Subprocessors

A subprocessor is a third party engaged by Casemix to process Personal Data on Casemix’s behalf when Casemix itself is acting as a processor for a Relify Customer. Not every company that Relify connects to is necessarily a subprocessor.

The list below focuses on material providers that can receive or process Customer Personal Data in the normal operation of Relify or when a Customer enables the relevant feature. Exact data categories depend on the modules used, the Customer’s configuration, the user’s permissions and the content entered into the Service.

The following providers may process Customer Personal Data for the purposes described. “Feature-specific” means the provider is used only when the Customer uses or enables the relevant functionality.

Relify uses the OpenAI API to provide enabled AI functionality. The general Relify Assistant may analyse authorised clinic information, answer operational questions, generate reports and, where enabled, perform permitted operational actions after a user instructs it. Patient-specific Clinical AI remains inside the EMR and is used as decision support for authorised healthcare professionals.

When an AI feature is used, only the information reasonably required for that request should be sent to the AI provider. OpenAI states that inputs and outputs submitted to its business/API services are not used to train its models by default unless the customer explicitly opts in to data sharing.

OpenAI maintains its own list of infrastructure and support subprocessors. Rather than duplicate a list that can change independently, Relify links customers to the provider’s current published information and treats changes at that layer in accordance with the applicable provider agreement and Relify DPA.

Relify is designed for Malaysian healthcare providers, but some service providers operate internationally. Customer Personal Data may therefore be processed outside Malaysia when required to provide the Service or an enabled feature.

Cross-border processing is handled in accordance with the Data Processing Addendum and applicable data-protection requirements. Casemix evaluates the nature of the provider, the data involved, processing purpose, contractual safeguards and other relevant risk factors.

Where practical, Relify selects regional infrastructure close to its Malaysian customer base. This does not mean that every support, security, routing or provider-side operation is restricted to a single country.

Casemix may add or replace subprocessors as Relify evolves. Where a material new subprocessor will process Customer Personal Data, Casemix will provide reasonable notice through this page, the Service, email or another appropriate channel before or around the provider’s introduction, consistent with the applicable Agreement and DPA.

Routine changes within a provider’s own infrastructure or nested subprocessor list are generally governed by that provider’s terms and notification mechanism unless Relify’s contract requires additional action.

The “Last updated” date at the top of this page indicates when this direct-material-subprocessor list was last reviewed.

If a Customer has a reasonable and documented data-protection objection to a material new subprocessor, the Customer should contact Casemix promptly after receiving notice and explain the grounds for the objection.

Casemix will consider the concern in good faith and may, where reasonably feasible, use an alternative arrangement, disable the affected feature, or otherwise address the risk. Some subprocessors are necessary to provide a particular feature or the Service itself; if no reasonable alternative exists, the parties’ rights are governed by the Agreement and DPA.

Relify can exchange information with third parties selected or enabled by a Customer. Depending on the service and legal relationship, those third parties may act as independent controllers, processors directly engaged by the Customer, recipients required by law, or Relify subprocessors.

Examples can include payment gateways, FPX/payment networks, insurers and corporate payers, laboratories, government systems, Customer-owned messaging or email accounts and other external services. Their own privacy terms and contracts may apply.

Relify does not label a third party as a subprocessor merely because a Customer chooses to send information to that third party through an integration.

Casemix seeks to maintain contractual protections with material subprocessors that are appropriate to the processing they perform. Depending on the provider and service, safeguards can include data-processing terms, confidentiality obligations, security commitments, incident-notification duties, restrictions on processing purposes and cross-border transfer mechanisms.

Casemix remains responsible to the Customer for performing its processor obligations through subprocessors to the extent provided by the Agreement and DPA.

For more information about Relify’s own controls, see Security and Compliance.

Questions about this list, a provider’s role, cross-border processing or a material subprocessor change can be sent to: