1. Who we are
EZClaim (operating under the CACMRSP — Claims Adjusting Case Management & Report Standardization Platform — designation in regulatory filings) is a multi-tenant SaaS for licensed Malaysian insurance adjusters working third-party-bodily-injury (TPBI) motor claims. Each adjusting firm operates an isolated workspace; this document covers how data flows through the platform regardless of which workspace you sign into.
2. The personal data we process
- Adjuster account data — name, email, preferred language, role, sign-in events.
- Subject case data — insured, claimant, driver, passenger, witness identifiers (NRIC / passport / phone / address), photos, sketches, police-report extracts, vehicle information, and the adjuster’s investigative narrative.
- Diagnostic data — IP, user-agent, device fingerprint at the moment of each state-changing action (audit-event scope only).
3. Lawful basis & purpose
Subject personal data is processed under PDPA s.6 (consent / performance of contract) for the sole purpose of producing the TPBI investigation report your principal insurer instructed the firm to deliver. The platform does not use case data for advertising, profiling, or any cross-firm analytics.
4. Subject consent
Each case carries an explicit subject consent obtained flag. The QC reviewer must affirm that the adjuster captured the necessary consent (verbal at scene, written via meeting form, or statutory authority under the insurance contract) before the report can be locked. Consent capture is audit-logged with the actor and timestamp.
5. Subject access requests
A data subject (insured, claimant, witness, etc.) may request a copy of every record we hold about them. Contact your firm’s admin directly — they can issue a per-case JSON + photo bundle from the workspace export tool. We aim to fulfil within 21 days of the request being recorded.
6. Right to erasure
Data subjects may request erasure of their personal data. The workspace MANAGEMENT reviews each request via /settings/data-governance. When fulfilled, the case PII (NRIC, name, phone, email, address, photos that depict the subject) is anonymized via one-way SHA-256 hashing. The case structural record (claim number, dates, monetary settlement) is retained for the regulatory 7-year (2,555-day) window required by Malaysian insurance practice and Bank Negara guidelines.
7. Retention
The workspace default retention is 2,555 days (≈7 years) from case closure. After this window the case is eligible for automated anonymisation; the structural record (claim number, dates, principal insurer) is retained beyond this window for legal-defence and audit-trail reasons. Each firm’s MANAGEMENT can shorten or extend this window above the 365-day floor.
8. Where data lives
All personal data is stored on infrastructure operated for the EZClaim service. Photos, documents, and report PDFs are stored with at-rest encryption; SMTP credentials provided by the firm are encrypted with AES-256-GCM keyed off the platform secret. Backups follow the same retention rules as the live data.
9. Sub-processors
EZClaim relies on a small set of named sub-processors for hosting, email, and optional AI features. The complete list (purpose, data accessed, region, contract status) is published at /privacy/sub-processors.
Self-hosted services (Helsinki-NLP OPUS-MT translation, Tesseract WASM OCR) run in-process and do not transmit case data anywhere. Cloud AI features (a third-party cloud AI provider, for conclusion drafting + photo analysis) only activate when the workspace MANAGEMENT explicitly enables them — no AI calls happen by default.
We notify firms 30 days before adding any sub-processor that processes case data.
10. Data Protection Officer & contact
EZClaim platform DPO: dev@aifactory.fyi. The platform DPO handles privacy questions, sub-processor changes, security incidents, and PDPA compliance enquiries from regulators or insurers acting as data controllers. Response SLA: 5 working days.
Your firm’s DPO: each adjusting firm is the data controller for the case data uploaded into its workspace. Privacy enquiries about a specific case (subject access, erasure, consent withdrawal) should go to your firm’s MANAGEMENT — visible at /settings/members.
11. Changelog
- 2026-05-09 · Sprint 8 hardening — added Section 9 sub-processors disclosure and Section 10 platform DPO contact. Encryption-at-rest for NRIC, contact, and address fields rolled out (AES-256-GCM). MFA mandatory for Reviewer-and-above roles. Automated retention deletion sweep added.
- 2026-05-02 · Initial publication of this policy alongside the PDPA right-to-erasure + subject-access-request features.