Dasar Privasi — Al-Irsyad
Berkuat kuasa: 1 September 2026 · Versi 1.0 · Dokumen ini bukan nasihat guaman.
1. Pengenalan
Aplikasi Pusat Rawatan Al-Irsyad ("Aplikasi") ialah sistem pengurusan klinik rawatan Islam (ruqyah, tepuk dan rawatan berkaitan) yang digunakan oleh pesakit, perawat dan kakitangan pentadbiran.
Dasar Privasi ini menerangkan cara data peribadi anda dikumpul, digunakan, didedahkan dan dilindungi apabila anda menggunakan Aplikasi berhubung perkhidmatan Pusat Rawatan Al-Irsyad.
Pengawal data:
- Pusat Rawatan Al Irsyad (202403287925 (JM1013991-D)) — pengawal data bagi data pendaftaran pesakit, rekod klinikal, kehadiran perawat, kredensial dan sumbangan.
- GENQIRA TECHNOLOGY SOLUTIONS — pengendali platform teknikal yang menyediakan Aplikasi; pengawal bersama bagi data akaun, keselamatan dan operasi platform.
Kedua-dua pihak memproses data peribadi menurut Akta Perlindungan Data Peribadi 2010 [Akta 709] ("APDP") dan peraturan-peraturannya, sebagaimana dipinda. Dengan mendaftar atau menggunakan Aplikasi, anda mengesahkan bahawa anda telah membaca dan memahami Dasar Privasi ini.
2. Data peribadi yang kami kumpul
2.1 Data yang anda berikan
| Kategori | Butiran |
|---|---|
| Identiti | Nama penuh, gelaran, nama panggilan, No. Kad Pengenalan (MyKad) atau No. Pasport, tarikh lahir, jantina, warganegara, kewarganegaraan |
| Hubungan | No. telefon, no. telefon alternatif, e-mel, alamat surat-menyurat (alamat, bandar, daerah, negeri, poskod, negara) |
| Hubungan kecemasan | Nama, no. telefon dan pertalian |
| Keluarga / tanggungan | Butiran asas individu lain yang anda daftar atau tempah pihak untuk mereka, dan pertalian mereka dengan anda |
| Profil pesakit | No. Rekod Perubatan (MRN), nama ibu, nama bapa, taraf perkahwinan, pekerjaan, jawatan, majikan |
| Profil perawat | No. keahlian / kad perawat, kod perawat, No. Pendaftaran KKM, lesen & kredensial dan tarikh sah laku, kepakaran, rekod kehadiran & cuti, KPI |
| Data akaun | Nama pengguna, kata laluan (disimpan sebagai hash), peranan/akses, kod pengesahan dua faktor |
| Kesihatan (sensitif) | Simptom & aduan semasa tempahan, catatan pesakit, penilaian & pemerhatian perawat, nota rawatan, hasil rawatan, cadangan susulan, sejarah lawatan |
| Foto | Gambar profil (jika dimuat naik) |
| Pembayaran & sumbangan | Jumlah, kaedah bayaran (FPX, DuitNow, kad, tunai), nama/e-mel/telefon pembayar, rujukan transaksi, no. resit |
2.2 Data yang dikumpul secara automatik
| Kategori | Butiran |
|---|---|
| Lokasi geografi | Koordinat GPS peranti semasa anda membuat daftar masuk — untuk mengesahkan anda dalam lingkungan 50 m dari klinik; dan koordinat yang anda pilih sendiri pada peta semasa mengemas kini alamat. Aplikasi tidak menjejaki lokasi anda di latar belakang. |
| Data penggunaan & peranti | Versi aplikasi, jenis peranti/OS, alamat IP, tarikh/masa log masuk, bilangan cubaan log masuk gagal, dan jejak audit tindakan dalam sistem |
| Nombor giliran | Nombor giliran, status giliran dan masa menunggu semasa lawatan |
2.3 Kami tidak mengumpul
Aplikasi ini tidak menggunakan SDK pengiklanan, tidak membina profil pemasaran, dan tidak menjual data peribadi anda.
3. Data peribadi sensitif & persetujuan
Menurut Seksyen 40 APDP, maklumat kesihatan dan maklumat kepercayaan agama anda ialah data peribadi sensitif. Oleh sebab Aplikasi menyediakan rawatan Islam, penggunaannya mendedahkan konteks keagamaan, dan rekod klinikal mengandungi maklumat kesihatan. Kami memproses data ini berdasarkan persetujuan nyata yang anda berikan semasa pendaftaran dan tempahan, dan bagi maksud rawatan perubatan oleh atau di bawah tanggungjawab seorang pengamal. Anda boleh menarik balik persetujuan (Bahagian 11); berbuat demikian mungkin menyebabkan kami tidak dapat menyediakan rawatan melalui Aplikasi.
4. Tujuan pemprosesan
- Mencipta dan mengurus akaun serta mengesahkan identiti anda;
- Memproses tempahan rawatan, daftar masuk berasaskan lokasi, penjanaan nombor giliran dan pengurusan barisan;
- Menyediakan rawatan, merekod penilaian klinikal, hasil dan temu janji susulan;
- Membolehkan perawat yang merawat anda melihat sejarah lawatan berkaitan — termasuk rawatan yang diterima di bawah organisasi lain — semata-mata untuk rawatan yang selamat;
- Memproses pembayaran dan sumbangan (termasuk pengiraan agihan antara klinik dan perawat);
- Mengurus kredensial, lesen, kehadiran dan agihan pendapatan perawat;
- Menghantar pemberitahuan berkaitan perkhidmatan (pengesahan e-mel, set semula kata laluan, status giliran, peringatan temu janji);
- Mengekalkan keselamatan, mencegah penipuan, menyelesaikan pertikaian dan menyimpan jejak audit;
- Mematuhi kewajipan undang-undang dan kehendak pihak berkuasa kawal selia (cth. Kementerian Kesihatan Malaysia).
5. Asas di sisi undang-undang
Kami bergantung pada satu atau lebih: (a) persetujuan anda; (b) keperluan pelaksanaan kontrak dengan anda; (c) mematuhi kewajipan undang-undang; (d) melindungi kepentingan penting anda (cth. kecemasan perubatan); (e) kepentingan sah kami untuk mengendali dan menjaga keselamatan Aplikasi.
6. Pendedahan kepada pihak ketiga
| Penerima | Data | Tujuan |
|---|---|---|
| Perawat & kakitangan yang dibenarkan | Data pendaftaran, klinikal & giliran | Menyediakan dan mengurus rawatan |
| Organisasi rawatan Islam lain dalam platform (jika anda dirawat oleh perawat di bawahnya) | Sejarah lawatan berkaitan pesakit | Kesinambungan rawatan yang selamat |
| Gerbang pembayaran — ToyyibPay (Toyyib Pay Sdn Bhd) | Nama, e-mel, no. telefon, jumlah | Memproses pembayaran FPX/DuitNow/kad. Tertakluk dasar privasi ToyyibPay. |
| Pembekal e-mel (SMTP) | Alamat e-mel, kandungan mesej transaksi | E-mel pengesahan & set semula kata laluan |
| Teks-ke-suara — Microsoft Azure AI Speech | Nombor giliran sahaja (tiada nama/data kesihatan) | Pengumuman suara "nombor giliran dipanggil" |
| Pembekal hosting — Render, Neon & Vercel · Asia (Singapura) | Semua data tersimpan (tersulit semasa transit) | Hosting pangkalan data & aplikasi |
| Penasihat profesional, juruaudit, pihak berkuasa | Sebagaimana dikehendaki | Nasihat, pematuhan, perintah mahkamah atau kehendak berkanun |
| Gedung aplikasi (Google, Apple, Huawei) | Data teknikal pemasangan/kerosakan platform mereka | Pengedaran aplikasi. Tertakluk dasar masing-masing. |
Kami tidak berkongsi data dengan broker data atau rangkaian pengiklanan.
7. Pemindahan rentas sempadan
Data peribadi anda disimpan di Render, Neon & Vercel · Asia (Singapura). Jika pusat data terletak di luar Malaysia (cth. Singapura), pemindahan dibuat dengan perlindungan setara APDP melalui terma kontrak dengan pembekal dan dengan persetujuan anda ke atas Dasar Privasi ini. ToyyibPay dikendalikan di Malaysia.
8. Kebenaran peranti
| Kebenaran | Bila diminta | Kegunaan | Jika ditolak |
|---|---|---|---|
| Lokasi (semasa digunakan sahaja) | Kali pertama daftar masuk | Mengesahkan anda di klinik (50 m); memilih lokasi pada peta | Tidak boleh daftar masuk automatik; kakitangan pendaftaran bantu manual |
| Kamera | Bila anda pilih untuk ambil foto profil | Ambil gambar profil | Boleh muat naik dari galeri atau langkau |
| Galeri / Foto | Bila anda pilih untuk muat naik foto profil | Pilih gambar profil sedia ada | Foto profil kekal kosong |
| Internet | Sentiasa | Menyambung ke pelayan | Aplikasi tidak berfungsi |
Aplikasi tidak menggunakan lokasi latar belakang, mikrofon, kenalan, kalendar atau pemberitahuan tolak sistem pada masa ini. Jika ditambah kelak, Dasar Privasi ini dikemas kini terlebih dahulu.
9. Tempoh pengekalan
- Rekod rawatan / perubatan: sekurang-kurangnya 7 tahun dari lawatan terakhir, selaras amalan rekod perubatan swasta di Malaysia (rujuk Akta Kemudahan dan Perkhidmatan Jagaan Kesihatan Swasta 1998 dan peraturannya). Bagi pesakit bawah umur, sekurang-kurangnya 7 tahun selepas mencapai umur 18.
- Data akaun & log audit: sepanjang akaun aktif dan sehingga 7 tahun selepas ditutup.
- Rekod pembayaran: 7 tahun bagi tujuan percukaian dan perakaunan.
- Selepas tempoh berkenaan, data dipadam atau dijadikan tanpa nama secara selamat.
10. Keselamatan data
Langkah teknikal dan organisasi yang munasabah: penyulitan semasa transit (HTTPS/TLS), kata laluan di-hash, pengesahan dua faktor, kawalan capaian berasaskan peranan, pengasingan data antara organisasi, pembalakan audit, dan pengehadan pendedahan kunci pihak ketiga. Tiada sistem yang selamat sepenuhnya; anda bertanggungjawab menjaga kerahsiaan kata laluan anda.
11. Hak anda di bawah APDP
Tertakluk kepada pengecualian undang-undang, anda berhak untuk: akses, pembetulan, menarik balik persetujuan, menghadkan pemprosesan (termasuk pemasaran langsung, yang tidak kami lakukan), mudah alih data, dan membuat aduan. Anda juga boleh memadam akaun anda dari dalam Aplikasi (Profil Saya › Privasi & Data).
Untuk melaksanakan hak ini, hubungi Pegawai Perlindungan Data di admin@irsyad.my. Kami membalas dalam tempoh yang ditetapkan undang-undang (pada amnya 21 hari), mungkin mengenakan fi yang dibenarkan, dan perlu mengesahkan identiti anda. Sesetengah data (cth. No. Kad Pengenalan dan rekod klinikal sejarah) tidak boleh dipadam sepenuhnya semasa tempoh pengekalan berkanun.
12. Kanak-kanak & individu di bawah jagaan
Aplikasi boleh digunakan untuk menempah rawatan bagi kanak-kanak dan tanggungan oleh ibu bapa atau penjaga sah. Dengan mendaftarkan seorang tanggungan, anda mengesahkan anda mempunyai kuasa undang-undang untuk berbuat demikian dan untuk bersetuju dengan pemprosesan data peribadi mereka bagi pihak mereka. Kanak-kanak tidak sepatutnya mendaftar akaun sendiri tanpa pengawasan ibu bapa/penjaga.
13. Pautan pihak ketiga
Aplikasi mungkin memaparkan pautan ke laman pihak ketiga (cth. halaman pembayaran ToyyibPay). Dasar ini tidak terpakai kepada laman tersebut; sila rujuk dasar privasi mereka.
14. Perubahan kepada Dasar Privasi
Kami mungkin mengemas kini dasar ini dari semasa ke semasa. Versi terkini sentiasa tersedia di https://portal.irsyad.my/dasar-privasi dengan tarikh kuat kuasa dikemas kini. Perubahan material diberitahu melalui Aplikasi atau e-mel. Penggunaan berterusan selepas perubahan menandakan penerimaan anda.
15. Hubungi kami & aduan
Pegawai Perlindungan Data — Pusat Rawatan Al Irsyad
Pegawai Perlindungan Data
E-mel: admin@irsyad.my
Telefon: +60 11-1000 0588
Alamat: 1, Jalan SB 7, Taman Seri Bestari, 43900 Sepang, Selangor
Pengendali platform: GENQIRA TECHNOLOGY SOLUTIONS — support@genqira.com
Jika anda tidak berpuas hati dengan jawapan kami, anda boleh membuat aduan kepada:
Jabatan Perlindungan Data Peribadi (JPDP), Kementerian Digital, Malaysia
Aras 6, Kompleks Kementerian Digital, Lot 4G9, Persiaran Perdana, Presint 4, 62100 Putrajaya
www.pdp.gov.my
Privacy Policy — Al-Irsyad
Effective: 1 September 2026 · Version 1.0 · This document is not legal advice.
1. Introduction
Pusat Rawatan Al-Irsyad (the "App") is a management system for Islamic treatment clinics (ruqyah, tepuk and related treatments), used by patients, practitioners and administrative staff.
This Privacy Policy explains how your personal data is collected, used, disclosed and protected when you use the App in connection with the services of Pusat Rawatan Al-Irsyad.
Data controllers:
- Pusat Rawatan Al Irsyad (202403287925 (JM1013991-D)) — controller of patient registration data, clinical records, practitioner attendance, credentials and contributions.
- GENQIRA TECHNOLOGY SOLUTIONS — operator of the technical platform that provides the App; joint controller of account, security and platform-operations data.
Both parties process personal data in accordance with the Personal Data Protection Act 2010 [Act 709] ("PDPA") and its subsidiary regulations, as amended. By registering for or using the App, you confirm that you have read and understood this Privacy Policy.
2. Personal data we collect
2.1 Data you provide
| Category | Details |
|---|---|
| Identity | Full name, title, nickname, NRIC / MyKad number or passport number, date of birth, gender, nationality, citizenship |
| Contact | Phone, alternate phone, email, mailing address (address, city, district, state, postcode, country) |
| Emergency contact | Name, phone and relationship |
| Family / dependants | Basic details of other individuals you register or book for, and their relationship to you |
| Patient profile | Medical Record Number (MRN), mother's name, father's name, marital status, occupation, job title, employer |
| Practitioner profile | Membership / practitioner card number, practitioner code, KKM registration number, licences & credentials and validity dates, specialisations, attendance & leave, KPIs |
| Account data | Username, password (stored as a non-reversible hash), role/access, 2FA codes |
| Health (sensitive) | Symptoms & complaints entered at booking, patient remarks, practitioner assessments & observations, treatment notes, outcomes, follow-up recommendations, visit history |
| Photos | Profile photo (if uploaded) |
| Payments & contributions | Amount, payment method (FPX, DuitNow, card, cash), payer name/email/phone, transaction references, receipt numbers |
2.2 Data collected automatically
| Category | Details |
|---|---|
| Geolocation | Your device's GPS coordinates at the moment you check in — to verify you are within 50 m of the clinic; and coordinates you pin yourself on a map when updating your address. The App does not track your location in the background. |
| Usage & device data | App version, device/OS type, IP address, login date/time, failed login attempt count, and an audit trail of actions in the system |
| Queue data | Queue number, queue status and waiting time during a visit |
2.3 What we do not collect
The App uses no advertising SDKs, builds no marketing profiles, and does not sell your personal data.
3. Sensitive personal data & consent
Under Section 40 of the PDPA, your health information and religious-belief information are sensitive personal data. Because the App provides Islamic treatment, your use of it discloses a religious context, and clinical records contain health information. We process this data on the basis of the explicit consent you give at registration and booking, and for the purpose of medical treatment provided by or under the responsibility of a practitioner. You may withdraw consent (Section 11); doing so may mean we can no longer provide treatment through the App.
4. Purposes of processing
- Create and manage your account and verify your identity;
- Process treatment bookings, location-based check-in, queue-number issuance and queue management;
- Deliver treatment and record clinical assessments, outcomes and follow-up appointments;
- Allow the practitioner treating you to view your relevant visit history — including treatment received under other organisations — solely for safe treatment;
- Process payments and contributions (including the clinic/practitioner contribution split);
- Manage practitioner credentials, licences, attendance and revenue distribution;
- Send service-related notifications (email verification, password reset, queue status, appointment reminders);
- Maintain security, prevent fraud, resolve disputes and keep an audit trail;
- Comply with legal obligations and regulator requirements (e.g. the Ministry of Health Malaysia).
5. Legal basis
We rely on one or more of: (a) your consent; (b) necessity for performance of a contract with you; (c) compliance with our legal obligations; (d) protection of your vital interests (e.g. a medical emergency); (e) our legitimate interests in operating and securing the App.
6. Disclosure to third parties
| Recipient | Data | Purpose |
|---|---|---|
| Authorised practitioners & staff | Registration, clinical & queue data | Delivering and managing treatment |
| Other Islamic-treatment organisations on the platform (if you are treated by a practitioner under one) | Relevant patient visit history | Continuity of safe care |
| Payment gateway — ToyyibPay (Toyyib Pay Sdn Bhd) | Name, email, phone, amount | Processing FPX/DuitNow/card payments. Subject to ToyyibPay's privacy policy. |
| Email (SMTP) provider | Email address, transactional message content | Verification & password-reset emails |
| Text-to-speech — Microsoft Azure AI Speech | Queue number only (no name/health data) | "Queue number called" voice announcement |
| Hosting provider — Render, Neon & Vercel · Asia (Singapura) | All stored data (encrypted in transit) | Database & application hosting |
| Professional advisers, auditors, authorities | As required | Advice, compliance, court orders or statutory requirements |
| App stores (Google, Apple, Huawei) | Technical install/crash data collected by their platforms | App distribution. Subject to their respective policies. |
We do not share data with data brokers or advertising networks.
7. Cross-border transfer
Your personal data is stored with Render, Neon & Vercel · Asia (Singapura). Where the data centre is outside Malaysia (e.g. Singapore), the transfer is made with protection equivalent to the PDPA through contractual terms with the provider, and with your consent to this Privacy Policy. ToyyibPay is operated in Malaysia.
8. Device permissions
| Permission | When requested | Use | If declined |
|---|---|---|---|
| Location (while in use only) | The first time you check in | Verify you are at the clinic (within 50 m); pin a location on a map | You cannot check in automatically; registration staff assist manually |
| Camera | When you choose to take a profile photo | Capture a profile photo | Upload from the gallery or skip |
| Photos / Gallery | When you choose to upload a profile photo | Select an existing profile photo | Profile photo stays empty |
| Internet | Always | Connect to the server | The App does not function |
The App does not use background location, microphone, contacts, calendar or system push notifications at this time. If such features are added later, this Privacy Policy will be updated first.
9. Retention
- Treatment / medical records: at least 7 years from the last visit, consistent with private medical-records practice in Malaysia (cf. the Private Healthcare Facilities and Services Act 1998 and its regulations). For minor patients, at least 7 years after they turn 18.
- Account data & audit logs: while the account is active and for up to 7 years after closure.
- Payment records: 7 years for tax and accounting purposes.
- After the applicable period, data is securely deleted or anonymised.
10. Data security
Reasonable technical and organisational measures: encryption in transit (HTTPS/TLS), hashed passwords, two-factor authentication, role-based access control, data isolation between organisations, audit logging, and restricted exposure of third-party keys. No system is completely secure; you are responsible for keeping your password confidential.
11. Your rights under the PDPA
Subject to legal exceptions, you have the right to: access, correction, withdraw consent, restrict processing (including direct marketing, which we do not do), data portability, and to complain. You can also delete your account from within the App (Profil Saya › Privasi & Data).
To exercise these rights, contact the Data Protection Officer at admin@irsyad.my. We respond within the period required by law (generally 21 days), may charge a permitted fee, and must verify your identity. Some data (e.g. NRIC number and historical clinical records) cannot be fully deleted while the statutory retention period is running.
12. Children & dependants
The App may be used to book treatment for children and dependants by their parent or legal guardian. By registering a dependant, you confirm that you have legal authority to do so and to consent to the processing of their personal data on their behalf. Children should not register their own account without parental/guardian supervision.
13. Third-party links
The App may display links to third-party sites (e.g. the ToyyibPay payment page). This Policy does not apply to those sites; please refer to their own privacy policies.
14. Changes to this Privacy Policy
We may update this Policy from time to time. The current version is always available at https://portal.irsyad.my/dasar-privasi with an updated effective date. Material changes are notified through the App or by email. Continued use after a change signifies acceptance.
15. Contact us & complaints
Data Protection Officer — Pusat Rawatan Al Irsyad
E-mail: admin@irsyad.my
Phone: +60 11-1000 0588
Address: 1, Jalan SB 7, Taman Seri Bestari, 43900 Sepang, Selangor
Platform operator: GENQIRA TECHNOLOGY SOLUTIONS — support@genqira.com
If you are not satisfied with our response, you may lodge a complaint with:
Department of Personal Data Protection (JPDP), Ministry of Digital, Malaysia
Level 6, Kompleks Kementerian Digital, Lot 4G9, Persiaran Perdana, Precinct 4, 62100 Putrajaya
www.pdp.gov.my