Privacy Policy

We act in two different roles depending on the data:

• As data user (controller) for account, contact, billing, website and marketing data, where we decide how and why it is used.
• As processor on behalf of Customers for Customer Data, including clinical and coding data that hospitals, clinics and other organisations submit. The Customer decides why that data is processed, and we process it only on their instructions.

If you are a patient of one of our Customers, please contact that hospital or clinic about your records. We will help them respond to your request.

Information you give us

• Account details: name, email, phone number, organisation, job role and login credentials.
• Google sign-in: if you choose to sign in with Google, we receive your name, email address, profile picture and Google account ID. See Signing in with Google.
• Enquiries: information you send through our contact form, email, phone or events.
• Training: participant names, organisations, contact details and attendance records.
• Billing: company details, invoices and payment records. We do not store card numbers; payments are made by bank transfer.

Customer Data you submit to the Services

• Clinical and coding data such as diagnoses, procedures, discharge summaries and episode details used for grouping, costing and coding.
• Any identifiers a Customer chooses to store in its own records within our software, which we process on the Customer's behalf.

Information collected automatically

• Device and app data: device model, operating system, app version and a device identifier used for secure, device-bound sign-in.
• AI feedback: if you report an AI answer, we receive the report, the related question and answer, and your account ID.
• Usage and logs: features used, API requests, timestamps, IP address and error reports, used to run, secure and improve the Services.
• Website: basic analytics and cookies as described below.

• To provide the Services, including grouping, costing, coding suggestions and API access.
• To create and secure accounts, verify devices and prevent fraud or misuse.
• To respond to enquiries, deliver consultancy and training, and provide support.
• To send invoices and service, security and legal notices.
• To monitor performance, fix errors and improve the Services, using aggregated or de-identified data where possible.
• To send updates about workshops and products, only where you have agreed, with an easy way to opt out.
• To comply with legal obligations and respond to lawful requests.

We do not sell personal data, and we do not use Customer Data for advertising.

You can sign in to our apps and web services with your Google account. When you do, Google shares the following with us, only after you agree on Google's consent screen:

• your name and profile picture;
• your email address;
• your Google account ID.

We use this information only to create and sign in to your account, show your name in the app, and contact you about your account. We do not:

• sell Google user data or use it for advertising;
• share it with third parties, except service providers that host our Services;
• use it, or send it to any AI provider, to train or improve AI or machine-learning models;
• access your Gmail, Drive, Calendar, Contacts or any other Google data.

You can remove our access at any time from your Google Account under Security > Third-party apps & services. To delete the data we hold, see Deleting your account.

When you use AI Features, such as code suggestions in Casemix CodeAssist, only the clinical content needed for coding is processed by AI.

• Our AI provider is OpenAI (OpenAI, L.L.C., United States). The clinical content above is sent to OpenAI's API, through our own servers, to generate code suggestions and DRG answers.
• Under OpenAI's API data terms, data sent through the API is not used to train OpenAI's models. OpenAI may keep requests for up to 30 days to detect abuse, then deletes them.
• Your name, email, Google account details and device identifiers are never sent to OpenAI.
• Before you use AI Features for the first time, the app asks for your permission to send clinical content to OpenAI. If you decline, AI Features stay off and the rest of the app still works. You can change this later in the app's settings.
• We may keep AI requests and answers for a limited period for security, troubleshooting and quality checks.

We share personal data only where needed, with:

• Service providers who help us run the Services, such as cloud hosting, email delivery and analytics, under contracts that require them to protect the data.
• OpenAI, our AI provider, which receives only de-identified clinical content when you use AI Features, as described above.
• Your organisation, where your account is provided by a Customer, which can see and manage its users' activity.
• Professional advisers such as auditors and lawyers, under confidentiality.
• Authorities where required by law or to protect rights, safety and security.
• A buyer or successor in the event of a merger or acquisition, under the same protections.

Some of our service providers process data outside Malaysia. In particular, clinical content used for AI Features is processed by OpenAI in the United States. Where this happens, we take steps required by the PDPA so that the data receives a comparable level of protection, such as contractual safeguards and choosing reputable providers.

• Account data: for as long as your account is active, then for a limited period for legal, tax and dispute purposes.
• Customer Data: for the duration of the Customer's subscription and as instructed by the Customer, then returned or deleted after a reasonable export period, subject to legal requirements.
• Logs and AI request records: for a limited period for security and troubleshooting.
• Enquiries and training records: as long as needed to respond and to issue certificates or HRD Corp claims.

You can delete your account and the personal data linked to it at any time:

• In the app: go to Settings > Account > Delete account.
• On the web: use our account deletion page, without needing the app.
• By email: write to info@casemix.com.my from the email address on your account.

We delete your account, profile, Google sign-in details, device records and saved coding history within 30 days of your request. Copies in backups are removed within a further 90 days.

We may keep some records where the law requires it, such as invoices and payment records for tax purposes, and anonymised usage statistics that no longer identify you.

If your account was provided by your organisation, your organisation's administrator may need to approve the request, and data your organisation owns stays with it.

Our mobile apps only ask for device permissions that a feature needs, and you can turn them off at any time in your device settings.

• Internet access: needed to sign in, group episodes and use AI Features.
• Notifications (optional): for account, security and service messages.

Our apps do not access your location, contacts, photos, camera or microphone unless a future feature clearly asks for it and you allow it.

We use technical and organisational measures to protect personal data, including encryption in transit, access controls, device-bound authentication for mobile apps, secure API keys and regular review of access.

No system is completely secure. If a breach affects your personal data, we will notify affected Customers and individuals, and the authorities where required, without undue delay.

Under the PDPA, you may:

• request access to the personal data we hold about you;
• ask us to correct inaccurate, incomplete or outdated data;
• withdraw consent or limit how we process your data, including for marketing and AI Features;
• delete your account, as described in Deleting your account;
• ask questions or raise a concern about how we handle your data.

To make a request, email info@casemix.com.my. We may need to verify your identity. For Customer Data, we will refer your request to the relevant organisation. More detail is in our PDPA Policy.

Our website uses two kinds of cookies and similar storage:

• Essential: needed for the site to work, such as remembering your cookie choice. These are always on.
• Analytics: anonymous statistics about how pages are used, so we can improve the site. These are only used if you allow them.

When you first visit, we ask for your choice. You can change it at any time using Cookie settings at the bottom of every page, or by clearing cookies in your browser. Our mobile apps do not use advertising trackers.

Our Services are intended for people aged 18 and over. We do not knowingly collect personal data from children. If we learn that we have, we will delete it.

Our website and apps may link to other sites, such as Relify, app stores or map services. Their privacy practices are governed by their own policies.

We may update this Policy from time to time. We will update the "Last updated" date and notify users of significant changes by email or within the Services.

Casemix Solutions Sdn. Bhd.
Lot 1-15 MKH Boulevard, Jalan Changkat, Bandar Kajang, 43000 Kajang, Selangor Darul Ehsan, Malaysia
info@casemix.com.my · +60 10-354 6921