undang. Tiada data demografi pesakit dihantar kepada ciri AI kami. Ciri AI kami dikendalikan oleh OpenAI di Amerika Syarikat, yang hanya menerima data klinikal tanpa pengenalan diri.

Anda berhak untuk mengakses dan membetulkan data peribadi anda, menarik balik persetujuan dan menghadkan pemprosesan. Anda juga boleh memadam akaun anda melalui aplikasi atau halaman pemadaman akaun. Sila hubungi Pegawai Perlindungan Data kami di info@casemix.com.my.

Data Protection Officer
Casemix Solutions Sdn. Bhd.
Lot 1-15 MKH Boulevard, Jalan Changkat, Bandar Kajang, 43000 Kajang, Selangor Darul Ehsan, Malaysia
info@casemix.com.my · +60 10-354 6921

We may update this Notice from time to time. The latest version will always be available on this page, with the "Last updated" date shown above.