Privacy

Who operates Practix

Practix is operated by Karmun, based in Kuala Lumpur, Malaysia, as an individual pending business registration. Contact: support@practix.my or WhatsApp +60 14-665 3696. When a registered business entity takes over this service, this page will name it and the date of the change.

Roles under the PDPA

• The clinic is the data user (controller) for its patients' personal and health data. It decides what is recorded and who in the clinic may see it.
• Practix is the data processor: we host the system and process data only to provide the service to the clinic. We do not use clinic or patient data for any purpose of our own, do not sell it, and do not use it to train AI models.
• Visitors to this website (practix.my public pages): we collect nothing beyond what the hosting provider logs to serve the page. There is no analytics script on the public pages.

What data the system holds for a clinic

Whatever the clinic enters: patient identity and contact details, appointments, clinical records (charts, notes, photographs, consents), billing and payment records, staff accounts, and the clinic's own settings. Voice recordings and typed text submitted to the AI scribe are stored with the resulting note so the clinic can trace what was said.

Where it is hosted and who processes it

Processor	What it does	Location
Supabase	Database, file storage, authentication	Sydney, Australia (AWS ap-southeast-2)
Cloudflare	Serves the web application and public pages	Global edge network
OpenAI	Speech-to-text and note structuring for the AI scribe and the other AI features listed in the in-app AI register, with model training disabled	United States
Sentry	Application error reports (technical diagnostics; no patient records)	United States / EU
Google Fonts	Typefaces on the web pages	Global

Clinic and patient data is therefore stored and processed outside Malaysia. A clinic that needs a specific hosting region or a signed data-processing agreement should ask before onboarding.

Security measures

• Each clinic's data is isolated by database-level access rules; a login only reaches its own clinic.
• Role-based access inside the clinic (dentist accounts cannot see money); optional two-factor authentication and device checks for staff logins.
• Patient-facing pages (online booking, aftercare links, the lab portal) show only what that page needs.
• Daily backups; signed consents carry a tamper-evident hash; destructive actions are confirmed and logged with who and when.

AI processing

Every AI feature is listed in an AI register inside the application, with what it receives and what it returns. AI output is a draft that a dentist reviews and signs; the system records what was removed or flagged before signing. Audio and text sent for AI processing are sent with model training disabled.

Retention and deletion

Data is retained for as long as the clinic uses the service and for any period the clinic is required by Malaysian law to keep clinical and financial records. When a clinic leaves, it can export its data; we delete our copy after the agreed handover period.

Patients: your rights

If you are a patient of a clinic that uses Practix, your requests to access, correct or delete your data go to the clinic — it is the data user and the only party that can verify who you are. We help the clinic fulfil them.

Changes

Changes to this notice are dated at the top of the page.