Last updated: 3 September 2026
ClaimHub Services ("we", "us", "our") operates the ClaimHub reconciliation service. This Privacy Policy explains how we collect, use, and protect your information in compliance with the Malaysian Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 whose provisions came into force on 1 June 2025 ("PDPA").
Two deployment modes — different data flows. ClaimHub is offered as (a) a Windows installer that processes data entirely on your clinic PC ("LocalInstall"), and (b) an optional web upload path ("Web SaaS"). The retention periods below apply only when data physically reaches our servers. Under LocalInstall, patient and AR data never leave your clinic premises — only license validation and credit accounting touch the cloud.
| Data Type | Purpose | Retention |
|---|---|---|
| Clinic name, address, Borang B ID | Account registration and verification | Duration of account |
| Admin name, email, phone | Account management and communication | Duration of account |
| Uploaded billing/TPA files (Web SaaS only) | Reconciliation processing | 90 days after processing, then permanently deleted |
| Patient names, visit dates, bill amounts (Web SaaS only) | Reconciliation matching | 90 days after processing, then permanently deleted |
| Patient/AR data under LocalInstall | Reconciliation matching on your PC | Never transmitted to ClaimHub — your local retention applies |
| Payment transaction records | Credit purchase and billing | 7 years (tax compliance) |
| IP address, browser info | Security and audit logging | 30 days |
Under PDPA 2010, the clinic is the Data User (Controller) for patient information processed through ClaimHub. ClaimHub Services is the Data Processor, acting only on documented instructions from the clinic. We do not determine the purposes or means of processing patient data — the clinic does.
As Data Processor, we commit that patient data is:
Each clinic operates in an isolated tenant environment. Database queries are automatically scoped to your tenant. No clinic can access another clinic's data, records, or reconciliation results.
We use a small number of vetted sub-processors to deliver the Service. We share only the minimum information required for each one to perform its function. Patient and AR data are not shared with any sub-processor.
We do not sell, rent, or share your data with any other third parties.
Most processing occurs in Malaysia (Hostinger Singapore-region VPS) or on the clinic's own PC (LocalInstall). Limited transactional data may be transferred to Stripe (US, Singapore) and Cloudflare (global edge network) as part of payment and web-traffic delivery. We rely on these processors' contractual safeguards (PCI DSS, SOC 2, EU Standard Contractual Clauses where applicable) to maintain protection equivalent to PDPA 2010 standards. By using ClaimHub, you consent to these limited cross-border transfers.
Under the Malaysian PDPA 2010, you have the right to:
To exercise these rights, contact our Data Protection Officer (section 12). We do not charge a fee for a first request in any 12-month period.
If a personal data breach occurs, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it. Where the breach causes or is likely to cause significant harm to you, we will also notify you directly within 7 days of notifying the Commissioner. These are the deadlines set by the PDPA as amended, and they replace the "reasonable timeframe" wording used in earlier versions of this policy.
Report a suspected incident to our Data Protection Officer (section 12). We treat breach reports as the highest priority in our support queue.
Separately from everything above, clinics may opt in to a de-identified data-sharing programme. It is optional, it is off unless you actively switch it on, and declining does not affect your use of ClaimHub in any way. You can withdraw at any time under Settings → Data & Privacy, which stops future use immediately.
If you opt in, this is what is shared:
This is what is never shared, whether you opt in or not:
The fields listed above are exactly the fields ClaimHub already stores to draw your dashboard — opting in does not cause us to collect anything new about you. We use this pooled, de-identified data to publish market-level benchmarks on how Malaysian panels pay, and to fund the free tier. Any output is aggregated across many clinics; we do not publish figures that could single out one clinic.
Each version of these terms is recorded against your consent. If the scope ever changes, your existing consent does not carry over to the new scope — we will ask you again.
ClaimHub uses essential cookies for authentication and session management only. We do not use tracking cookies, analytics cookies, or advertising cookies.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date.
As required by the PDPA as amended, ClaimHub Services has designated a Data Protection Officer who is accountable for our compliance with the Act. Contact the Data Protection Officer for privacy inquiries, to exercise any right in section 7, or to report a suspected data incident:
Data Protection Officer
TO BE APPOINTED
ClaimHub Services
Email: dpo@claimhub.cc
Address: Shah Alam, Selangor, Malaysia
Response time: within 5 business days for routine requests; within 24 hours for a suspected breach. If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner, Malaysia (Jabatan Perlindungan Data Peribadi).
For anything that is not a privacy matter: contact@claimhub.cc.