Data Processing and Shared Control Agreement

Last updated: 31 October 2026

This agreement will be reviewed by counsel; we will tell you before any change. It forms part of the Terms of Service.

Parties

1. BOOK IN CHAT PTE. LTD. (UEN 202646792Z), registered office 60 Paya Lebar Road #06-28, Paya Lebar Square, Singapore 409051 (BookInChat, we). Data Protection Officer: Lee Cheng Han, dpo@bookinchat.com.
2. The business that registers for BookInChat and accepts the Terms of Service (the Shop), including a sole proprietor.

This Agreement is accepted electronically when the Shop accepts the Terms of Service. It applies for as long as BookInChat holds any Shop Customer Data.

1. Definitions

• Customer: an individual who contacts the Shop or is booked, served or recorded by the Shop through BookInChat (for example by WhatsApp message or a booking).
• Shop Customer Data: personal data about Customers that enters BookInChat through the Shop's use of the service: WhatsApp profile name and number, messages, voice notes, images and files, transcripts, bookings, service and package history, payment records the Shop enters, staff notes, and AI-generated summaries.
• Sensitive Data: (a) all Shop Customer Data of a Shop registered as, or operating as, a clinic or other healthcare or aesthetic-medical provider (Clinic); (b) any data, in any Shop, about a person's physical or mental health or condition, treatment, medication, pregnancy or medical history; (c) any other "sensitive personal data" under the MY PDPA (including biometric data) and data the PDPC treats as of a sensitive nature; and (d) identity-document numbers (NRIC, MyKad, passport) and financial account numbers.
• Shop Purposes: the purposes for which the Shop uses BookInChat: answering Customers, taking and managing bookings, reminders, records of services, packages and payments, marketing the Shop chooses to send, and the Shop's own business records.
• BookInChat Purposes: only (a) Service Operation: running, maintaining, troubleshooting and supporting the service, capacity planning, billing the Shop, and keeping records the law requires; (b) Security and Integrity: preventing, detecting and investigating security incidents, fraud, spam, abuse and breaches of the Acceptable Use Policy, and enforcing our terms; (c) Legal: complying with law, court orders and lawful requests from authorities, and establishing or defending legal claims; and (d) Improvement: improving the same Shop's own assistant using De-identified Data, as set out in clause 6.
• De-identified Data: data derived from Shop Customer Data from which BookInChat has removed or replaced direct identifiers and reduced indirect identifiers so that it can no longer reasonably be associated with an identified or identifiable individual, using the process in Schedule 2. De-identified Data is tagged with the Shop it came from.
• SG PDPA: Singapore Personal Data Protection Act 2012 and its regulations. MY PDPA: Malaysia Personal Data Protection Act 2010 (Act 709) as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727), and its regulations, standards and guidelines. Data Protection Law: both, and any other data protection law that applies to a party.
• "Controller" includes an "organisation" under the SG PDPA and a "data controller" under the MY PDPA. "Processor" includes a "data intermediary" under the SG PDPA and a "data processor" under the MY PDPA.

2. Roles (shared control)

2.1 The Shop is a controller of Shop Customer Data for the Shop Purposes. The Shop decides what it asks its Customers, what it records, which features it switches on, what its AI receptionist may say, and how long it keeps chats (within the settings BookInChat offers).

2.2 For the Shop Purposes, BookInChat processes Shop Customer Data on the Shop's behalf and only on the Shop's documented instructions (clause 3). For this processing BookInChat is the Shop's processor or data intermediary.

2.3 BookInChat is an independent controller of Shop Customer Data for the BookInChat Purposes. BookInChat decides how it processes data for those purposes and is responsible for that processing under Data Protection Law. BookInChat does not use Shop Customer Data for any other purpose, does not sell it, and does not use it to advertise to Customers or to market to them for BookInChat or any other business.

2.4 No joint determination beyond this Agreement. The parties do not jointly decide purposes beyond what this Agreement allocates. Where Data Protection Law nevertheless treats the parties as joint controllers of any processing, the allocation of responsibilities below is their arrangement for that processing.

2.5 Who does what.

• Notice to Customers (collection, purposes, AI use, both parties' roles, transfers): the Shop is primarily responsible and makes our notice for customers and its own privacy notice available (clause 4); BookInChat provides the notice and publishes its Privacy Policy.
• Legal basis and consent for the Shop Purposes, including explicit consent for Sensitive Data: the Shop; BookInChat supports this in the product (consent flows for Clinics).
• Legal basis for the BookInChat Purposes: BookInChat; the Shop passes on BookInChat's notice and does not block lawful processing.
• WhatsApp opt-in and opt-out (Meta policy): the Shop; BookInChat honours STOP automatically (clause 4.4).
• Access, correction, portability, deletion and withdrawal of consent: the Shop is the primary point of contact for the Shop Purposes; BookInChat handles requests about the BookInChat Purposes and assists the Shop (clause 7).
• Security of the platform: BookInChat (clause 8, Schedule 1); the Shop secures its own devices, staff accounts and passwords.
• Breach notification to regulators and Customers: the Shop for the Shop Purposes; BookInChat for the BookInChat Purposes, and BookInChat notifies the Shop (clause 9).
• Cross-border transfer obligations: the Shop for its own transfers and for engaging BookInChat; BookInChat provides transfer information and safeguards for its sub-processors (clause 10).
• Data Protection Officer contact: each party its own; BookInChat's is Lee Cheng Han, dpo@bookinchat.com.

3. Processing on the Shop's instructions (Shop Purposes)

3.1 The Shop's documented instructions are: this Agreement, the Terms of Service, the Shop's settings and configuration, and actions taken by the Shop's authorised users in the app.

3.2 BookInChat will tell the Shop promptly if, in its opinion, an instruction breaches Data Protection Law, and may decline to follow it.

3.3 BookInChat ensures that everyone it authorises to access Shop Customer Data is bound by confidentiality.

3.4 Subject matter, duration, nature, data and data subjects are described in Schedule 3.

4. The Shop's obligations, including notice to Customers

4.1 Notice. Before or when a Customer's data is first collected through BookInChat, and before any new purpose, the Shop must make our notice for customers (or wording at least as informative approved by BookInChat) available to the Customer, in the language the Customer uses. The notice tells the Customer: (a) replies may be drafted by AI and checked by the Shop; (b) the Shop and BookInChat both handle their data, and for what; (c) where the data is stored and that it may be processed outside the Customer's country; (d) how to reach the Shop and BookInChat; and (e) how to stop messages (STOP).

4.2 Malaysian Customers. Where the Customer is in Malaysia, the Shop's privacy notice must be in Bahasa Melayu and English and include the matters in section 7(1) of the MY PDPA, including the transfer of data outside Malaysia. BookInChat provides its notice text in Bahasa Melayu, English and 中文.

4.3 Lawful basis and consent. The Shop is responsible for having a lawful basis (including consent where needed) for the Shop Purposes and for disclosing Shop Customer Data to BookInChat for the BookInChat Purposes described in the notice. For Sensitive Data the Shop must obtain the Customer's explicit consent or rely on another condition the law allows, and must use BookInChat's Clinic consent flow where offered.

4.4 WhatsApp opt-in and opt-out. The Shop must obtain and record any opt-in Meta requires before sending business-initiated messages, and must honour opt-outs. When a Customer replies STOP, BookInChat automatically stops all automated messages to that Customer (assistant replies, reminders and marketing) until the Customer replies START, and records the opt-out; the Shop must not override it.

4.5 Accuracy and minimisation. The Shop must not enter more Customer data than it needs and must not upload Sensitive Data into fields not designed for it.

4.6 Clinic responsibilities. A Clinic remains responsible for clinical decisions, patient records required by health regulation, and compliance with health advertising rules. BookInChat does not provide medical advice.

5. BookInChat's own processing (BookInChat Purposes)

5.1 BookInChat processes Shop Customer Data for the BookInChat Purposes only as far as necessary and proportionate, and describes that processing in its Privacy Policy.

5.2 For Service Operation and Security and Integrity, BookInChat may access identifiable data, limited to authorised personnel on a need-to-know basis and logged.

5.3 For Improvement, BookInChat uses only De-identified Data, subject to clause 6.

6. Improvement use of De-identified Data and opt-out

6.1 Default. Unless the Shop opts out, BookInChat may create De-identified Data from the Shop's Shop Customer Data and use it to improve that same Shop's assistant (for example its prompts and tuning). Improvement includes training and fine-tuning BookInChat's own AI models, operated by BookInChat on its own servers or, in future, in a data centre it operates, using only De-identified Data of the Shop, for that Shop's assistant only. BookInChat never uses one Shop's data, de-identified or not, to improve another Shop's assistant or any shared model.

6.2 Sensitive Data is always excluded. BookInChat never uses Sensitive Data for Improvement, whether or not de-identified and whether or not the Shop opts out. All data of a Clinic is excluded at source. In other Shops, BookInChat applies automated filtering to exclude conversations that appear to contain health or other Sensitive Data, and excludes the whole conversation where filtering flags it.

6.3 Opt-out. The Shop may opt out at any time, free of charge and without loss of features, by emailing support@bookinchat.com. BookInChat then stops creating De-identified Data from that Shop's data and removes the De-identified Data tagged to that Shop. The opt-out does not affect processing for Service Operation, Security and Integrity, or Legal purposes.

6.4 Customer objections. A Customer may object to Improvement use through the Shop or by emailing support@bookinchat.com. The Shop must pass on objections it receives. BookInChat gives effect to an objection within 5 business days by excluding that Customer's conversations.

6.5 No re-identification. BookInChat will not attempt to re-identify any individual from De-identified Data, will not combine it with other data for that purpose, and will contractually prohibit anyone it shares it with from doing so.

6.6 Retention. De-identified Data tagged to a Shop may be kept after the Shop's account ends, unless the Shop opted out.

6.7 WhatsApp platform terms. Meta's terms for the WhatsApp Business Platform allow platform data to be used to improve an AI model only for the business's exclusive use. Limiting Improvement to each Shop's own assistant follows that rule.

7. Requests from Customers

7.1 The Shop is the primary point of contact for requests about the Shop Purposes. BookInChat provides tools in the app for the Shop to find, export, correct and delete a Customer's data.

7.2 If BookInChat receives a request that concerns the Shop Purposes, it will forward it to the Shop within 3 business days and will not answer it itself except to acknowledge receipt and say it has been forwarded.

7.3 BookInChat handles requests about the BookInChat Purposes itself. Requests received by the Shop that concern the BookInChat Purposes must be forwarded to dpo@bookinchat.com within 3 business days.

7.4 Where the Shop cannot fulfil a request with the in-app tools, BookInChat will help promptly after the Shop's written request, so the Shop can meet its legal deadlines.

8. Security

8.1 BookInChat maintains reasonable security arrangements appropriate to the risk, including those in Schedule 1, and reviews them at least annually.

8.2 The Shop is responsible for its users: giving access only to people who need it, removing staff who leave, protecting passwords and devices, and enabling the security features BookInChat offers.

9. Personal data breaches

9.1 Notice to the Shop. If BookInChat becomes aware of a personal data breach affecting Shop Customer Data, it will notify the Shop without undue delay and in any event within 72 hours of becoming aware, by email to the Shop's account owner and by in-app notice.

9.2 Content. The notice will include, as far as then known (and updated as facts emerge): what happened and when; categories and approximate numbers of Customers and records; likely consequences; measures taken or proposed; what the Shop and Customers can do; and a contact point.

9.3 Regulators and Customers: Shop Purposes. The Shop decides whether and how to notify regulators and Customers for breaches affecting the Shop Purposes. BookInChat will provide the information and drafts (in English, Bahasa Melayu and 中文) the Shop reasonably needs.

9.4 Regulators and Customers: BookInChat Purposes. For breaches affecting processing BookInChat controls, BookInChat makes any required notifications itself and informs affected Shops.

9.5 Notifying a breach is not an admission of fault.

10. Sub-processors and transfers

10.1 The Shop authorises BookInChat to engage the sub-processors on our Sub-processor list.

10.2 BookInChat will email Shop account owners at least 3 hours before a new or replacement sub-processor starts processing Shop Customer Data, and update the list page. The Shop may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Shop may end the Service before the change and receive a pro-rata refund of unused prepaid time. In an emergency (for example a sub-processor's sudden failure or a security need) BookInChat may change sooner and will notify as soon as practicable.

10.3 BookInChat imposes on each sub-processor written data-protection obligations providing protection at least comparable to this Agreement and to Data Protection Law, and remains responsible for its sub-processors.

10.4 Transfers. Shop Customer Data is stored on servers in Singapore. Some sub-processors process data in other countries (see the Sub-processor list). For Malaysian Customers, storage in Singapore is itself a transfer outside Malaysia. BookInChat will make transfers only where it has taken appropriate steps for the recipient to be bound by legally enforceable obligations giving comparable protection, and to support the Shop's reliance on section 129 of the MY PDPA. On request BookInChat provides the transfer information the Shop needs for its records (recipient, country, data types and purpose).

10.5 AI providers. BookInChat uses one or more of the AI providers on the Sub-processor list (NUS SoC LaaS, Alibaba Cloud Model Studio, Google Gemini API, OpenAI API and Anthropic Claude API), reached only through BookInChat's own AI gateway, to read and answer messages and draft replies for every Shop, including health details at Clinics after the patient agrees to the Clinic's notice. These providers may process Shop Customer Data outside Malaysia and Singapore. For these transfers BookInChat relies on contractual terms with each provider (its data processing terms) and on the provider's published API data terms; BookInChat uses only paid or commercial API services whose published terms say the provider does not use API data to train or improve its models without BookInChat's agreement, except NUS SoC LaaS, which has no published API terms and which BookInChat uses under its access arrangement with NUS. Adding or replacing an AI provider follows clause 10.2, including the 3-hour notice.

11. Audits and information

Once a year, on request, BookInChat will answer a written security questionnaire from the Shop and provide its sub-processor and transfer information, and will also do so after a breach affecting the Shop. BookInChat does not offer on-site audits.

12. Retention, return and deletion

12.1 During the service. Shop Customer Data is kept until the Shop deletes it or sets a retention period in its settings, subject to clause 12.3. A Customer's voice note is transcribed into text and the transcript is kept like any other message; the audio file is kept for 90 days so the Shop's staff can replay it, and BookInChat then deletes it automatically (sooner on a Customer erasure).

12.2 After the Shop cancels or its account ends. The Shop can export its data for 90 days after the account ends. Clinic safety records and financial records (such as packages, member credit and payment records the Shop entered) are the Shop's own records; BookInChat provides a full export during that period, and the Shop is responsible for keeping any records the law requires it to keep. After the 90-day export period ends (by BookInChat's daily job, usually within a few days), BookInChat: (a) deletes the Shop's WhatsApp, Instagram, Facebook Messenger and Threads messages, the files sent in them, the reply drafts made for them and BookInChat's raw copies of them, and deletes the clinic health notes, the assistant's conversation summaries (including those of deleted chats), the assistant's memory notes (remembered preferences and customer memory cards), the text of the assistant's draft replies, staff notes on the assistant's replies and the contents of imported customer files; (b) replaces Customers' names, contact details and usernames, the names and notes on the Shop's customer list, bookings, booking offers, late-cancellation and no-show records and customer profiles, and the Shop's name, web address and brand details, with coded (pseudonymised) values; removes Customers' names from receipts; removes staff notes and chat and customer links from clinic health-alert records; ends the Shop's users' access; and, for a user with no other active BookInChat account, codes their name, email address and phone number and disables their sign-in; and (c) keeps only receipts and payment proofs (7 years from settlement), clinic health-alert records (alert type, level and times; 7 years, as safety records), the chat consent and STOP (opt-out) records and the audit trail (records needed for a legal claim or legal hold are kept as in clause 12.3(b)), together with the Shop's other records with the details in (b) coded (bookings, customer profiles, payment, credit and package records, staff names on the schedule, other stored files with coded file names, and the search indexes already built). BookInChat keeps the coded records only for its Security and Integrity purpose (to detect fraud and abuse across the Service) and for at most 12 months after the account ends; coded data remains personal data. 12 months after the account ends, BookInChat's daily job erases each Customer's records as under clause 12.4, keeping only the records in (c), booking, package and payment rows without Customer details, and the Shop's own records that are not about a Customer (staff names on the schedule, the Shop's documents and the search indexes already built). Backup copies are overwritten in the normal backup cycle and are not restored except for disaster recovery, after which steps (a) and (b) are re-applied.

12.3 Other records kept. In addition to clause 12.2(b) and (c), BookInChat keeps: (a) its own invoices to the Shop and the accounting records the law requires BookInChat to keep; (b) data needed to establish or defend a legal claim or comply with a legal hold, until it is resolved; (c) minimal records of opt-outs and consent, so they continue to be honoured; and (d) De-identified Data tagged to the Shop, unless the Shop opted out (clause 6.6).

12.4 Customer erasure. On the Shop's instruction, BookInChat deletes a Customer's data within 30 days, except records the law requires to be kept (such as financial records, including deposit and top-up payment proofs, kept for 7 years from settlement with the Customer's name removed; this applies also to a data-deletion request made through Meta or WhatsApp, after which payment proof images are kept with access restricted, are no longer shown to the Shop's users, and are deleted when the 7 years end), subject to clause 12.3.

12.5 On request BookInChat confirms deletion in writing.

13. Liability

Each party's liability under this Agreement is subject to the limitations in the Terms of Service, except that nothing limits liability that cannot be limited by law.

14. Order of precedence

If this Agreement conflicts with the Terms of Service on the processing of personal data, this Agreement prevails.

Schedule 1: Security measures (summary)

1. Encryption in transit (TLS) on all public endpoints, and encrypted backups.
2. Logical separation of each Shop's data: each Shop's data is separated in the database and access is checked on every request.
3. Role-based access for Shop users; least-privilege access for BookInChat personnel; access logging.
4. AI requests routed only through BookInChat's own AI gateway to the approved model provider.
5. Backups with access restricted to the operator.
6. Patch management, dependency scanning, and secrets kept outside source code.
7. An internal incident response procedure.
8. Confidentiality undertakings from personnel.

Schedule 2: De-identification process

1. Scope. Only non-Sensitive Data of Shops that have not opted out. Clinics are excluded at source.
2. Exclusion filter. Conversations flagged by automated detection as containing health information or other Sensitive Data are excluded entirely.
3. Direct identifiers removed or replaced with random placeholders that are not linked back: names, phone numbers, WhatsApp IDs, email and postal addresses, identity-document numbers, payment references, booking IDs, staff names, Shop name and location, URLs and social handles; images, voice recordings and files are discarded (only text transcripts with identifiers removed are kept).
4. Indirect identifiers reduced: exact dates and times generalised, rare free-text details removed or generalised, small groups suppressed.
5. No key retained. No table linking placeholders to the original identifiers is kept.
6. Review. Samples are reviewed before use; re-identification risk is reviewed at least annually and when methods change, applying the PDPC's Guide to Basic Anonymisation. Data that does not meet the standard is treated as personal data and deleted under clause 12.
7. Controls. Access limited to authorised personnel; no export to third parties except under a contract prohibiting re-identification.

Schedule 3: Description of processing

• Data subjects: Customers and prospective customers of the Shop; Shop staff named in records.
• Data: as in the definition of Shop Customer Data; Sensitive Data at Clinics and where a Customer volunteers it.
• Nature: receiving, storing, transcribing, AI processing by one or more of the AI providers on the Sub-processor list (clause 10.5), AI drafting of replies, booking management, reminders, search, export and deletion.
• Duration: the term of the Shop's account plus the 90-day period after it ends; after that, the records described in clauses 12.2 and 12.3.
• Locations: Singapore (storage) and the sub-processor locations on the Sub-processor list, which for AI processing may be outside Malaysia and Singapore.