Data protection, for clinics
How Catat handles your clinic's data
Who is responsible for what, where recordings and notes are kept, which providers process them, and what happens if something goes wrong.
Your clinic decides what is recorded and is responsible for telling parents and getting their consent. Purple Playhouse Sdn Bhd runs Catat and processes that data only to provide the service to you. Recordings and notes are stored on Google Cloud in Singapore. Audio is transcribed by OpenAI and notes are drafted by Anthropic, under business terms that do not allow your data to be used to train their models.
Roles
Who is responsible
Under the PDPA, your clinic is the data controller. You decide which consultations are recorded, what goes into the record, and who on your team can see it. Health information is sensitive personal data, so your clinic needs the explicit consent of the parent or patient before recording a consultation.
Purple Playhouse Sdn Bhd (PPSB), the company behind Catat, is your data processor. We process personal data only to provide Catat to your clinic and on your instructions. Since the 2024 amendments, a data processor is directly bound by the PDPA Security Principle, and we hold ourselves to it.
What we process
What Catat processes
- iYour team's account details: name, email address, role in the clinic and, for doctors, MMC registration number.
- iiPatient records your clinic enters: for example the child's name, date of birth, parent contact details, allergies and vaccination history.
- iiiConsultation audio recorded in Catat, and the transcript made from it.
- ivDocuments Catat drafts and your clinic edits and signs: consultation notes, letters, referral letters and medical certificates.
- vUsage records such as how many notes were made and what the AI processing cost. These hold no clinical content.
Where
Where your data is stored
The Catat database, audio files and application servers run on Google Cloud (Firebase), in the Singapore region. This means your data is stored outside Malaysia. The PDPA allows this where the destination gives an adequate level of protection, and Google provides contractual data protection commitments for its cloud services.
Transcription and note drafting are done by the providers listed below, whose processing takes place mainly in the United States.
Providers
Providers that process data for Catat
| Provider | What it does | Data involved |
|---|---|---|
| Google Cloud (Firebase) | Hosting, database, file storage, sign-in | Everything listed above |
| OpenAI | Turns consultation audio into a transcript | Consultation audio |
| Anthropic | Drafts the note, letters and summaries from the transcript | Transcript and the patient details needed for the note |
| OtoWA | Sends WhatsApp messages from your clinic's number, only if your clinic connects it | The parent's phone number and the message your clinic chooses to send |
OpenAI and Anthropic process audio and text through their business APIs. Under those terms, your data is not used to train their models. Each may keep request data for a limited period to detect abuse, as their published terms describe.
If your clinic sets up its own email server in Catat, emails are sent through that server, which your clinic controls.
Access
Who can see your data
- iYour clinic's team, according to the role and permissions your clinic owner sets. Each clinic can reach only its own data.
- iiPPSB staff and engineers working for PPSB, under confidentiality, and only to set up your account, fix a fault you report, keep the service secure, or when the law requires it.
- iiiPPSB's own admin tools show each clinic's name, account owner, number of notes and AI costs. They do not show patient names, recordings or notes.
Security
How data is protected
- iData is encrypted in transit (HTTPS) and at rest on Google Cloud.
- iiEvery request must come from a signed-in member of the clinic that owns the data.
- iiiAI provider keys and other secrets are held on the server and never sent to the browser.
- ivThe database is backed up daily, and can be restored to any point in the previous 7 days.
Retention
How long data is kept
Records, audio and documents are kept for as long as your clinic uses Catat, so your team can return to them. Your clinic remains responsible for keeping medical records for the period the law and MMC guidance require.
If your clinic stops using Catat, the clinic owner can ask us to export your data and then delete it. We delete it within 30 days of the request. Copies in backups expire within a further 7 days.
Breaches
If something goes wrong
If we become aware of a personal data breach affecting your clinic's data, we will tell your clinic without undue delay, and within 72 hours. We will give you the information you need to notify the Personal Data Protection Commissioner and, where the breach is likely to cause significant harm, the affected parents or patients, as the PDPA requires of data controllers.
Your clinic
What your clinic is responsible for
- iTelling parents or patients that a consultation is being recorded, and getting their explicit consent first.
- iiReviewing every AI-drafted note, letter or certificate before it is signed or sent.
- iiiGiving team members only the access they need, and removing people who leave.
- ivAnswering access and correction requests from parents or patients. We will help with any data held in Catat.
Contact
Contact
Data protection questions, requests and breach reports: catat@ppsb.com, or WhatsApp +60 12 317 0015.
PPSB's data protection officer is Ejaz Abdul Kayum, reachable at the same email address.
Catat is developed by Purple Playhouse Sdn Bhd, Malaysia.