Privacy notice

In short

• You can search for clinics without an account and without giving any personal data.
• We only collect personal data when you send a form: an error report, a clinic profile claim, a newsletter sign-up or an appointment request.
• We do not ask for your medical records or symptoms. An appointment request shows the clinic and service you chose; we treat it as sensitive personal data and process it only with your explicit consent.
• We do not sell or rent personal data. An appointment request goes only to the clinic you chose; that clinic may pay KlinikCari a service fee for this feature.
• Usage statistics through Google Analytics are used only if you choose “Accept” in the cookie banner. If you decline, nothing is loaded from Google Analytics.

1. Who we are

KlinikCari, Wangsa Maju, 53300 Kuala Lumpur. E-mail: contact@klinik.com.my.

In this notice, “KlinikCari”, “we” and “us” mean the operator above, which is the data controller for the personal data described here.

2. Personal data we collect

• When you browse the site: our server records standard technical data (IP address, browser and device type, pages opened and time) in the hosting provider’s security logs. Members of the public do not need an account.
• Usage statistics (only if you agree): if you choose “Accept” in the cookie banner, Google Analytics records how the site is used: pages viewed and the site that brought you here, searches on the site, interactions such as scrolling and clicks on links, device and browser type, language, approximate location (country and city) and a random identifier stored in a cookie. Google states that Google Analytics 4 does not log or store IP addresses. We do not send your name, e-mail, phone number or form contents to Google Analytics, and it is not used on clinic-owner account pages or invoice pages.
• Clicks on contact buttons: when you click Call, WhatsApp, Waze, Google Maps or the website on a profile, we record only the type of click, the clinic and the date, without your IP address or any identifier. We also count how many times each clinic profile is viewed, in the same way.
• Device location: if you choose a nearby search and allow location, the coordinates are sent with that search and are not stored by KlinikCari. They may appear in standard server logs.
• Error reports: the clinic, the information that is wrong, the suggested correction, a source (optional), whether you are a member of the public or clinic staff, and your e-mail or phone (optional).
• Clinic profile claims: full name, role at the clinic, phone, e-mail, verification method and, if you choose it, a copy of the clinic’s registration certificate. If the claim is approved, we create an owner account with your e-mail; the password is stored only in hashed form, and every change you send through the account is logged.
• Newsletter: e-mail address, preferred language and the date you confirmed your subscription.
• Appointment requests: on profiles of clinics that offer this form: your name, phone number, preferred date and time, the service you choose (optional), a short note (optional), the clinic, the page the form was sent from, the page language and the time you gave consent. We also keep a one-way hash of the phone number to detect repeat requests.
• Spam protection: a one-way hash of your IP address to limit repeated submissions. The IP address itself is not stored with the form.
• Information in clinic listings: profiles contain a clinic’s business information (name, address, phone, opening hours and services) collected from public sources, such as online map listings, the clinic’s official website and social media, and Ministry of Health Malaysia (KKM) directories. Some clinic names include a doctor’s name; we show it only as part of the business name the clinic uses publicly.

3. Why we process your data

• To provide and improve the directory, including correcting clinic information based on reports.
• To understand how the site is used so we can improve the directory, through Google Analytics statistics used only with your consent.
• To verify that a person claiming a profile is authorised by the clinic, and to contact them about that profile.
• To send the newsletter you subscribed to.
• To pass your appointment request to the clinic you chose so that it can contact you, and to keep a record of requests for billing the clinic and settling disputes about invalid requests.
• To answer your questions and requests.
• To protect the site from spam, abuse and security threats.
• To comply with the law and lawful requests from authorities.

We do not use your data for any other purpose without telling you first and, where required, getting your consent.

4. Required or optional

Using the directory needs no personal data, and usage statistics are entirely optional: the site works the same whether you accept or decline analytics cookies. In our forms, fields marked as required are needed to process your submission: without them we cannot verify a claim or send the newsletter. Contact details in an error report are optional; without them we still check your report but cannot reply.

In an appointment request, your name, phone number and preferred date are required so that the clinic can contact you; the service and note are optional. A request is sent only after you tick the consent box on the form.

By sending a form, you agree to your data being processed as described in this notice. You can withdraw your consent at any time (see section 11).

5. Health information

KlinikCari is not a healthcare provider. We do not ask for, record or process medical records, symptoms or diagnoses, and we do not collect biometric data. Please do not enter such information in our forms. If it is sent by mistake, we delete it as soon as we find it.

An appointment request shows which clinic you want to visit and, if you choose one, the service you want. This may reveal something about your health, so we treat it as sensitive personal data under Act 709 and process it only with the explicit consent you give by ticking the box on the form. The note on the form is for practical matters only; the clinic will ask about medical matters when it contacts you.

6. Who we disclose data to

We may disclose personal data to the following classes of third parties:

• Service providers who process data for us: our web host (Hostinger) and our e-mail delivery provider. They may use the data only to provide their service to us.
• Google (Google Analytics), only if you agree: Google processes usage statistics on our behalf under Google’s data processing terms. We have switched off Google Signals and ad personalisation, and we do not allow Google to use this data for its own products or advertising.
• Services your browser loads: fonts from Google Fonts and maps from OpenFreeMap (or OpenStreetMap map tiles if your browser cannot display vector maps). Their servers receive your IP address when a page or map loads.
• The clinic concerned: we may contact a clinic to check a correction, but we do not give the clinic a reporter’s name or contact details without your consent.
• The clinic that receives your appointment request: we give the request (name, phone number, preferred date and time, service and note) to that clinic’s authorised profile managers, by e-mail and in their KlinikCari account. The request is not sent to any other clinic. The clinic is responsible in its own right under Act 709 for how it uses your details and, under our terms, may use them only to arrange your appointment. The clinic may pay KlinikCari a service fee for receiving requests.
• Professional advisers and authorities: where required by law or court order, or to establish or defend legal rights.
• A successor business: if KlinikCari is sold or reorganised, data is transferred subject to the protections in this notice.

When you follow a link to Waze, Google Maps, WhatsApp or a clinic’s website, you leave KlinikCari and that service’s privacy notice applies.

7. Transfers outside Malaysia

This site’s hosting server is located in the United States, and Google (including Google Analytics, if you agree), OpenFreeMap and OpenStreetMap operate servers outside Malaysia. The data described in this notice is therefore processed outside Malaysia. For hosting, e-mail and Google Analytics, we rely on those providers’ data protection terms and security measures, in line with section 129 of Act 709 and the Cross Border Personal Data Transfer Guidelines. By sending a form or accepting analytics cookies, you are informed of these transfers.

8. Security

The site uses an encrypted connection (HTTPS). Only authorised administrators can access form submissions; an appointment request can also be seen by the profile managers of the clinic that received it. Copies of registration certificates are stored outside the site’s public directory and can be downloaded only by administrators. Forms are protected against automated submissions.

No system is completely secure. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner within 72 hours, and notify you within seven days after that if the breach is likely to cause you significant harm, as required by Act 709 and the related guidelines.

9. How long we keep data

• Contact details in error reports: deleted automatically after 30 days. The report itself, without contact details, is kept as the profile’s correction history.
• IP hashes for spam protection: deleted after 30 days.
• Appointment requests: your name, phone number and note are deleted automatically 90 days after the request is sent. A record without your details (clinic, date and service) is kept for accounts and statistics. The copy the clinic received, including the notification e-mail, is kept under the clinic’s own practices; contact the clinic to ask for it to be deleted.
• Profile claims: kept while you manage the profile. Rejected claims are deleted 24 months after the decision. Certificate copies are deleted after 24 months. Owner accounts are deleted on request or when you no longer manage any profile.
• Newsletter: until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. After you unsubscribe, we keep your e-mail address on a suppression list so you don’t receive our e-mails again.
• E-mails you send us: up to 24 months after your enquiry is resolved.
• Server logs: kept by the hosting provider for a limited period for security.
• Google Analytics statistics: user-level and event-level data is deleted automatically by Google after 2 months. Summary reports without individual identifiers may be kept longer. The _ga cookie expires after 2 years, or sooner if you decline or delete it.

10. Accuracy

We take reasonable steps to keep the personal data we hold accurate, complete, not misleading and up to date. Please tell us if your details change.

11. Your rights

• Access: ask for a copy of the personal data we hold about you. We reply within 21 days of receiving a complete request.
• Correction: ask us to correct data that is inaccurate, incomplete or misleading.
• Withdraw consent: at any time. This does not affect processing carried out before then. For usage statistics, use the “Cookie settings” link at the bottom of the page or the button in section 12.
• Data portability: ask for the data you gave us to be sent to you or to another data controller in a commonly used format, where technically feasible.
• Direct marketing: unsubscribe using the link in every newsletter e-mail, or by contacting us.
• Prevent processing that is likely to cause you damage or distress, and ask us to delete data we no longer need.

Send requests to contact@klinik.com.my with the subject “PDPA”. We may ask for proof of identity before acting. We do not charge for ordinary requests. If you are not satisfied with our reply, you can complain to the Personal Data Protection Department at pdp.gov.my.

12. Cookies

Essential cookies (no consent needed): login cookies for administrators and clinic profile owners, a temporary cookie while you set a password, the kc_consent cookie that stores your cookie choice for 6 months, and other technical cookies the site needs to work.

Analytics cookies (only with your consent): the Google Analytics cookies _ga and _ga_<ID> are set only after you choose “Accept” in the cookie banner. They store a random identifier for up to 2 years to tell new and returning visits apart. If you choose “Decline”, the Google Analytics code is not loaded at all. You can change your choice at any time through the “Cookie settings” link at the bottom of every page or the button below; if you withdraw consent, we delete the Google Analytics cookies from your browser.

We do not use advertising cookies. If we add advertising in future, we will update this notice first.

Your current choice: not chosen yet. Change cookie settings

13. Under-18s

Anyone can use the directory. Our forms are intended for users aged 18 or over. If you are under 18, please ask a parent or guardian to send the form for you.

14. Changes to this notice

We may update this notice from time to time. The effective date at the top shows the current version. Significant changes will be shown on this page and, for newsletter subscribers and profile owners, announced by e-mail.

15. Contact us

Privacy questions and requests under Act 709: contact@klinik.com.my (subject: PDPA). See also our Terms of use.