AI & Responsible Use

This AI & Responsible Use Policy explains how artificial intelligence features in Relify are intended to be used, what users remain responsible for, and the safeguards that apply when AI reads authorised information, generates outputs or performs an operational action.

It applies to Customers and Authorised Users of Relify, including clinic owners, branch administrators, healthcare professionals and other staff who are permitted to access an AI Feature. It should be read together with the Terms of Service, Privacy Policy, PDPA Statement, and where applicable the Customer’s Data Processing Addendum.

The exact AI capabilities available to a Customer depend on the subscription plan, role permissions, branch or group scope, feature configuration and the functionality that Relify has enabled at the relevant time.

Relify separates operational AI from clinical decision-support so that each is used in the appropriate context.

The separation is deliberate. Operational AI may support clinic administration and business workflows, while patient-specific clinical reasoning and clinical decision support must remain within the controlled EMR clinical context.

The Relify Assistant is designed to help authorised users understand and operate their clinic more efficiently. Subject to plan and permission controls, users may ask it to:

• check operational status, counts, trends, exceptions and other information available within their authorised scope;
• answer questions about appointments, queue operations, billing, invoices, claims, expenses, accounting, inventory, procurement, suppliers, packages, branch performance and other enabled modules;
• compare branches or periods and explain material changes, anomalies or performance drivers where relevant data is available;
• summarise authorised operational information and prepare management-ready explanations;
• generate reports and, where supported, downloadable spreadsheet or other exports;
• prepare or carry out enabled operational tasks when the user expressly asks the Assistant to do so; and
• use prior conversation context where that capability is enabled to understand a follow-up request.

The Assistant is not a substitute for the Customer’s own approval processes, accounting controls, inventory controls or staff supervision. A user should not instruct it to take an action that the user would not be authorised to perform directly in Relify.

Where enabled, the Assistant can do more than return text. It may invoke approved Relify workflows or tools in response to a user instruction. Examples may include creating or updating operational records, performing stock-related actions, carrying out invoice-related operations, preparing exports or reports, or initiating another supported workflow.

An AI-performed action is treated as an action initiated through the account of the Authorised User who requested it. The action remains subject to the same Customer scope, branch scope, role and permission restrictions that apply to that user.

AI interpretation can be imperfect. Before requesting a consequential action, users should give clear instructions and review the target, quantity, date, amount, record, branch or other important parameter. Relify may refuse, narrow or ask for confirmation when a request is ambiguous, unsupported, unsafe or outside the user’s authority.

The Assistant may generate narrative summaries, tables, management reports, XLSX or other supported exports from authorised Relify data. Generated reports can help users investigate performance, stock, billing, finance, operations and other business topics.

Reports and analyses are generated from the data available to the Assistant at the time of the request. They can be affected by missing records, incorrect source data, date filters, branch scope, delayed integrations, user permissions or model error.

Users must verify material figures against the underlying Relify records before relying on an AI-generated report for statutory reporting, tax, financial statements, insurance or payer submissions, procurement commitments, disciplinary decisions, contractual commitments or another consequential purpose.

AI access follows Relify access. The Assistant should only retrieve or act on information that the authenticated user is permitted to access under the Customer’s configured roles, branch assignments, group scope and feature permissions.

• Branch users should not receive data from branches outside their permitted scope.
• HQ or group-level users may receive cross-branch information only where their assigned role and permissions allow it.
• Plan restrictions and module permissions continue to apply when the same function is requested through AI.
• Customers are responsible for configuring and periodically reviewing user roles and permissions.

Users must not attempt to obtain restricted information by rephrasing a prompt, using indirect instructions, asking the model to ignore permissions or otherwise attempting to circumvent Relify’s access controls.

Relify may require an additional confirmation step before an AI-initiated action that is destructive, difficult to reverse, financially material, unusually broad or otherwise sensitive. The types of actions that require confirmation may change as the platform evolves.

A confirmation screen or prompt is a safety mechanism, not a substitute for the user’s own review. The user remains responsible for checking the action before confirming it.

Relify may also block or require a user to complete an action directly in the relevant module where the requested operation is not suitable for AI execution.

Relify’s patient-specific Clinical AI is confined to the EMR clinical workflow. It is designed to assist a qualified healthcare professional who is already reviewing or documenting a patient encounter.

Depending on the plan and enabled feature set, Clinical AI may assist with:

• generating a draft visit summary from information available in the current clinical encounter;
• suggesting potentially relevant ICD-10 or ICD-11 codes for clinician review; and
• analysing clinical information presented in the EMR to help the clinician identify points that may warrant review.

The general Relify Assistant is not intended to provide patient-specific clinical diagnosis, treatment decisions or medical decision support outside this EMR Clinical AI context. Operational AI should not be used as a workaround to obtain clinical advice.

Relify does not intend the general Assistant to independently write or save a completed clinical record on behalf of a clinician. Final clinical documentation and any clinically significant information incorporated into the EMR remain subject to the responsible healthcare professional’s review and the applicable EMR workflow.

Clinical AI outputs are decision-support and drafting aids. They are not a diagnosis, prescription, medical order, medical device determination, treatment plan or substitute for professional judgment merely because they appear in Relify.

A qualified healthcare professional must review relevant source information and independently determine whether an AI output is correct and appropriate for the patient before relying on it in clinical care. This includes verifying:

• diagnoses and differential diagnoses;
• ICD codes and coding rules;
• medication, allergy, contraindication and interaction information;
• summaries and statements attributed to a patient encounter;
• clinical measurements, timelines and context; and
• any recommendation or inference that could influence care.

Customers and healthcare professionals remain responsible for patient care, medical records, informed consent, professional standards and any legal or regulatory duties that apply to the practice of medicine.

AI systems can produce inaccurate, incomplete, outdated, inconsistent or misleading output, including confident-sounding output that is wrong. AI may also misunderstand a user’s request or fail to account for information that was not available in its context.

Users must apply appropriate professional or operational judgment and verify material output before acting on it. The level of verification should increase with the potential consequence of an error.

Relify may use rules, deterministic application logic, database queries and approved tools alongside generative AI. A response produced with a tool can still be wrong if the request was interpreted incorrectly or the source data itself is inaccurate.

When an Authorised User invokes an AI Feature, Relify may process the information reasonably necessary to understand the request and produce the requested result. Depending on the feature, this may include:

• the user’s prompt and relevant conversation context;
• user identity, role, permissions, branch or group scope and other access-control context;
• authorised operational records retrieved from Relify;
• for Clinical AI only, relevant patient and encounter information from the EMR clinical context;
• results returned by approved Relify tools or workflows;
• generated AI output; and
• technical, safety, usage and audit information needed to operate and secure the feature.

Relify should limit the context supplied to an AI Feature to information reasonably relevant to the requested task. Users should likewise avoid placing unrelated personal data, credentials, secrets or unnecessary sensitive information in a prompt.

AI does not reduce the privacy obligations that otherwise apply to personal data in Relify. Personal data used by AI remains subject to applicable data-protection requirements, the Customer’s instructions where Casemix acts as processor, and the safeguards described in Relify’s privacy documentation.

Health information and certain other data can constitute sensitive personal data under Malaysia’s Personal Data Protection Act 2010 (Act 709). Customers must ensure that they have an appropriate legal basis or applicable condition for processing such information and must limit AI use to authorised healthcare or operational purposes.

Our Privacy Policy explains Relify’s broader privacy practices, and our PDPA Statement provides the Malaysia-focused notice. Where an AI service provider processes Customer Data on our behalf, it is handled as a service provider or subprocessor subject to the applicable contractual and technical arrangements.

Not every AI-assisted function is automated decision-making or profiling. Many Relify AI functions respond to a user’s request, summarise information or assist a human user who remains responsible for the decision.

Where a Relify deployment or Customer workflow uses AI in a way that constitutes automated decision-making or profiling involving personal data, the responsible party must assess and implement the safeguards required by applicable law and guidance. This may include appropriate notices, data-protection impact assessment, human review, consent or another applicable condition, and mechanisms for individuals to exercise relevant rights.

Clinical AI is specifically designed as human-reviewed decision support rather than a system that independently determines a patient’s diagnosis, treatment eligibility or outcome.

Where technically supported, Relify may maintain audit and safety records associated with AI use. For an AI-assisted operational action, these records may include the initiating user, prompt or instruction, relevant scope, confirmation event, tool or workflow invoked, result, timestamp and error or cancellation state.

Audit information helps Customers and Casemix investigate unexpected changes, demonstrate accountability, troubleshoot failures, detect abuse and understand which user initiated an AI-assisted action.

Customers should not treat an AI chat transcript as the sole authoritative system of record for an operational or clinical event. The applicable Relify module, EMR record, transaction record, audit log or generated report remains the appropriate source to verify what was ultimately saved or executed.

Users must not use Relify AI to:

• circumvent authentication, permissions, plan controls, branch restrictions or security safeguards;
• access, disclose or infer personal data that the user is not authorised to access;
• impersonate another user or falsely attribute an AI-assisted action to another person;
• make an unauthorised change to patient, financial, inventory, billing or other Customer records;
• use the general Assistant to obtain patient-specific diagnosis, treatment or medical decision support outside Clinical AI in the EMR;
• make solely automated high-impact decisions about patients, employees or other individuals contrary to applicable law or Customer policy;
• generate or distribute unlawful, fraudulent, deceptive, discriminatory, harassing or malicious material;
• introduce malware, exploit prompts, hidden instructions or content designed to compromise Relify or a connected system;
• extract model secrets, system prompts, credentials, tokens or confidential security information; or
• use the Service in any manner prohibited by the Terms of Service or applicable law.

Casemix may restrict or suspend an AI Feature where reasonably necessary to protect patients, users, Customers, the Service or third parties.

AI features create additional security considerations because prompts and retrieved information can influence model behaviour. Relify may therefore apply input validation, permission checks, tool restrictions, output handling, confirmation gates, logging, rate limits and other safeguards.

Users should treat instructions contained in uploaded files, external messages, websites or other untrusted content as potentially unsafe. Content that tells the AI to ignore policy, reveal confidential data or perform an unrelated action should not be treated as authorised merely because it appears in data being analysed.

Users must never enter passwords, API secrets, private keys or authentication tokens into an AI prompt unless a Relify workflow expressly requires and securely handles that information.

AI Features may be subject to plan-specific usage allowances, token or model-consumption limits, rate limits, fair-use restrictions, pooled group limits or other technical controls disclosed in the applicable plan or Order Form.

AI availability can also depend on model providers, network services, maintenance, feature rollout, safety controls and the Customer’s configuration. Casemix may change the underlying model, routing, prompt design, tool implementation or safety controls where reasonably necessary to improve quality, security, compliance, performance or cost efficiency.

Reaching an AI usage allowance may limit additional AI processing without preventing access to non-AI functionality, subject to the applicable plan and Service design.

Relify may use third-party AI, cloud, infrastructure or security providers to deliver AI Features. Where such a provider processes personal data on our behalf, we treat that provider in accordance with the applicable contractual role and our data-processing obligations.

The providers used in production, their purpose and relevant processing information should be reflected in Relify’s Subprocessors information. Customers should review that page together with the Privacy Policy and any applicable Data Processing Addendum.

We do not make an absolute public promise about model-training or retention practices unless the applicable production configuration and provider contract support that promise. Any specific statement about whether Customer Data is used for general-purpose model training should be read together with the then-current Subprocessors information and applicable Customer agreement.

AI capabilities change quickly. Casemix may add, remove, limit or modify AI Features, supported actions, underlying models, tool integrations, confirmation requirements or safety controls as Relify develops.

We may update this Policy when there is a material change to how Relify AI operates, our legal obligations or our risk controls. The “Last updated” date at the top identifies the current version. Where required by law or contract, we will provide additional notice of material changes.

Users should report an AI issue when an output appears materially incorrect, unsafe, privacy-invasive, clinically concerning, discriminatory, or when an AI-assisted action did not match the user’s instruction.

When reporting an issue, provide enough information for us to investigate, such as the approximate time, affected module, user account, branch, conversation or action reference and a description of what occurred. Do not send additional patient information through an insecure channel merely to explain the problem.

Before publication, confirm that these mailboxes are active and routed to the appropriate operational owners.

This Policy is intended to explain the responsible-use rules and safeguards specifically applicable to AI. It does not replace the Terms of Service, Privacy Policy, PDPA Statement, Data Processing Addendum, Customer Order Form, professional obligations or applicable law.

If a Customer agreement imposes stricter AI, privacy, security, clinical or approval requirements, the stricter contractual requirement applies to that Customer to the extent provided in the agreement. If applicable law requires a safeguard that is not stated here, the legal requirement still applies.

References to features or examples in this Policy do not guarantee that every feature is included in every subscription plan or generally available at all times.

Questions about this Policy or Relify AI may be directed to Casemix Solutions Sdn Bhd. through the relevant contact below.

For a patient-specific medical-record or care question, patients should generally contact the healthcare provider or clinic that controls the relevant record rather than using Relify’s legal or product-support address as a clinical channel.