How Jentra Clinic uses your details
This notice covers the Jentra Clinic app. It is for the owners, admins, managers and staff of a clinic. It is also for locums who ask for a shift through a slot link. You agree to this notice when you join Jentra Clinic. It is written in English and Malay as the Personal Data Protection Act 2010 asks.
- 01
Who is responsible
Jentra Labs Sdn. Bhd. (202601044573 (1706668-M)) runs Jentra Clinic. "Jentra" and "we" in this notice mean Jentra Labs Sdn. Bhd. Our address is No 20, Jalan Bunga Raya Satu, Kampung Baru, 68100 Batu Caves, Selangor.
- Your clinic decides what goes into the app about its staff, locums, shifts and leave. Your clinic is the data controller for that data. Jentra is its data processor. We process that data only to run the app for your clinic.
- Jentra is the data controller for your sign-in account. Jentra is also the data controller for the subscription and its payments.
- Your clinic can add people who never sign in. Your clinic is their data controller. Your clinic must tell them how it uses their details.
- 02
What we collect
- Your account: your email address, your name and your role in the clinic. Google gives us your name and email address when you sign in with Google.
- The people list that your clinic enters: name, phone number, email address, whether the person is staff or a locum, and the work the person does. A doctor's entry can also hold the MMC number and the expiry dates of the Annual Practising Certificate and the indemnity cover.
- Work details: the rate, the days and sessions a person is usually free, the clinics the person works at, the shifts and the leave requests. A leave request can hold a note.
- A do-not-book note. A clinic can mark a person as not to be booked. The clinic adds a short reason. Clinic members see the reason. The person does not see it in the app. The person may still ask for it with an access request.
- Locums who use a slot link: your name, your phone number, your MMC number if you give it, and the shifts you ask for. The link signs you in without an account. This lets the app tell your requests apart from other requests.
- For owners and admins who pay: the plan, the amounts and dates of payments, and the bank receipts you upload. A receipt can show your name, your bank and your account number.
- A one-way hash of the owner's email address. It records that a free trial was used. The same address then cannot start a second trial.
- Technical records of sign-ins: the time and the internet address. We keep them to keep the app secure.
Jentra Clinic does not take patient data. Do not enter any patient's details in it.
- 03
Why we use it
- We use it to run the roster for your clinic: the people list, shifts, leave and slot links.
- We use it to sign you in and keep the app secure.
- We use it to answer your support requests.
- We use it to bill the subscription, check payment receipts and keep the records the law asks for.
We never sell your details. We do not use them to train AI.
- 04
Where the data comes from
- You give us data when you sign up, use the app or fill in a slot link.
- Your clinic gives us data when a manager or admin adds you to the people list or records your shifts and leave.
- Google gives us your name and email address when you choose to sign in with Google.
- 05
What you must give
- An email address is required for an account. You cannot sign in without it.
- A name and a phone number are required for each person in the people list. The clinic cannot add the person without them.
- A slot link requires your name and phone number. The clinic cannot receive your request without them. Your MMC number is optional.
- A bank receipt is required to pay by bank transfer. Jentra cannot confirm the payment without it.
All other details are optional.
- 06
Who receives it
- People in your clinic see the data that their role allows. A manager sees only the clinics assigned to that manager.
- Jentra staff open clinic data only to give the support your clinic asks for, or to fix a fault that stops the app working.
- Google runs the app for us. Firebase Authentication handles sign-in. Google Cloud stores the data, runs the app's functions and keeps the uploaded receipts. Firebase Hosting serves the app's files.
- ZH Healthcare Sdn. Bhd. (1469895-W) collects subscription payments for Jentra until Jentra's bank account opens. It receives your bank transfer.
- Cloudflare runs Jentra's internal console. The console holds customer, invoice and payment records.
- Google stores the emails you send us. Brevo delivers the emails we send from hello@jentra.my. Anthropic runs the AI assistant that helps us sort emails and draft replies.
- A WhatsApp or call button opens the manager's own WhatsApp or phone. The app does not send the message itself.
- A government body or a court receives data when the law requires it.
- 07
Where it is stored
- Google Cloud stores the clinic data and the receipts in Singapore (the asia-southeast1 region). The app's database and its functions run in that region.
- Firebase Authentication processes sign-in data only in the United States. Google states this on its Firebase privacy page.
- Firebase Hosting serves the app's files from Google's global network. Those files hold none of your data.
- Cloudflare, Brevo and Anthropic may process data outside Malaysia.
Singapore and the United States are outside Malaysia. We tell you about these transfers here because the Commissioner's guideline on cross-border transfer asks for it.
- 08
How we protect it
- You sign in with Google or with an email address and a password. An email sign-in works only after you confirm the address.
- Database rules check each request. A person sees only the data of the clinic group they belong to.
- The app records who approved each leave request and who set each do-not-book note.
- Jentra staff who can reach clinic data must keep it confidential. They open it only to give the support your clinic asks for, or to fix a fault that stops the app working.
- 09
How long we keep it
- We keep clinic data while your clinic subscribes.
- The app becomes read-only for 14 days when a trial or paid period ends without payment. The account then locks.
- We keep the data for 90 days after an account locks. We tell the owner in writing before we delete it. The owner may ask us to delete it sooner.
- We keep payment receipts and invoices for 7 years as Malaysian tax and company law requires.
- We keep a locum's shift request from a slot link for 12 months after the shift.
- We keep the one-way hash of the owner's email address for 3 years. The hash stops a second free trial.
- 10
Your rights
- You may ask to see the personal data we hold about you. You may also ask for a copy.
- You may ask us to correct data that is wrong, incomplete, misleading or out of date.
- You may withdraw your consent by writing to us. We then stop processing your data. We cannot keep your account open without your consent.
- You may ask us to send your data to another service you choose. We do this when it is technically possible and the data format fits.
- You may limit what you give. You may leave the optional details blank.
- The owner can export the people, shifts, clinics and leave as CSV files.
Email hello@jentra.my from the address you sign in with to use a right. Say what you are asking for. We reply within 21 days. Your clinic decides on the data it entered. We pass your request to your clinic and help it reply.
- 11
Questions and complaints
Email hello@jentra.my about anything in this notice. You may also complain in writing to the Personal Data Protection Commissioner. The Commissioner's email address is aduan@pdp.gov.my.
- 12
Data protection officer
Jentra has not appointed a data protection officer. The Commissioner's guideline requires one above 20,000 people. The limit is 10,000 people for sensitive data. Jentra is below both numbers. Send privacy questions and requests to hello@jentra.my.
- 13
Data breaches
- A data breach means personal data is lost, misused or opened without permission.
- Jentra tells your clinic within 24 hours of becoming aware of a breach of clinic data. Your clinic then tells the Commissioner. Your clinic also tells the people affected when the law requires it. We help your clinic do so.
- Jentra tells the Personal Data Protection Commissioner about a breach of account or billing data within 72 hours. We tell you within 7 days after that when the breach is likely to cause you significant harm.
- 14
Changes to this notice
A changed notice gets a new version number and a new effective date. Both appear at the top of this page. The app records the version you accepted. We tell you about a new version by email and by a message in the app. You accept the notice again only when a change is material.