Privacy Policy

KOBARAN TEGUH SDN. BHD. (Company Registration No. 202601001919 (1664016-P)), trading as Medivis, is committed to protecting personal data in accordance with the Personal Data Protection Act 2010 (Act 709) of Malaysia.

Medivis is a multi-tenant booking CRM for businesses: appointment scheduling, a WhatsApp conversation desk, and an AI assistant that answers routine questions. Each business operates in its own isolated workspace on its own subdomain.

This policy explains how we collect, use, disclose and safeguard personal data on that platform. Our Data Protection Officer can be reached at kobaranteguh@gmail.com.

Medivis holds two categories of personal data, and no more.

Contact data

• Name, phone number and — where the business records them — email address and date of birth
• NRIC, stored as a one-way hash for matching. The number itself is never written to the database in readable form
• WhatsApp conversation transcripts between the contact and the business
• Appointment records: date, time, provider, service and the business's own notes
• Marketing consent and opt-out status

Business staff data

• Name, email address, role and branch assignment
• Sign-in activity and audit log entries

Medivis does not hold clinical records. Prescriptions, diagnoses, consultation notes, laboratory results and billing records live in whatever system the business uses for them — never here.

Operational (required to provide the service)

• Booking, rescheduling and cancelling appointments
• Two-way WhatsApp conversation between the business and the contact
• Appointment reminders and post-visit follow-up messages

AI assistance

• The AI agent answers questions about services, prices, opening hours and availability, and can book an appointment on the contact's behalf
• Identifiers — NRIC, phone number, email address — are scrubbed from the message text before it is sent to the model
• The agent is blocked from giving medical advice and hands the conversation to a human when a question needs one

Marketing (consent required)

• Broadcast messages, sent only to contacts who have not opted out
• Replying STOP opts a number out immediately, and the opt-out is enforced on send

Three processors handle data on our behalf. There is no integration with any practice management system, and no data is sold or shared for advertising.

Under the Personal Data Protection Act 2010 (Act 709), you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — have inaccurate or incomplete data corrected
• Withdraw consent — at any time, including marketing consent
• Complain — to the Department of Personal Data Protection Malaysia (JPDP)

The business you dealt with is the data controller, so a request is usually fastest made to the business directly. You may also contact our DPO at kobaranteguh@gmail.com, and we will respond within the timeframe the law requires.

• Contact and appointment records: for as long as the business subscribes, plus 7 years
• WhatsApp conversations: 24 months
• Audit logs: 5 years

A suspended or non-paying business is locked out, not deleted: its data is preserved so it can be recovered or exported when the account is settled.

Each business's data is isolated at the query layer, credentials are encrypted at rest, and every sensitive action is logged. Our Security page describes the controls in detail.

Medivis sets essential sign-in cookies only — no tracking, analytics or advertising cookies. See our Cookie Policy.

We may update this policy from time to time. Material changes will be communicated by email or through the platform before they take effect.