Data Protection

1. Our Commitment

Easy Claim exists to support independent, defensible claims decisions, which means the trust our clients place in us to handle sensitive claim and medical information responsibly is central to how we operate. This page explains, at a general level, how we approach data protection across our platform and specialist network.

2. Sensitive Personal Data

Much of the information we process on behalf of clients relates to health and medical conditions, which is treated as sensitive personal data under the PDPA. We apply enhanced safeguards to this category of data, including restricted access on a need-to-know basis and additional handling controls beyond our standard security baseline.

3. Our Role: Controller vs. Processor

For information submitted directly to us through this website (such as enquiry forms), Easy Claim acts as the data controller. For claim files and medical information we review on behalf of an insurer, reinsurer, TPA, healthcare provider, or law firm, we act as a data processor, handling that data strictly in accordance with the instructions and service agreement of the relevant client.

4. Security Measures

• Practices aligned with ISO 27001 information security management standards.
• Infrastructure aligned with Bank Negara Malaysia's Cloud Service Provider (CSP) expectations for regulated financial data.
• Access controls, audit trails, and encryption for claim files in transit and at rest.
• A verified, credentialed specialist network, with confidentiality obligations built into how specialists are onboarded.

5. Confidentiality of the Specialist Network

Independent medical specialists engaged through our network are screened and are bound by confidentiality obligations regarding any claim or patient information they access as part of an engagement.

6. Data Breach Response

We maintain internal procedures to identify, contain, and respond to any suspected data security incident, and to notify affected clients and, where legally required, the relevant regulator without undue delay.

7. Data Subject Access Requests

Individuals seeking to exercise data protection rights over information held about them should, where the data relates to a specific claim, contact the insurer, TPA, or other organisation that instructed us, as they are typically the data controller for that claim. For data submitted directly to Easy Claim, see our Privacy Policy.

8. Regulatory Alignment

Our data protection practices are designed with reference to Malaysia's Personal Data Protection Act 2010 and relevant Bank Negara Malaysia guidelines applicable to our clients in the financial and insurance sectors.

9. Contact Us

For questions about our data protection practices, contact us at enquiries@easyclaim.tech.