Last updated: September 25, 2026
Desk Clinic is operated by Sorable Sdn Bhd ("Sorable", "we", "us", or "our"), registration no. 201701047379, of B-5-8 Plaza Mont Kiara, Mont Kiara, 50480 Kuala Lumpur, Malaysia.
This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our website, create an account, or use Desk Clinic. Desk Clinic is software for scheduling, patient management, billing, and related clinic operations. This policy covers our marketing site, the product, and support channels.
Information We Collect
Information you provide directly
We collect information you provide when you:
- create or administer an account
- create an organization or invite team members
- contact us through forms, email, or support requests
- subscribe to updates or marketing communications
- purchase a subscription or other paid services
- upload files, notes, patient records, or other content into the platform
Depending on how you use Desk Clinic, this information may include:
- name, email address, and sign-in details
- organization and clinic profile details
- billing and transaction details
- support request contents and attachments
- patient or operational data entered by you or your organization, including identity details captured when a clinic scans a MyKad or enters a record
Information we collect automatically
When you use Desk Clinic, we automatically collect limited technical information such as:
- IP address and approximate location based on that address
- browser, device, and operating system information
- pages viewed, referring pages, and basic usage events
- timestamps, error logs, and diagnostic data
- cookie, local storage, and similar preference information
Information from third parties
We receive information from providers that help us operate the service, such as:
- authentication providers when you sign in with a third-party account
- payment processors for subscription and billing events
- email delivery providers that send transactional or product email on our behalf
- messaging providers (for example, Twilio) when your organization sends SMS or WhatsApp messages through the platform
- fraud-prevention and security services (for example, Cloudflare Turnstile) when you complete certain forms or sign-in flows
- AI model providers (for example, OpenAI) when you use optional AI-assisted product features. We send the prompt and the context needed to generate a response
- infrastructure, analytics, performance monitoring, and storage providers that support the platform
How We Use Information
We use personal information to:
- provide, maintain, secure, and improve Desk Clinic
- create and manage accounts, organizations, and subscriptions
- authenticate users and prevent unauthorized access
- process payments and billing-related transactions
- send service messages and security notices by email and, where your organization uses those features, by SMS or WhatsApp
- send product updates and marketing communications when you have subscribed to them
- respond to support requests and other communications
- monitor usage, troubleshoot issues, and improve performance, including through analytics tools such as Vercel Analytics and Vercel Speed Insights
- operate optional AI-assisted features, including sending inputs to AI providers and storing chat history for your organization
- detect fraud, abuse, or other unlawful activity
- comply with legal obligations and enforce our terms
How We Share Information
We share information in these cases:
- Service providers: with vendors that host the service, provide analytics, authentication, payments, messaging, support, or storage
- Within your organization: with users your clinic has authorized, according to your settings and permissions
- Legal and safety reasons: when required by law or legal process, or to protect the rights, safety, and security of Sorable, our users, or others
- Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets
- With your direction or consent: when you ask us to share information or connect a third-party service
We do not sell personal information.
Customer Data and the PDPA
If you use Desk Clinic for a clinic, practice, or other organization, that organization controls the data it submits, including patient and operational records. Under Malaysia's Personal Data Protection Act 2010 (PDPA), the organization is generally the data user for that information. Sorable processes it for the organization.
Health information is sensitive personal data under the PDPA. The organization is responsible for having a lawful basis to collect and use it, and for giving patients any notice the PDPA requires. The organization is also responsible for who can access records inside Desk Clinic, and for keeping records for as long as the law requires.
Cookies, Local Storage, and Similar Technologies
We use cookies and similar technologies to:
- keep users signed in and maintain session state
- remember language, sidebar, and other interface preferences
- store cookie consent preferences
- understand traffic, performance, and product usage, including through Vercel Analytics and Vercel Speed Insights, as described in our Cookie Policy
- support security checks such as Cloudflare Turnstile on certain pages
For more detail, see our Cookie Policy.
Data Retention
We keep information for as long as we need it to provide the service, keep security and business records, meet legal obligations, resolve disputes, and enforce agreements. How long we keep a record depends on the type of data, the customer relationship, and the legal requirement that applies.
Security
We use administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
International Processing
We and our service providers may process and store information in countries other than Malaysia. Where the law requires it, we take steps to protect those transfers.
Your Choices and Rights
You can ask us to:
- tell you what personal information we hold about you
- correct information that is inaccurate, incomplete, misleading, or out of date
- delete personal information where we are required or allowed to do so
- stop sending marketing messages you opted into
- stop processing that depends on your consent
- provide a copy of your information in a portable format, where the law gives you that right
In Malaysia, these requests sit alongside your rights under the PDPA. Requests about a patient's clinic record should go to that clinic. We may need to verify your identity before we complete a request. Some rights are limited by law.
Children
The marketing site and staff accounts are not for children. We do not knowingly let a child open a Desk Clinic account.
A clinic may store records about child patients. Those records are customer data the clinic submits, and the clinic is responsible for them.
Changes to This Policy
We may update this Privacy Policy from time to time. If we make a material change, we will post the updated version on this page and change the "Last updated" date above.
Contact
Sorable Sdn Bhd
B-5-8 Plaza Mont Kiara, Mont Kiara, 50480 Kuala Lumpur, Malaysia
Registration no. 201701047379
Questions about this Privacy Policy, and privacy requests, go to contact@desk.clinic.