Last updated: 5 May 2026
ClaimHub Services ("we", "us", "our") operates the ClaimHub reconciliation service. This Privacy Policy explains how we collect, use, and protect your information in compliance with the Malaysian Personal Data Protection Act 2010 (PDPA 2010).
Two deployment modes — different data flows. ClaimHub is offered as (a) a Windows installer that processes data entirely on your clinic PC ("LocalInstall"), and (b) an optional web upload path ("Web SaaS"). The retention periods below apply only when data physically reaches our servers. Under LocalInstall, patient and AR data never leave your clinic premises — only license validation and credit accounting touch the cloud.
| Data Type | Purpose | Retention |
|---|---|---|
| Clinic name, address, Borang B ID | Account registration and verification | Duration of account |
| Admin name, email, phone | Account management and communication | Duration of account |
| Uploaded billing/TPA files (Web SaaS only) | Reconciliation processing | 90 days after processing, then permanently deleted |
| Patient names, visit dates, bill amounts (Web SaaS only) | Reconciliation matching | 90 days after processing, then permanently deleted |
| Patient/AR data under LocalInstall | Reconciliation matching on your PC | Never transmitted to ClaimHub — your local retention applies |
| Payment transaction records | Credit purchase and billing | 7 years (tax compliance) |
| IP address, browser info | Security and audit logging | 30 days |
Under PDPA 2010, the clinic is the Data User (Controller) for patient information processed through ClaimHub. ClaimHub Services is the Data Processor, acting only on documented instructions from the clinic. We do not determine the purposes or means of processing patient data — the clinic does.
As Data Processor, we commit that patient data is:
Each clinic operates in an isolated tenant environment. Database queries are automatically scoped to your tenant. No clinic can access another clinic's data, records, or reconciliation results.
We use a small number of vetted sub-processors to deliver the Service. We share only the minimum information required for each one to perform its function. Patient and AR data are not shared with any sub-processor.
We do not sell, rent, or share your data with any other third parties.
Most processing occurs in Malaysia (Hostinger Singapore-region VPS) or on the clinic's own PC (LocalInstall). Limited transactional data may be transferred to Stripe (US, Singapore) and Cloudflare (global edge network) as part of payment and web-traffic delivery. We rely on these processors' contractual safeguards (PCI DSS, SOC 2, EU Standard Contractual Clauses where applicable) to maintain protection equivalent to PDPA 2010 standards. By using ClaimHub, you consent to these limited cross-border transfers.
Under the Malaysian PDPA 2010, you have the right to:
To exercise these rights, email contact@claimhub.cc.
In the event of a data breach affecting your personal data, we will notify you and the relevant authorities as required by PDPA 2010, within a reasonable timeframe.
ClaimHub uses essential cookies for authentication and session management only. We do not use tracking cookies, analytics cookies, or advertising cookies.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date.
For privacy-related inquiries, to exercise your PDPA 2010 rights, or to report a suspected data incident, contact our designated point of contact:
ClaimHub Services
Email: contact@claimhub.cc
Address: Shah Alam, Selangor, Malaysia
Response time: within 5 business days for routine requests; within 24 hours for
suspected breaches.