Data Processing Addendum

This Data Processing Addendum (the “DPA”) forms part of the agreement governing the Customer’s use of Relify (the “Agreement”) where Casemix Solutions Sdn Bhd. (“Casemix”, “Relify”, “we” or “us”) processes Personal Data on behalf of the Customer.

This DPA applies only to processing for which Casemix acts as a data processor on behalf of the Customer as data controller. It does not convert processing that Casemix independently determines for its own lawful purposes into processor activity.

Capitalised terms not defined in this DPA have the meanings given in the Agreement. References to Data Protection Law include the Malaysian Personal Data Protection Act 2010 (Act 709), as amended, applicable regulations, binding codes, orders and requirements of the Personal Data Protection Commissioner, and any other data-protection law that applies to the relevant processing.

For Customer Personal Data processed to provide Relify:

• Customer is the data controller. Customer determines the purposes of processing, who may access the data, which modules and integrations are used, applicable retention decisions, and the instructions given to Casemix through the Agreement and the Service.
• Casemix is the data processor. Casemix processes Customer Personal Data on behalf of Customer to host, secure, support and operate Relify and to perform the Customer’s documented instructions.
• Each party remains responsible for the duties that Data Protection Law places directly on that party. Nothing in this DPA transfers a statutory obligation that cannot lawfully be transferred.

If a particular processing activity makes the parties’ roles different from the general allocation above, the role is determined by the facts and applicable law rather than the label used in this DPA.

Casemix will process Customer Personal Data only on documented instructions from Customer, except where processing is required by applicable law. Customer’s documented instructions include:

• the Agreement, this DPA and the Customer’s order or subscription;
• the Customer’s use and configuration of Relify modules, permissions, branches, integrations and retention/export features;
• actions and requests submitted by Authorised Users through Relify, including through the Relify Assistant where an AI-enabled operation is supported;
• support, migration, import, export or technical requests made by authorised Customer representatives; and
• additional written instructions accepted by Casemix.

If Casemix reasonably believes an instruction violates applicable Data Protection Law, Casemix may notify Customer and suspend the affected processing to the extent reasonably necessary while the parties clarify the instruction. Casemix is not required to provide legal advice to Customer.

Customer is responsible for ensuring that its instructions and use of Relify comply with Data Protection Law and healthcare obligations applicable to the Customer. This includes, as applicable:

• having a lawful basis and providing required notices or obtaining required consent or authorisation for the personal data Customer places in Relify;
• ensuring that sensitive personal data, including health information, is collected and used lawfully;
• configuring appropriate user roles, branch access and permissions and promptly removing access that is no longer required;
• responding to data-subject requests where Customer is the relevant controller;
• determining lawful retention periods for medical, financial, employment and other Customer records;
• ensuring information supplied to Casemix is relevant to the requested service and not unlawfully collected; and
• reviewing the legal and clinical suitability of AI-enabled workflows before enabling them for staff.

Customer must not instruct Casemix to process Personal Data for a purpose that is unlawful or materially outside the Service.

Casemix will limit access to Customer Personal Data to personnel and authorised contractors who need access to provide, secure, maintain or support the Service or comply with lawful obligations.

Persons authorised to process Customer Personal Data will be subject to appropriate confidentiality obligations and will receive access appropriate to their functions. Casemix will maintain internal access controls intended to prevent unauthorised access, use or disclosure.

Casemix will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the data, the risks of processing and the state of technology.

The security framework may include, as appropriate to the relevant component of Relify, authentication and session controls, role- and branch-based access restrictions, cryptographic protections, logging and monitoring, environment and service-access controls, backup and recovery processes, vulnerability and patch management, incident response, personnel controls and subprocessor diligence.

Casemix may update security measures as technologies and risks evolve, provided that the overall level of protection for Customer Personal Data is not materially reduced during the term of the Agreement. Schedule B describes the security framework at a contractual level without disclosing security-sensitive implementation details.

Where Customer enables or uses an AI Feature, Customer instructs Casemix to process the information reasonably necessary to provide that feature, subject to the Customer’s plan, permissions and authorised scope.

AI prompts, retrieved context, generated outputs, reports and tool/action records that contain or derive from Customer Personal Data are treated as Customer Personal Data for purposes of this DPA. AI does not expand an Authorised User’s permissions or branch scope.

Casemix will not sell Customer Personal Data or use it for unrelated advertising. Any third-party AI infrastructure used to provide an AI Feature is governed by the subprocessor provisions of this DPA and the current Subprocessors information.

Customer authorises Casemix to engage subprocessors to process Customer Personal Data as necessary to provide Relify, including providers of hosting, storage, database, communications, security, support, payment/integration infrastructure and AI processing where applicable.

Casemix will:

• maintain contractual protections with subprocessors that are appropriate to the processing they perform;
• require subprocessors to protect Customer Personal Data in a manner consistent with applicable Data Protection Law and Casemix’s obligations under this DPA;
• remain responsible to Customer for the performance of its DPA obligations where those obligations are carried out through a subprocessor, subject to the Agreement; and
• maintain a current Subprocessors page or other reasonable mechanism identifying material subprocessors.

Where Casemix introduces a material new subprocessor that will process Customer Personal Data, Casemix will provide reasonable notice through the Service, the Subprocessors page, email or another appropriate channel. Customer may raise a reasonable, documented data-protection objection. The parties will work in good faith to address the concern; if no reasonable alternative is available, the parties may discontinue the affected processing or feature in accordance with the Agreement.

Customer acknowledges that Relify may use infrastructure or subprocessors that process Customer Personal Data outside Malaysia. Casemix will make such transfers only where permitted by applicable Data Protection Law and will implement or require appropriate safeguards applicable to the transfer.

Customer authorises transfers necessary to provide the Service to the locations identified through the current Subprocessors information, subject to this DPA. Where Customer has additional lawful transfer requirements, Customer should notify Casemix before enabling the affected integration or processing activity.

If Casemix becomes aware of a confirmed Personal Data Breach affecting Customer Personal Data for which Casemix acts as processor, Casemix will notify Customer without undue delay and provide information reasonably available to Casemix to assist Customer with its assessment and legally required notifications.

Information may include, as reasonably available, the nature of the incident, categories of data and data subjects affected, likely consequences, containment or remediation measures, and a contact point for follow-up. Information may be supplied in phases as the investigation develops.

Casemix will take reasonable steps to contain, investigate and remediate a breach within its systems. Customer remains responsible for determining whether and how it must notify the Personal Data Protection Commissioner, affected data subjects or other authorities when Customer is the controller, although Casemix will provide reasonable cooperation.

Notification under this section is not an admission of fault or liability.

Taking into account the nature of the processing, Casemix will provide reasonable assistance to Customer with requests by data subjects to exercise rights that apply to Customer-controlled Personal Data, including access, correction and data portability where applicable.

Where Casemix receives a request directly concerning Customer-controlled Personal Data, Casemix may refer the requestor to Customer or forward the request to Customer unless applicable law requires Casemix to respond directly. Casemix will not independently alter or release a patient’s Customer-controlled medical record without Customer instruction or another lawful basis.

Taking into account the nature of processing and information available to Casemix, Casemix will provide reasonable information and assistance to help Customer meet applicable obligations relating to:

• security of processing and assessment of Personal Data Breaches;
• data-protection impact assessments or comparable risk assessments where required;
• consultation with a competent authority where legally required;
• Customer privacy notices and records of processing insofar as they concern Relify; and
• verification of relevant processor safeguards.

Assistance beyond standard documentation or support may be subject to reasonable fees where it requires significant custom work, provided Casemix informs Customer in advance where practicable.

If Casemix receives a legally binding demand from a court, regulator or public authority for Customer Personal Data, Casemix may disclose only the information it is legally required to provide.

Where legally permitted, Casemix will notify Customer of a request directed specifically at Customer Personal Data so that Customer may seek protective measures or otherwise respond. Casemix may preserve data where legally required to do so.

During the term, Relify may provide Customer with export functionality for supported records and reports. Customer is responsible for completing required exports before termination and for preserving records that Customer is legally or professionally required to retain.

Following termination or expiry of the Agreement, Casemix will delete or return Customer Personal Data in accordance with the Agreement and its applicable deletion and backup lifecycle, unless continued retention is required by law or reasonably necessary to establish, exercise or defend legal claims.

Customer Personal Data may remain temporarily in backups or disaster-recovery copies until those copies are overwritten or expire in the ordinary course. During that period the data remains subject to applicable confidentiality and security protections and will not be restored for ordinary business use except where required for recovery, security, legal compliance or similar legitimate purposes.

Casemix will make available information reasonably necessary to demonstrate compliance with this DPA, which may include security documentation, policies, questionnaires, independent assessment summaries or other appropriate evidence.

If such information is insufficient for a legal requirement applicable to Customer, Customer may request an additional audit relating specifically to Casemix’s processing of Customer Personal Data. Any audit must:

• be subject to reasonable advance notice and confidentiality obligations;
• occur no more than once in a 12-month period unless required by law, a regulator or a material security incident;
• avoid access to other customers’ data, source code, penetration-test details or information that would create a security risk;
• be conducted during normal business hours and minimise disruption; and
• use existing third-party reports or remote evidence where those can reasonably satisfy the request.

Customer bears its own audit costs and, where an audit creates material additional cost for Casemix, the parties may agree reasonable charges in advance unless applicable law requires otherwise.

This DPA does not apply to Personal Data for which Casemix independently determines the purposes and means of processing. Depending on the context, this may include limited business-contact, subscription administration, billing administration, security, abuse-prevention, service telemetry, support administration, website or legal-compliance information.

Such processing is governed by the Privacy Policy and PDPA Statement, as applicable. Casemix will not treat Customer’s patient records or clinical content as Casemix-controlled data merely because they are hosted in Relify.

The liability limitations, exclusions, governing-law provisions and dispute terms in the Agreement apply to this DPA except to the extent applicable law requires otherwise.

If this DPA conflicts with the Agreement on the processing or protection of Customer Personal Data, this DPA controls to the extent of that conflict. If a separately executed data-protection schedule expressly states that it overrides this DPA, that executed schedule controls for the processing it covers.

Nothing in this DPA limits a statutory right or obligation that cannot lawfully be limited by contract.

Casemix may update this DPA to reflect changes in law, regulatory guidance, Relify’s processing practices or security arrangements. Casemix will not materially reduce the protections for Customer Personal Data during an active subscription without reasonable notice, except where a change is required by law or necessary to address an urgent security issue.

The “Last updated” date identifies the current public version. Material changes may be communicated through the Service, email, the Trust & Legal Center or another reasonable channel.

Nature and purposes. Clinic administration; patient registration and records; EMR and clinical workflows; appointments and queue; pharmacy and laboratory workflows; inventory and procurement; invoicing, expenses, accounting, tax and payer/claims workflows; messaging and notifications; analytics and reports; multi-branch/HQ management; authorised support and migration; operational AI; and Clinical AI within the EMR where enabled.

Categories of data subjects. Patients, including children and minors; parents, guardians or family contacts; doctors, locums, nurses, receptionists, administrators and other clinic personnel; Customer representatives; supplier or vendor contacts; payer, insurer, TPA, corporate or government-contact persons; and other individuals whose Personal Data Customer lawfully places in the Service.

Categories of Personal Data. Identity and contact information; identifiers such as MRN, national identification or passport information where entered; demographic and appointment information; user/account/role information; audit and activity records; clinical notes, diagnoses, ICD codes, allergies, chronic conditions, vitals, growth information, prescriptions, medications, lab information, files and other medical records; pharmacy and dispensing information; queue and visit information; invoice, payer, claim and transactional information; inventory/supplier contact information; communications; reports and analytics; and AI prompts, retrieved context, outputs and action logs.

Sensitive Personal Data. Customer Personal Data may include health information and other sensitive personal data protected by Malaysian law. Customer must use Relify consistently with the legal requirements applicable to sensitive personal data.

Casemix’s security programme is risk-based and may evolve. The measures relevant to a particular Relify component may include:

• Identity and access: authentication controls, role-based access, branch/group scoping, least-privilege administration and access revocation processes;
• Application safeguards: permission checks, secure session handling, input validation and controls intended to limit unauthorised data access;
• Data protection: cryptographic protections where appropriate, controlled storage access, backup/recovery processes and safeguards against accidental loss;
• Monitoring and accountability: logging, audit records, operational monitoring and investigation capability appropriate to the relevant service;
• Infrastructure and vulnerability management: hosting/provider controls, patching and dependency management, vulnerability remediation and environment access restrictions;
• Incident response: procedures to identify, contain, investigate, remediate and communicate security incidents;
• People and vendors: confidentiality obligations, access appropriate to job responsibilities and due diligence/contractual controls for material subprocessors; and
• AI safeguards: permission-scoped retrieval, feature separation between operational Assistant and Clinical AI, supported-tool restrictions, auditability of AI-performed operations and human review requirements for clinical output.

Security information that would materially increase risk if publicly disclosed may be provided under confidentiality rather than published on this page.

Questions about this DPA or processor safeguards may be directed to:

Enterprise Customers requiring a separately signed DPA or security questionnaire may contact the appropriate Relify representative.