Patient data statement / Kenyataan data pesakit

1. Who is responsible

When patients message your clinic and Friday replies, your clinic is the data controller under the Personal Data Protection Act 2010 (as amended in 2024). ALLWEEK TECHNOLOGIES is your data processor: we process patient data only on your behalf, to run Friday for your clinic, and only as you instruct.

Health information is sensitive personal data under the Act. Your clinic is responsible for having the patient's consent. Friday's first reply to a new patient says it is your clinic's automated assistant and links to your clinic's privacy notice; the wording of that reply is yours to approve.

2. What we process

• Patients' names and WhatsApp numbers.
• The messages they send your clinic and the replies sent back, including anything a patient chooses to write about their health.
• Bookings, reminders, quotes, invoices, receipts and payment records, and bank-in slips patients send.

3. What we will and will not do with it

• We use patient data only to provide Friday to your clinic.
• We do not use it for our own purposes, do not sell it, and do not use it to market to your patients.
• Friday does not answer medical questions. It hands them to your clinic.
• Only members of our team who need to, to set up, supervise or support your Friday, can see your clinic's chats. In your supervised first week, our team reads replies to check them.

4. Who else handles it (sub-processors)

We will tell you before we add or change a sub-processor. Some of these suppliers process data outside Malaysia; we transfer data only as section 129 of the Act allows.

5. Security

• Encrypted connections (HTTPS) between patients, your clinic, our servers and our suppliers.
• Each clinic's data kept separate from other clinics'.
• A personal sign-in for each owner and staff member.
• Access by our team limited to the people who need it.
• Regular backups.

6. If something goes wrong

If we learn of a personal data breach that affects your clinic's data, we will tell you within 24 hours of becoming aware of it, with what we know, so you can meet your own duty to notify the Personal Data Protection Commissioner and affected patients.

7. Patients' requests

If a patient asks us to see, correct or delete their data, we pass the request to your clinic within 2 working days and help you answer it. We act on your instructions.

8. How long we keep it

While your clinic uses Friday. When you leave, you can download your customer list first. We then delete your clinic's patient data within 30 days, and it leaves our backups within a further 30 days, except records the law requires us to keep. See Data deletion.

9. Contact

ALLWEEK TECHNOLOGIES, hello@allweek.com.my, +60 19-300 0709.

Ringkasan (Bahasa Melayu)

Apabila pesakit menghantar mesej kepada klinik anda dan Friday membalas, klinik anda ialah pengawal data di bawah Akta Perlindungan Data Peribadi 2010 (seperti yang dipinda pada tahun 2024), dan ALLWEEK TECHNOLOGIES ialah pemproses data klinik anda.

• Kami memproses data pesakit hanya bagi pihak klinik anda, untuk menjalankan Friday, dan mengikut arahan anda.
• Kami tidak menggunakannya untuk tujuan kami sendiri, tidak menjualnya, dan tidak menggunakannya untuk pemasaran kepada pesakit anda.
• Maklumat kesihatan ialah data peribadi sensitif. Klinik anda bertanggungjawab mendapatkan persetujuan pesakit.
• Jika berlaku pelanggaran data yang menjejaskan data klinik anda, kami akan memaklumkan anda dalam tempoh 24 jam selepas kami mengetahuinya.
• Permintaan pesakit untuk melihat, membetulkan atau memadam data akan dihantar kepada klinik anda dalam tempoh 2 hari bekerja.
• Apabila anda berhenti, kami memadam data pesakit klinik anda dalam tempoh 30 hari.

Versi penuh dalam Bahasa Melayu sedang disediakan.