Patient Consent Notice

This notice explains how your personal data is collected, used and protected when you contact a clinic that uses Medivis. It is meant to help you understand exactly what you are consenting to — and, just as importantly, what you are not.

Medivis is the clinic's booking and messaging system. It manages the clinic's appointment calendar and its WhatsApp conversations with patients. You never sign in to Medivis: there is no patient portal and no patient account. Everything you do reaches the clinic through WhatsApp or through the clinic's front desk.

This notice is issued in accordance with the Personal Data Protection Act 2010 (Act 709) of Malaysia.

When you message or book with a clinic that uses Medivis, this may be collected:

• Your name
• Your phone number — the WhatsApp number you message from
• Your email address and address, if the clinic records them
• Your identity card number, if you give it. It is stored only as a one-way hash used to match you to your existing record; the number itself is never kept in readable form
• The WhatsApp messages you exchange with the clinic, including any media you send
• Your appointments: date, time, branch, doctor or provider, the service booked, and the note the front desk types against the booking
• Whether you have opted out of marketing messages

Medivis is a booking and messaging system, not a medical record system. The following are never held on this platform:

• Prescriptions, medications dispensed, or treatment summaries
• Diagnoses, consultation notes, laboratory results or medical certificates
• Invoices, payments, or any card or bank detail — the clinic is billed, not you
• Panel or insurance membership, and any claim made against it
• Queue numbers or check-in records

Where your clinic keeps that information, it keeps it in its own separate systems, and it is covered by the clinic's own notice rather than this one.

Service processing (part of using the clinic)

Some processing is what the service is, and cannot be separated from it:

• Booking, rescheduling and cancelling your appointments
• Holding a two-way WhatsApp conversation with the clinic
• Sending you appointment reminders, and accepting a cancellation you send by reply
• Sending a follow-up message after your visit

If you do not want this processing, the clinic cannot book or message you through Medivis — you would need to contact it by phone or in person instead.

Marketing (optional, you can opt out)

• Broadcast messages and promotional offers
• Health tips and other educational content

You can withdraw marketing consent at any time, and doing so does not affect your bookings or your care. See below.

Some of the clinic's WhatsApp replies are written by an AI assistant rather than a person. It answers routine questions — services, prices, opening hours, location and available appointment slots — and can book an appointment for you.

• Before your message is sent to the AI provider, identifiers in it — identity card number, phone number, email address — are automatically removed.
• The assistant is blocked from giving medical advice. Ask a clinical question and the conversation is handed to clinic staff instead of answered.
• You can ask for a person at any time, and clinic staff can take over any conversation.

Our AI Disclosure explains this in full.

You can withdraw your consent at any time:

• Reply STOP or BERHENTI to any WhatsApp message from the clinic. Marketing messages stop straight away — the opt-out is recorded against your number and checked every time a message is about to be sent. Reply START to opt back in.
• Ask the clinic directly, at the counter, by phone or by email
• Contact the Medivis Data Protection Officer at kobaranteguh@gmail.com

Opting out of marketing still leaves you receiving appointment reminders and replies to questions you have asked. Withdrawing consent for the service processing itself means the clinic can no longer book or message you through Medivis.

• Access: request a copy of the personal data held about you
• Correction: request correction of inaccurate or incomplete data
• Withdraw consent: stop processing for a specific purpose, such as marketing
• Complain: lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP)

Your clinic is the data controller, so asking the clinic directly is usually the fastest route.

For any question about this notice, or to exercise your rights, please contact your clinic or: