Privacy Policy

BookAClinic (bookaclinic.ai) is operated by Replyr Sdn. Bhd. (1663859-K / 202601001762), a company registered in Malaysia with its office in Kuala Lumpur. In this policy, "we", "us" and "BookAClinic" mean Replyr Sdn. Bhd.

We are a clinic discovery and referral platform. We are not a healthcare provider, we do not give medical advice, and we do not perform treatment. When you visit a clinic, that clinic holds and is responsible for your medical records.

This policy explains what we do with your personal data. It is written to meet our obligations under Malaysia's Personal Data Protection Act 2010 (PDPA).

• Contact details. Your name, phone number and email address when you message us, fill in a form, or ask to be matched with a clinic.
• What you tell us. The treatment you are interested in, your budget range, your location, your preferred language, and anything else you choose to put in a message.
• Photos you upload. Face photos for AI Face Analysis, and screenshots or photos of promotions you send us for a Legit Check.
• Booking and claim details. The clinic and treatment you booked, your booking reference, and, if you raise a Booking Protection claim, your account of what happened and your payment receipt from the clinic.
• Clinic and partner enquiries. If you apply on behalf of a clinic, your name, your role, the clinic name, city, website, phone and email.
• Job applications. Whatever you submit through our careers pages.

When you use bookaclinic.ai we collect standard technical information: your device and browser type, the pages you view and how long you spend on them, the site or advertisement that brought you here, and an approximate location worked out from your IP address. This comes from cookies and similar technologies, which are covered in section 09.

We do not ask for your identity card number, passport number, bank account details or card details, and you should not send them to us. We do not hold your medical records. We take no payment on this website. Payment for treatment is made to the clinic directly.

If you use AI Face Analysis you upload photos of your face and give us your name and phone number. Here is exactly what happens to them.

Most conversations with BookAClinic happen on WhatsApp, including bookings, Legit Check and face analysis reports. When you message us:

• We receive your WhatsApp display name, your phone number, and the messages and images you send.
• Some replies are handled by our automated assistant. Our team can read the conversation and step in at any time.
• WhatsApp is operated by Meta and your use of it is governed by Meta's own terms and privacy policy. We do not control how Meta handles a message in transit.
• Some links on this website pre-fill your first message so our assistant knows which page you came from. You can edit or delete that text before you send it.

• To reply to you and answer what you asked.
• To match you with clinics that fit what you asked for, and to arrange your appointment.
• To produce and deliver what you requested: a face analysis report, a Legit Check verdict, a doctor certification result.
• To administer Booking Protection, including mediating and deciding claims.
• To keep the platform safe, prevent fraud and abuse, and keep proper records.
• To measure how our pages and advertisements perform so we can improve them.
• To follow up on a booking or enquiry you started. If you would rather not hear from us, say so and we stop.

We do not sell your personal data to anyone. We share it only in these situations.

• The clinic you choose. When you ask us to connect you or to book for you, we pass on what that clinic needs to attend to you: usually your name, your phone number, and the treatment you are asking about.
• Service providers who run our systems. Hosting and database, the automation that delivers your reports and messages, messaging through WhatsApp, website and product analytics, advertising measurement, internal team notifications, and AI processing for face analysis. They act on our instructions and only for the purpose we give them.
• Brand and clinic partners, in aggregate only. Where we report campaign performance to a partner, we report counts and trends, never the names or contact details of individuals, unless you specifically asked to be contacted by that partner.
• When the law requires it. For example a valid request from a regulator, a court, or an enforcement authority.
• If our business changes hands. Any buyer would be bound by this policy for data collected under it.

We use cookies and similar technologies to keep the site working, remember your preferences, understand which pages people use, and measure our advertising. That includes Google Analytics, PostHog product analytics, and the Meta pixel. You can block or delete cookies in your browser settings. If you do, parts of the site may not work as well.

Our database and files are hosted in Singapore. Some of our service providers, including our analytics and AI processing partners, operate in the United States and elsewhere, so your data may be transferred to and stored outside Malaysia. Where that happens we require the provider to protect your data to a standard consistent with the PDPA.

• Enquiries, WhatsApp conversations and booking records: 24 months after our last contact with you, unless we need them longer to handle a claim or to meet a legal obligation.
• Face analysis photos and the images generated from them: 12 months, then deleted. You can ask us to delete them sooner.
• Booking Protection claim records: 6 years from the close of the claim, in case a dispute is reopened.
• Analytics data: held by our analytics providers under their standard retention settings.

You have the right to:

• Ask what personal data we hold about you and receive a copy of it.
• Ask us to correct anything inaccurate, incomplete or out of date.
• Ask us to delete your data, including your face photos and reports.
• Withdraw your consent, and tell us to stop using your data for marketing.
• Limit how we process your data.

To use any of these, message us on WhatsApp at +60 10-334 5578 or email michael@replyr.ai. We will respond within 21 days, as the PDPA requires. We may need to confirm it is really you first, usually by checking the request comes from the phone number we already have. There is no charge for this.

Access to our systems is limited to the people who need it, traffic to this site is encrypted, and our database sits behind row level access controls. No system is perfect. If a breach ever affects your data we will tell you what happened and what to do about it.

BookAClinic is built for adults. Our tools, including AI Face Analysis, are not intended for anyone under 18, and the analysis stops when someone tells us they are under 18. If you believe a child has sent us personal data, message us and we will delete it.

We may update this policy. The version on this page is the one in force and the effective date is shown at the top. If we make a change that materially affects how we use your data, we will say so here.

• WhatsApp: +60 10-334 5578
• Email: michael@replyr.ai · dylan@replyr.ai
• Replyr Sdn. Bhd. (1663859-K / 202601001762), Kuala Lumpur, Malaysia

If you are not satisfied with how we have handled your personal data, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) in Malaysia.