COTechEnterprise is operated by C&O Tech Enterprise, a business registered in Malaysia with the Companies Commission of Malaysia (SSM).
This Privacy Policy explains how C&O Tech Enterprise, trading as COTechEnterprise ("COTechEnterprise", "COTech", "we", "us" or "our"), collects, uses, stores, discloses and protects personal data when individuals and businesses use our websites, software, AI-powered chatbot services, WhatsApp integrations, live-chat services and related products.
We are committed to handling personal data responsibly and in accordance with applicable data protection laws, including the Personal Data Protection Act 2010 (Act 709) of Malaysia, as amended from time to time.
1. Scope of this Privacy Policy
This Privacy Policy applies to personal data processed through:
- the COTechEnterprise website;
- COTechEnterprise clinic and business accounts;
- our administrative dashboard;
- our AI chatbot and messaging services;
- WhatsApp Business integrations;
- communications between clinics, their staff, patients and COTechEnterprise;
- customer support, billing and account-management activities; and
- other services operated by COTechEnterprise that link to this Privacy Policy.
This Privacy Policy may apply differently depending on whether you are a clinic or business customer, an authorised staff member, a patient or end user communicating with a clinic, or a visitor to our website.
2. Our role in processing personal data
COTechEnterprise may process personal data in different capacities depending on the circumstances.
For information relating to our own customers, website visitors, account holders, billing contacts and business operations, COTechEnterprise generally determines why and how the information is processed.
Where a clinic uses COTechEnterprise to process patient conversations, messages or related information on the clinic's behalf, the clinic generally determines the purposes for which that patient information is processed, while COTechEnterprise provides the technology and processes the information to provide the contracted service.
Clinics using COTechEnterprise remain responsible for their own privacy obligations, including providing appropriate privacy notices and obtaining any permissions or consents required for their collection and use of patient information.
3. Personal data we may collect
Depending on how you interact with COTechEnterprise, we may collect or process the following categories of information.
Clinic and business information
This may include:
- clinic or business name;
- business registration information;
- business address;
- contact details;
- names and contact information of authorised representatives;
- billing and subscription information; and
- information necessary to establish and administer the business relationship.
User account information
For clinic staff and authorised users, this may include:
- name;
- email address;
- telephone number;
- account role and permissions;
- authentication information; and
- account activity.
Passwords are stored using secure password-hashing methods rather than in plain text.
Patient and conversation information
When a person communicates with a clinic through a channel connected to COTechEnterprise, we may process:
- telephone number or messaging identifier;
- message content;
- message timestamps;
- conversation history;
- attachments or media submitted through supported channels;
- chatbot and live-agent interactions;
- appointment-related enquiries;
- service or treatment enquiries; and
- other information voluntarily included in the conversation.
Health and sensitive personal data
Because COTechEnterprise provides services to clinics, conversations may contain information relating to a person's health, symptoms, dental concerns, treatment history or treatment enquiries.
Such information may constitute sensitive personal data under applicable law.
COTechEnterprise processes such information only where necessary to provide the relevant clinic's communication, chatbot, support or related services and, where applicable, on the clinic's instructions.
Patients and users should avoid submitting identification numbers, financial account details, full payment-card information or other highly sensitive information that is unnecessary for the purpose of their enquiry.
WhatsApp and Meta integration information
When a clinic connects its WhatsApp Business account to COTechEnterprise, including through Meta's Embedded Signup process, we may process information necessary to establish and maintain that integration, including:
- WhatsApp Business Account identifiers;
- Meta business identifiers;
- WhatsApp phone-number identifiers;
- display telephone numbers;
- integration status;
- access credentials or access tokens;
- webhook events;
- messaging metadata; and
- related configuration information.
We use this information to connect the clinic's authorised WhatsApp Business account, receive and deliver messages, maintain the integration, troubleshoot problems and provide the COTechEnterprise service.
Technical and usage information
We may automatically collect technical information such as:
- IP address;
- browser and device information;
- operating system;
- login and access logs;
- timestamps;
- application events;
- security logs;
- diagnostic information;
- error logs; and
- basic service-usage information.
We use this information primarily for security, reliability, troubleshooting and service administration.
4. Sources of personal data
We may obtain personal data:
- directly from clinic customers and their authorised staff;
- directly from patients or other individuals who communicate through channels connected to COTechEnterprise;
- from Meta, WhatsApp or other platforms authorised by a clinic;
- from our websites, forms and account-registration processes;
- automatically through use of our websites and services; and
- from service providers where necessary to provide the service.
Where a clinic provides personal data to COTechEnterprise, the clinic is responsible for ensuring that it is authorised to provide that information to us for the relevant purpose.
5. Why we process personal data
We may process personal data where necessary to:
- create, authenticate and administer accounts;
- provide COTechEnterprise's chatbot, messaging and live-agent services;
- process and respond to messages;
- provide clinic information requested by users;
- support appointment-related communications;
- connect and operate WhatsApp Business and other authorised integrations;
- provide customer and technical support;
- maintain conversation history and service continuity;
- monitor service reliability and diagnose technical issues;
- detect fraud, misuse, security incidents and unauthorised access;
- administer subscriptions, invoices and payments;
- communicate important service or account information;
- comply with applicable laws and lawful requests;
- establish, exercise or defend legal rights; and
- evaluate and improve the quality and reliability of our services.
We do not sell personal data.
We do not use patient conversation data for third-party advertising.
Where we use information for product evaluation, testing or improvement, we seek to minimise the personal data involved and use aggregated, anonymised or de-identified information where reasonably practicable.
6. Artificial intelligence processing
COTechEnterprise uses artificial intelligence technologies to provide certain chatbot and automation features.
When a user sends a message to an AI-powered service, relevant portions of the message and necessary conversational context may be processed by COTechEnterprise systems and by technology service providers used to operate the AI service.
Such processing may be used to:
- understand the user's request;
- retrieve relevant clinic information;
- generate an appropriate response;
- identify when human assistance may be required;
- maintain conversational context;
- detect errors or inappropriate system behaviour; and
- maintain and improve service quality.
AI-generated responses are intended to support communication between clinics and users. COTechEnterprise does not replace the professional judgement of a qualified healthcare professional.
We do not sell patient conversations or use them for advertising purposes.
We do not use identifiable patient conversation content to train or fine-tune general-purpose artificial intelligence models.
7. Whether providing personal data is required
Certain information is necessary for us to provide our services.
For example, a clinic must provide the information required to create an account and connect its authorised WhatsApp Business account if it wishes to use the WhatsApp integration.
Clinic staff must provide the information required to create and secure their accounts.
Patients are generally free to decide what information they include in their messages. However, a clinic may be unable to properly respond to an enquiry if insufficient information is provided.
Where information is optional, users may choose not to provide it.
8. How we disclose personal data
We may disclose or make personal data available to the following categories of recipients where reasonably necessary.
The relevant clinic
Patient messages and related information are accessible to the clinic with which the patient is communicating and to authorised members of that clinic's staff.
Technology and service providers
We may use third-party providers to operate parts of COTechEnterprise, including:
- cloud and server hosting;
- artificial intelligence processing;
- database and infrastructure services;
- email delivery;
- authentication and security;
- analytics and monitoring;
- payment processing; and
- technical support.
These providers may process information only to the extent necessary for the services they provide to us and subject to applicable contractual, security and data-protection requirements.
Communication platforms
Information may be exchanged with communication providers such as Meta and WhatsApp where necessary to send and receive messages or provide integrations requested by a clinic.
Use of those third-party platforms is also subject to their respective terms and privacy policies.
Professional advisers
We may disclose information to professional advisers, auditors, accountants, insurers or legal advisers where reasonably necessary.
Authorities and legal requirements
We may disclose information where required or permitted by applicable law, regulation, court order or lawful request from an authority, or where reasonably necessary to protect our legal rights, systems, users or the public.
We do not disclose patient conversations from one clinic to another clinic except where specifically authorised and legally permitted.
9. International transfers
COTechEnterprise operates in Malaysia, but some of the technology providers used to operate our services may process or store information outside Malaysia.
Where personal data is transferred outside Malaysia, we take reasonable steps to ensure that such transfers comply with applicable data-protection requirements and that appropriate safeguards are applied.
This may include assessing the destination and recipient, implementing contractual protections and applying technical or organisational safeguards appropriate to the nature of the data.
10. Data retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, to provide our services, to satisfy contractual requirements, to resolve disputes and to comply with legal or regulatory obligations.
Retention periods may vary depending on the type of information.
Clinic account and contractual information may be retained for the duration of the business relationship and for an appropriate period afterwards where required for legal, accounting or record-keeping purposes.
Conversation information is retained in accordance with the configuration and requirements of the relevant clinic and COTechEnterprise's applicable retention procedures.
Technical and security logs are generally retained for shorter periods unless they are required to investigate a security incident, misuse or technical problem.
Where personal data is no longer required, we will take reasonable steps to delete, anonymise or otherwise securely dispose of it.
Some information may remain temporarily in secure backups until those backups are overwritten in accordance with our backup-retention procedures.
11. Security
We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, misuse, loss or destruction.
Measures may include, as appropriate:
- HTTPS and encrypted network communications;
- authentication and access controls;
- role-based access restrictions;
- secure password hashing;
- controlled access to systems and credentials;
- system and security logging;
- software and infrastructure maintenance; and
- monitoring and incident-response procedures.
Access to patient conversations within a clinic is restricted to authorised users according to the clinic's account configuration.
No internet-based system can provide absolute security, and we therefore cannot guarantee that unauthorised access or other security incidents will never occur.
12. Your rights
Subject to applicable law and relevant exceptions, individuals may have rights concerning their personal data, including the right to:
- request access to personal data held about them;
- request correction of inaccurate, incomplete or misleading information;
- withdraw consent where processing depends on consent;
- request that certain processing be limited;
- request deletion of personal data where applicable; and
- make enquiries or complaints regarding the handling of their personal data.
Where COTechEnterprise processes patient information on behalf of a clinic, patients should normally contact the clinic with which they communicated first.
COTechEnterprise will reasonably assist the clinic in responding to applicable privacy requests where required.
Requests relating directly to information controlled by COTechEnterprise may be submitted using the contact information in Section 18.
We may request reasonable information to verify the identity and authority of a person making a request before disclosing, correcting or deleting personal data.
13. Data deletion
Individuals and clinic customers may request deletion of applicable personal data held by COTechEnterprise.
Requests may be submitted to:
Please use the subject:
Data Deletion Request
The request should provide enough information for us to identify the relevant account or data, such as the account email address, clinic name or telephone number associated with the service. Do not send passwords or unnecessary sensitive information.
We may verify the identity or authority of the requester before processing a deletion request.
Where the information is controlled by a clinic, we may refer or coordinate the request with the relevant clinic.
We will delete or anonymise information that is no longer required, subject to applicable legal, contractual, security and record-retention obligations.
Certain information may need to be retained where required by law, necessary to establish or defend legal claims, required for fraud or security investigations, or temporarily present in scheduled backups.
Further instructions are available on our Data Deletion Instructions page.
14. WhatsApp and third-party platforms
COTechEnterprise integrates with WhatsApp Business and may integrate with other third-party communication platforms.
When a clinic authorises such an integration, COTechEnterprise uses the authorised account information and credentials only for purposes associated with providing and maintaining the requested integration and related services.
Messages transmitted through WhatsApp are also processed by Meta and WhatsApp under their own applicable terms, policies and privacy practices.
Clinics are responsible for ensuring that their use of WhatsApp Business through COTechEnterprise complies with applicable WhatsApp Business policies and applicable law.
15. Cookies and similar technologies
Our websites and applications may use cookies or similar technologies that are necessary for functions such as authentication, security, session management and user preferences.
We may also use analytics or performance technologies to understand how our services operate and to improve reliability.
Where required by applicable law, we will obtain appropriate consent before using non-essential cookies or similar technologies.
Users may also control certain cookies through their browser settings. Disabling necessary cookies may prevent some features from functioning correctly.
16. Children and minors
COTechEnterprise is a business service intended for use by clinics and authorised business users.
However, clinics may provide healthcare services to children and minors, and communications processed through COTechEnterprise may therefore contain information relating to a minor.
Where information relating to a minor is processed, the relevant clinic is responsible for ensuring that it has the appropriate authority, notices and consents required by applicable law, including from a parent or legal guardian where necessary.
COTechEnterprise processes such information only for purposes associated with providing the relevant services.
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technology, business practices or legal obligations.
The current version will be published on our website and identified by the Last updated date above.
Where a change materially affects how we process personal data, we may provide additional notice where appropriate.
18. Contact us
Questions, requests or complaints concerning this Privacy Policy or COTechEnterprise's handling of personal data may be directed to:
C&O Tech Enterprise (COTechEnterprise)
Petaling Jaya, Selangor Darul Ehsan, Malaysia
Email: cotech.startup@gmail.com
Telephone: +60 10-521 2333
Website: www.cotechenterprise.com
For data access, correction or deletion requests, please provide sufficient information for us to identify the relevant data and verify your request.