Privacy Policy

This Privacy Policy explains how Casemix Solutions Sdn Bhd. (“Casemix”, “Relify”, “we”, “us” or “our”) handles personal data in connection with the Relify clinic management platform, our websites, support channels, sales and account administration, and related services.

Relify is primarily a business-to-business healthcare software service. This means the same platform can contain information for which a clinic or healthcare organisation decides the purpose of processing, and information that Casemix processes for its own account, security, support and business administration.

This Policy applies to clinic owners, authorised staff, healthcare professionals, patients whose data is processed through Relify, patient-portal users where available, business contacts, website visitors and other individuals whose personal data is handled in connection with the Service.

It does not replace a clinic’s own privacy notice to its patients, nor does it change the clinic’s professional, statutory or contractual responsibilities for medical records and patient care.

Our privacy responsibilities depend on why personal data is being processed.

Some activities can involve more than one role. For example, a clinic controls the medical purpose of a patient record while Casemix may separately control limited account-security or service-telemetry data generated when an authorised user accesses Relify. The applicable role is assessed by reference to the specific processing activity.

If you are a patient and your request concerns the content of your medical record, your clinic will usually be the correct first point of contact because it controls the clinical purpose and record.

Depending on the features used, Relify may process the following categories of personal data:

• Clinic and organisation data: clinic name, branch information, registration or business information, billing contacts, subscription details and authorised representatives;
• User and professional data: name, work email, phone number, user ID, role, permissions, professional title, registration or credential information where provided, branch assignments and account status;
• Authentication and security data: session identifiers, authentication events, security logs, IP address, device/browser information, timestamps, access records, suspected-abuse indicators and, for connected services, OAuth access/refresh tokens or comparable provider credentials. Provider credentials are treated as confidential security data and are stored in protected or encrypted form rather than exposed in ordinary user interfaces;
• Patient identity and demographic data: name, date of birth, sex or gender information where recorded, identification or passport details where collected by the Customer, address, contact details, emergency contacts and related-person information;
• Health and medical data: medical history, allergies, chronic conditions, diagnoses, ICD codes, medications, prescriptions, clinical notes, visit summaries, vitals, growth information, attachments, laboratory information, referral documents, images, files and other information forming part of a patient record;
• Appointments and care-flow data: bookings, appointment type, clinician assignment, check-in, queue status, consultation timing, no-show or cancellation information and related workflow events;
• Billing, payer and financial workflow data: invoices, payment status, payment method, claim or payer information, panel/TPA/corporate details, discounts, taxes, deposits, receipts and transaction references;
• Pharmacy, inventory and operational data: dispensing records, stock movements, batch details, supplier contacts, procurement records, package usage and related operational activity;
• Communications and connected-channel data: support requests; connected mailbox and account identifiers; sender, recipient and CC fields; email subjects, message bodies, HTML or plain-text content, attachments and inline media; thread/message identifiers, timestamps and mailbox/folder indicators; Facebook Page identifiers and names; Instagram business account identifiers and usernames; Messenger or Instagram sender identifiers, message content and attachments; postbacks, reactions where enabled, delivery/read/echo events and webhook events; WhatsApp business and phone identifiers and message events; and other communications sent through integrations where enabled;
• AI-related data: prompts, questions, selected context, retrieved records, AI-generated outputs, tool/action requests, confirmations, tool results, safety events and associated audit information;
• Website and usage data: pages visited, referral information, browser/device attributes, preference information and analytics or diagnostic events where such collection is enabled; and
• Other information: information a Customer or individual chooses to provide through configured fields, uploads, integrations or support channels.

Not every Customer uses every Relify module, and not every data category is collected in every deployment.

We may receive personal data directly from you, from the Customer that provides your healthcare or employs or engages you, from another authorised user acting for that Customer, or from systems connected to Relify.

Sources may include:

• clinic staff entering or uploading patient and operational information;
• patients submitting information to a clinic, online booking flow or patient-facing feature;
• existing clinic records imported or migrated into Relify;
• laboratories, pharmacies, payers, insurers, TPAs, corporate panels or other parties where the Customer lawfully receives and records that information;
• third-party integrations enabled by the Customer;
• payment, messaging, email or identity providers used to deliver configured features;
• our own websites, support interactions and account administration; and
• technical events automatically generated when the Service is accessed or used.

Customers are responsible for ensuring they have the authority to provide personal data to Relify and for giving any patient, employee or other notice required for the Customer’s own processing.

Casemix uses or processes personal data only for purposes connected with operating Relify, carrying out Customer instructions, protecting the Service and meeting applicable legal obligations. Depending on context, those purposes may include:

• providing, hosting, maintaining and supporting the Relify platform;
• creating and securing accounts, sessions, branches, roles and permissions;
• supporting patient registration, EMR, appointments, queue, pharmacy, laboratory, billing, claims, inventory, accounting, reporting and related clinic workflows;
• generating documents, reports, exports and operational records requested by authorised users;
• providing AI-assisted features when invoked by authorised users;
• processing subscription, billing and payment administration;
• sending service, security, support and transactional communications;
• detecting, investigating and preventing fraud, abuse, unauthorised access and security incidents;
• maintaining audit trails, system integrity, backups, resilience and disaster recovery;
• diagnosing errors, improving reliability and developing or testing Service functionality using data appropriate for that purpose;
• meeting contractual, regulatory, tax, accounting, legal and dispute-resolution requirements; and
• creating aggregated or de-identified information as described below.

Where consent or explicit consent is required under applicable law for a particular activity, the responsible party must obtain that consent before the relevant processing occurs. Where Casemix acts only as a processor, we rely on the Customer to identify and satisfy the legal basis or condition applicable to its processing.

Health information is sensitive personal data. Relify is designed to process such information only in the context of authorised healthcare and clinic operations.

Customers decide what patient and clinical information is entered into Relify, who within their organisation may access it, how long it should be retained and how it may lawfully be disclosed. Customers must configure roles and permissions appropriately and must not grant access merely for convenience.

Casemix personnel do not require routine access to patient clinical content to operate the Service. Where access is reasonably necessary for support, security, incident investigation, migration or another authorised purpose, access should be limited to the scope and duration needed and handled under applicable confidentiality and access-control procedures.

Relify is not the healthcare provider and does not become the owner of a patient’s clinical record merely because the record is stored or processed through the platform.

Relify includes AI-assisted functionality for both operational and clinical workflows. The exact features available depend on the Customer’s plan, permissions and configuration.

Operational AI

The Relify Assistant may answer authorised business questions, retrieve and analyse clinic information, generate explanations or reports, prepare exports, and, where enabled, initiate or perform permitted operational actions in response to an authorised user’s instruction.

Clinical AI

Clinical AI features may process relevant visit information to generate items such as visit summaries, ICD-10/ICD-11 suggestions or clinical analysis. These are decision-support outputs. They are not a substitute for professional medical judgment, and a qualified healthcare professional remains responsible for reviewing clinical information before relying on it or incorporating it into care.

What is processed when AI is used

When an authorised user intentionally invokes an AI Feature, Relify may select and transmit the information reasonably necessary to answer the request or perform the requested workflow. Depending on the feature, this may include prompt text, authorised clinic records, patient or clinical information, metadata, tool results and the generated response.

AI processing may involve third-party infrastructure providers acting as service providers or subprocessors. Additional information about such providers, their purpose and relevant processing locations is maintained on our Subprocessors page and, where appropriate, in our AI & Responsible Use information.

Google Workspace data and AI

Google Workspace data obtained through Google APIs is not sold, used for advertising, used to determine creditworthiness or lending eligibility, or used to create, train or improve a generalised machine-learning or artificial-intelligence model. Connecting a Gmail or Google Workspace mailbox does not by itself cause mailbox content to be included in Relify AI prompts or model context. If Relify offers a user-facing feature that intentionally processes Google Workspace data with AI, the processing will be limited to the data reasonably necessary for the user-requested feature and will be handled in accordance with the applicable Google user-data policies, required user consent and our disclosed service-provider arrangements.

Relify is not intended to make a solely automated clinical decision that replaces the responsible healthcare professional. Customers must not use AI outputs as the sole basis for a significant decision about a person where applicable law requires human involvement, transparency or other safeguards.

Where an AI Feature is allowed to carry out an operational action, Relify may process and retain information needed to establish what happened. This can include the authorised user, the instruction, relevant context, any confirmation requested, the tool or workflow used, the result, timestamp and related system events.

These records support security, troubleshooting, accountability, dispute investigation and audit requirements. An AI-assisted action remains subject to the initiating user’s permissions and does not grant the AI broader access than that user is authorised to exercise.

Relify may require explicit user confirmation before sensitive, consequential or destructive actions. Customers remain responsible for assigning suitable permissions and for ensuring that staff understand when review or confirmation is required.

Our public websites and web applications may use cookies, local browser storage or similar technologies for essential functions such as security, session management, navigation and preferences. Where enabled, we may also use analytics or diagnostic technologies to understand website performance and improve user experience.

Non-essential technologies, if used, will be handled in accordance with the choices and notices applicable to the deployment. Browser controls can also be used to limit or delete cookies, although disabling essential cookies may prevent parts of the Service from working correctly.

Relify does not use browser storage as a substitute for server-side controls for sensitive clinical records where doing so would create inappropriate privacy or security risk.

We do not sell Patient Data or Customer Data to data brokers or advertisers. We disclose personal data only where reasonably necessary for the Service, instructed by a Customer, permitted by the applicable agreement, or required or permitted by law.

Recipients may include:

• the Customer and its authorised users, branches and group entities, according to permissions and configured data-sharing rules;
• hosting, cloud, storage, backup, security, communications, support, payment and AI service providers that process information on our behalf;
• Customer-selected integrations such as messaging, email, payment, laboratory, payer or other platforms where the Customer enables the integration;
• professional advisers, auditors, insurers or consultants subject to appropriate confidentiality obligations;
• regulators, courts, law-enforcement authorities or public bodies where disclosure is required or permitted by law; and
• a successor or transaction counterparty in connection with a bona fide corporate restructuring, financing, acquisition or sale, subject to appropriate safeguards.

Our current service-provider categories and material subprocessors are described on the Subprocessors page. The list may change as infrastructure or features change.

The general recipient categories above do not override stricter provider-specific restrictions. In particular, Google Workspace data obtained through Google APIs is subject to the Limited Use restrictions described in the Google Workspace subsection below, and Meta Platform Data is handled subject to applicable Meta platform terms and data-use requirements.

Relify may connect to third-party services selected or enabled by a Customer, such as Google Workspace/Gmail, Microsoft 365/Outlook, Facebook Messenger, Instagram, WhatsApp, payment gateways, transactional email, laboratories, payer systems, online booking tools or other integrations.

When an integration is used, Relify may send or receive the information needed to perform the requested user-facing function. For example, a payment provider may receive payment and transaction details; a messaging provider may receive recipient contact information and message content; an email provider may provide authorised mailbox content for the shared inbox; or a laboratory integration may receive order and patient information required for the laboratory workflow.

Third-party platforms may process information under their own terms and privacy practices in addition to any role they perform as our or the Customer’s service provider. Customers are responsible for assessing and lawfully configuring integrations they choose to enable, including messaging consent, recipient selection and any patient-facing notices required for those channels.

Google Workspace and Gmail

When an authorised Customer administrator connects a Gmail or Google Workspace mailbox, Relify uses Google OAuth. Relify does not receive the user’s Google password. Depending on the scopes approved by the user, Relify may access the connected mailbox identity and email address, sender/recipient information, subjects, message bodies, HTML or plain-text content, attachments or inline content, message/thread identifiers, timestamps and other mailbox metadata needed to provide the shared inbox. Relify uses Gmail send access only when an authorised user deliberately sends or replies to an email from Relify.

Relify may store synced Google Workspace email content and metadata in the Customer’s Relify workspace only as reasonably necessary to provide the connected shared-inbox experience, thread history, reconciliation, search, security, audit and related user-facing functionality. OAuth access and refresh tokens are treated as confidential credentials and are encrypted or otherwise protected at rest. Google Workspace data is not sold, used for advertising, used for credit or lending decisions, or used to create, train or improve a generalised AI or machine-learning model.

Human access to Google Workspace data by Casemix personnel is not routine and is limited to circumstances permitted by Google policy, such as where the user has explicitly asked us to inspect specific data for support, where access is necessary for security or abuse investigation, where required by law, or where data has been aggregated and anonymised for permitted internal operations.

Google Limited Use disclosure. Relify’s use and transfer of information received from Google APIs and Google Workspace scopes will adhere to the Google API Services User Data Policy and the Google Workspace User Data and Developer Policy, including the Limited Use requirements.

Meta technologies: Facebook Messenger, Instagram and WhatsApp

When an authorised Customer administrator connects a Meta business asset, Relify may receive and process the identifiers and data needed for that connection, such as Facebook Page IDs and names, Instagram business account IDs/usernames, WhatsApp business or phone identifiers, sender or participant identifiers, profile/display information made available by the relevant API, message content and attachments, timestamps, postbacks, delivery/read/reaction/echo events, webhook events and access tokens. Relify does not receive the user’s Facebook or Instagram password.

We use Meta Platform Data only to connect the business asset selected by the Customer, display and reconcile conversations in the Relify shared inbox, route inbound communications, send replies or messages initiated by authorised users, maintain delivery/read state, maintain webhook subscriptions, secure the integration and troubleshoot service issues. We do not sell Meta Platform Data or use it for targeted advertising.

Meta access tokens and similar credentials are treated as confidential security data and are protected from ordinary user access. We process and delete Meta Platform Data in accordance with applicable Meta terms, Customer instructions and law. Where Meta requires Platform Data to be deleted because a user or Customer requests deletion, the data is no longer necessary, the integration is discontinued, or Meta itself requests deletion, we will delete or de-identify the relevant data without undue delay unless applicable law requires a specific record to be retained. Any legally required retention is restricted to that legal purpose and ends when the requirement expires.

Connected-service access, revocation and data deletion

Users and Customers have separate controls for stopping future provider access and for deleting data that has already been imported into Relify:

• Disconnect a channel: an authorised Customer administrator can go to Relify CRM → Channels and use the Manage/Disconnect control for the connected email or Meta channel. Disconnecting stops future synchronisation or messaging access and removes, invalidates or ceases use of the relevant provider credential where supported.
• Revoke at the provider: a Google user may also revoke Relify’s access through the Google Account third-party connections/security controls. A Facebook or Instagram user or business administrator may revoke the relevant app/business integration through Meta account or business settings. Provider-side revocation stops future API access but is separate from deletion of data that was previously imported into Relify.
• Delete previously imported Google or Meta data: an authorised Customer administrator or an affected individual may request deletion by emailing support@relify.com.my or legal@relify.com.my. Please identify the relevant clinic/organisation and connected mailbox, Facebook Page, Instagram account or other account sufficiently for us to locate the data. Where the data is controlled by a Customer, we may verify authority and coordinate the request with that Customer.
• What deletion means: subject to applicable law and legitimate record-retention duties, we will delete, de-identify or otherwise render inaccessible the relevant connected-service data without undue delay. If a legal, regulatory, professional or dispute-related obligation requires temporary retention, the retained data will be restricted to that purpose and deleted when the obligation ends.

Disconnecting a provider does not automatically erase historical messages that have already become part of the Customer’s Relify records. Historical data remains subject to the Customer’s configured retention obligations and the deletion process above. Where applicable, a Customer may request export or return of its data before deletion.

Relify may use cloud, communications, support, security or AI providers whose systems or personnel are located outside Malaysia. As a result, personal data may be processed or transferred across borders when necessary to provide a configured Service.

Where the Malaysian PDPA applies to a cross-border transfer, Casemix will use the transfer mechanism, assessment, contractual safeguards, consent or other condition required by applicable law for the relevant processing. We also expect Customers to consider their own cross-border obligations when they select integrations or instruct Relify to send data to an external provider.

Specific processing locations can change as providers update their infrastructure. Material provider information should therefore be read together with the current Subprocessors page rather than assumed from this Policy alone.

We retain personal data only for as long as reasonably necessary for the purpose for which it is processed, subject to legal, professional, tax, accounting, security, dispute, backup and contractual requirements.

For patient and clinical records, the Customer generally determines the applicable retention schedule because the Customer controls the healthcare purpose and must comply with its own professional and legal record-keeping duties. Relify provides tools and contractual processes intended to support export, retention, return and deletion, but the Customer remains responsible for deciding what records must be preserved.

After account closure or contract termination, Customer Data may remain for a limited period in active systems, recovery environments or backups before deletion in accordance with the applicable agreement, backup lifecycle and legal obligations. Backups may not be immediately editable or deletable on an individual-record basis, but data will age out through the applicable backup process unless preservation is legally required.

Casemix-controlled account, security, billing or support data may be retained for different periods where necessary for legitimate administration, security, dispute resolution or legal compliance.

Google Workspace data and Meta Platform Data are additionally subject to the provider-specific access, Limited Use and deletion requirements described in Section 11. Where those requirements call for earlier deletion than our general retention approach, the provider-specific requirement applies unless applicable law requires retention.

Casemix maintains administrative, organisational and technical safeguards designed to protect personal data from accidental or unlawful loss, misuse, unauthorised access, disclosure, alteration or destruction. Depending on the system and risk, measures may include authentication, role-based permissions, encryption, audit logging, environment separation, backups, monitoring, access reviews and incident-response procedures.

No internet-connected service can guarantee absolute security. Customers and authorised users also have responsibilities, including protecting credentials, using appropriate devices and networks, assigning only necessary permissions and promptly reporting suspected compromise.

If we become aware of a personal data breach, we will investigate, contain and remediate it as appropriate. Where Malaysian law or applicable Commissioner guidance requires notification to the Personal Data Protection Commissioner or affected individuals, we will make or support those notifications in the manner and timeframe required. When Casemix acts as a processor, we will provide the relevant Customer with information reasonably needed for the Customer’s own breach-response obligations.

Depending on the processing activity and subject to the Malaysian PDPA, applicable exceptions and other laws, you may have rights to:

• receive information about the processing of your personal data;
• request access to personal data;
• request correction of personal data that is inaccurate, incomplete, misleading or not up to date;
• withdraw consent by written notice where the processing relies on consent;
• prevent certain processing likely to cause damage or distress where the statutory conditions are met;
• object to or prevent direct-marketing processing;
• request data portability where the statutory requirements and technical conditions are satisfied; and
• make other requests available under applicable law.

If Casemix acts only as processor for the data concerned, we may refer your request to the relevant Customer or require the Customer’s authority before changing or releasing the record. For a patient’s medical record, please contact the clinic first unless there is a specific reason you cannot do so.

We may need to verify identity and authority before fulfilling a request. Some requests can be limited or refused where the law permits or requires us to do so, including where disclosure would adversely affect another person’s rights or where the record must be retained.

For Google Workspace, Facebook Messenger, Instagram, WhatsApp and other connected-service data, see Connected-service access, revocation and data deletion for the practical steps to disconnect an integration or request deletion of previously imported data.

Relify may contain information about children or minors because healthcare providers use the Service to deliver care. Casemix does not independently decide to collect a child’s medical information for advertising or unrelated purposes.

The Customer is responsible for determining the appropriate parent, guardian or other authority for the child’s care and for obtaining any consent or authorisation required for its processing. Where Casemix controls a child’s data for a separate purpose, we will apply the safeguards and consent requirements applicable to that activity.

Patient-facing features should not be used by a minor without the level of parent, guardian or other authorisation required by the Customer and applicable law.

We may send account, security, billing, support and service communications that are reasonably necessary to administer Relify. These operational messages are different from promotional marketing.

Where Casemix sends direct marketing to business contacts, recipients may opt out through the mechanism provided or by contacting us. We will honour legally valid direct-marketing objections or withdrawal requests.

Patient reminders, campaigns or other communications sent by a Customer through Relify are controlled by that Customer. The Customer is responsible for recipient selection, message content, consent and opt-out requirements applicable to those communications.

We may create aggregated, statistical or de-identified information for service analytics, capacity planning, reliability, security, research, benchmarking or product improvement, provided the information is handled so that it does not reasonably identify an individual and is used subject to applicable law and contractual restrictions.

We do not treat a dataset as anonymous merely because obvious identifiers have been removed. Where information remains reasonably capable of identifying a person, directly or indirectly, we continue to treat it as personal data.

We may disclose or transfer information where reasonably necessary to establish, exercise or defend legal rights; comply with binding legal process; respond to regulators or authorities; investigate fraud or security incidents; or protect the rights, safety and integrity of Relify, our Customers or others.

If Casemix is involved in a merger, acquisition, financing, reorganisation, sale of assets or similar transaction, information may be reviewed or transferred as part of that transaction subject to confidentiality, due-diligence controls and applicable data-protection requirements. Any successor that receives personal data will remain subject to applicable legal obligations and relevant contractual restrictions.

We may update this Privacy Policy when Relify’s features, data flows, legal requirements, business practices or service providers change. The “Last updated” date at the top identifies the current version.

Where a change materially affects how personal data is processed, we will provide additional notice where required by law and, where appropriate, through the Service, Customer communications or an updated PDPA Notice.

Customers should review this Policy, the PDPA Notice, the Data Processing Addendum, the AI & Responsible Use information and the current Subprocessors list when evaluating their own privacy obligations.

Privacy questions, requests or concerns relating to Casemix-controlled processing may be submitted using the contacts below. If your request concerns Customer-controlled patient or clinic data, we may need to coordinate with the relevant Customer.

Company: Casemix Solutions Sdn Bhd. You may also use the Relify contact page.

Where applicable, you may also have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia. We encourage you to contact us or the relevant Customer first where appropriate so the issue can be understood and addressed promptly.

Casemix will appoint and register a Data Protection Officer where the applicable Malaysian statutory or regulatory criteria require it and will maintain privacy-governance responsibilities appropriate to the scale and sensitivity of the processing.