Privacy Policy

KaunterAI Digital (202603194052 / 003873338-M) collects personal data in two different roles.

As a data controller, we collect data you give us directly: your name, email address, phone number and business name when you create an account or contact us, records of our correspondence, and the billing details needed to issue invoices.

As a data processor, we handle data on behalf of the businesses that use our service. When a clinic connects KaunterAI, the following passes through the platform: the customer's name and phone number, the content of WhatsApp messages between that customer and the clinic, appointment details such as service requested and date and time, and the clinic's own configuration — its services, prices and operating hours. In these cases the clinic is the data controller and its own privacy notice governs that data.

KaunterAI does not collect or store medical records.

We process personal data to provide and operate the service, to answer enquiries and manage bookings on behalf of our business customers, to communicate with account holders, to issue invoices and collect payment, to keep the platform secure and working, and to meet our legal obligations.

Where we act as a data processor, we act only on the instructions of the business whose account it is. We do not use that data for our own purposes and we do not sell it.

Message content is processed by Anthropic's Claude API in order to generate replies. Under Anthropic's commercial terms this content is not used to train their models, and it is deleted from their systems within 30 days.

We share personal data with the service providers that make the platform work:

Meta Platforms, for delivering and receiving WhatsApp messages through the WhatsApp Cloud API. Anthropic, for generating replies to messages. Billplz, for processing payments. Hostinger, for hosting the platform on servers located in Malaysia.

The platform and its database are hosted in Malaysia. Message content is additionally sent to Meta and to Anthropic, both of which process it on infrastructure outside Malaysia. Where we act as a data processor, the business remains the data controller and is responsible for the cross-border transfer requirements under Section 129 of the Personal Data Protection Act 2010; we make information about our processing locations available so they can meet those obligations.

We may also disclose personal data where required by law or by a regulatory authority.

We do not sell personal data, and we do not share it for advertising.

Under the Personal Data Protection Act 2010 you may request access to the personal data we hold about you, request that inaccurate data be corrected, withdraw consent you have given, ask us to stop processing your data for direct marketing, and request a copy of your data in a structured, commonly used format.

To exercise any of these, email support@kaunterai.my. If the data you are asking about is held on behalf of a business using our service — for example, if you are a patient of a clinic — we will pass your request to that business, which is the data controller and can act on it.

If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner, Jabatan Perlindungan Data Peribadi, Putrajaya.

We keep personal data only as long as we need it. Message content is deleted after 12 months. Booking records are kept while your account is active and for 90 days after it closes. Account and contact details are deleted 90 days after an account closes. Invoices and payment records are kept for 7 years, as Malaysian tax law requires.