Effective: 1 January 2026 · Governed by PDPA 2010 (Malaysia)

Privacy Policy

Last updated: 1 January 2026

1. Data Controller

This Privacy Policy is issued by MOVO-X Sdn Bhd (operating as MOVO-X Malaysia), the Data User as defined under Malaysia's Personal Data Protection Act 2010 (PDPA 2010).

Contact: privacy@movo-x.com

2. Legal Basis

This policy is governed by the Personal Data Protection Act 2010 (PDPA 2010) of Malaysia. MOVO-X Sdn Bhd is registered as a Data User with the Department of Personal Data Protection (JPDP) Malaysia. All personal data processing is conducted in compliance with the seven Personal Data Protection Principles under PDPA 2010.

3. Data We Collect

We collect and process the following categories of personal data:

CategoryDetails
Clinic administratorName, email address, role, phone number
Patient NRICSHA-256 hash only — raw IC number is NEVER stored
Queue / appointment dataArrival time, department selected, wait time, call time
Kiosk usage logsDevice ID, timestamp, action type — for audit and analytics
PDPA consent recordsConsent timestamp, version, kiosk device ID
Clinical recordsNOT collected or stored — queue metadata only

4. How We Use Personal Data

  • •To provide the MOVO-X queue management and kiosk services
  • •To identify returning patients via NRIC hash for faster check-in
  • •To send WhatsApp queue notifications to patients
  • •To generate anonymised analytics for clinic operations
  • •To maintain audit logs for regulatory compliance
  • •To fulfil obligations under PDPA 2010 and PHFSA 1998

5. Data Residency

All patient and operational data is stored in ASEAN-resident infrastructure:

  • •Primary database: Supabase Singapore (ap-southeast-1) — encrypted at rest with AES-256
  • •KMS encryption keys: Supabase KL (ap-southeast-5) — keys never co-located with data
  • •Edge compute: Vercel sin1 (Singapore) — static assets and middleware only

No patient personal data is transferred outside ASEAN except to Anthropic (AI triage, zero data retention mode — data not persisted by Anthropic after processing).

6. Retention

  • •Active account data: retained while subscription is active
  • •Post-termination: 7 years from subscription end date (PDPA 2010 requirement)
  • •Audit logs: 7 years, immutable write-once
  • •Data export: provided within 14 days of termination request

7. Your Rights Under PDPA 2010

As a data subject under PDPA 2010, you have the right to:

  • •Access — request a copy of all personal data held about you
  • •Correction — request correction of inaccurate or incomplete data
  • •Withdrawal of consent — withdraw consent at any time (does not affect lawfulness of prior processing)
  • •Complaint — lodge a complaint with PDPC Malaysia (pdp.gov.my)

To exercise your rights: privacy@movo-x.com

8. Subprocessors

We use the following third-party subprocessors to deliver our services:

  • •Supabase (AWS Singapore): Database storage — ap-southeast-1
  • •Supabase (AWS KL): KMS key management — ap-southeast-5
  • •Vercel (Singapore edge): Application hosting — sin1
  • •Anthropic: AI triage — zero data retention mode
  • •Resend: Transactional admin email
  • •Meta (WhatsApp Business API): Patient queue notifications

9. Breach Notification

In the event of a confirmed personal data breach involving Malaysian residents' data: PDPC Malaysia will be notified within 72 hours. Affected data subjects will be notified within 7 days. Enterprise customers will receive a full incident report within 14 days.

10. Contact

Privacy enquiries: privacy@movo-x.com
Data Protection Officer: dpo@movo-x.com
MOVO-X Sdn Bhd, Kuala Lumpur, Malaysia

Trust Centre →Security →Compliance →