Privacy Policy

1. Who we are

This Privacy Policy describes how TicketHub (also known as Support Ticket Hub), a Smagsys clinic staff support console operated in Malaysia, collects and uses personal data. Clinics do not use the TicketHub web interface; clinic staff and requesters typically contact support via WhatsApp Business (Meta Cloud API) and a Telegram bot. Authenticated Smagsys staff use TicketHub to manage support tickets.

TicketHub is an IT/support ticketing and operations console. It is not a clinic electronic medical record (EMR) and is not intended to store clinical patient records.

2. Data we process

Staff accounts

For staff who sign in to TicketHub, we may process names, email addresses, SYSUID/login identifiers, branch, designation/role, and phone numbers (sourced from smagsys.staff_details / hub user records). Authentication uses a session cookie named scis_session (HMAC-signed, typically lasting about seven days).

Clinic / requester support data

To operate support tickets we may process ticket numbers, requester name, phone number, WhatsApp or Telegram chat identifiers, issue descriptions, comments and messages, attachments (such as screenshots or files), AnyDesk IDs, activity history, assignment details, invoice/billing-related fields stored in the hub, and attendance or notification settings where applicable.

Messaging providers

Message content and related metadata are processed via the Meta WhatsApp Cloud API and Telegram / n8n webhooks so that staff can receive and reply to support conversations.

3. Purpose of processing

We process personal data to:

• Operate clinic IT and support ticketing
• Authenticate staff and assign work
• Reply to requesters on WhatsApp and Telegram
• Support billing and invoice-related operations within the hub

We do not use TicketHub as a medical EMR or for clinical treatment records.

4. Sharing

Personal data may be shared with Meta (WhatsApp Cloud API) and Telegram / n8n as needed to send and receive support messages; with the SMAGSYS staff database for authentication; and with hosting infrastructure operated by the TicketHub operator. We do not sell personal data.

5. Retention

Data is retained for as long as needed for support operations and for legal or accounting purposes. Staff should follow the operator's internal retention practices.

6. Security

Access to TicketHub is limited to authenticated staff. The public service is served over HTTPS on the operator's domain. Application secrets are kept in server environment configuration, not in client-side code.

7. Your rights (PDPA)

Under Malaysia's Personal Data Protection Act (PDPA), you may have rights to access, correct, or request deletion of personal data where applicable. To exercise these rights, contact the organisation that operates TicketHub via https://tickethub.scis.com.my.

8. Children

TicketHub is directed at clinic support operations and staff. It is not directed at children.

9. Changes

We may update this Privacy Policy from time to time. The effective date shown at the top of this page will be revised when material changes are published.