QueueIn Data Processing Addendum

Version: 1.0-alpha

Last updated: 3 September 2026

Effective date: 3 September 2026

Parties: Effortless Engine Sdn. Bhd. (“QueueIn”) and the Clinic named in

the accepted Order Schedule

This DPA forms part of the QueueIn Business Subscription Terms. It applies to personal data about patients, queue visitors, and related persons that QueueIn processes for the Clinic (“Clinic Data”). It does not replace the Business-Account Privacy Notice for owner, staff, support, and billing data.

1. Roles

1. The Clinic is the data controller for Clinic Data when it decides why and

how patient/queue data is used for its queue operations.

1. QueueIn is the data processor when it processes Clinic Data only to provide,

secure, support, maintain, or delete the service on the Clinic's documented instructions.

1. Each party remains responsible for duties that apply directly to it. The

Clinic's use of QueueIn does not transfer its notice, lawful-processing, consent, accuracy, rights-response, healthcare, or professional duties to QueueIn.

1. QueueIn is a separate controller for its own limited business-account,

billing, tax, fraud/abuse prevention, corporate, legal-claim, and regulatory processing. That processing is outside this DPA and is described in the Business-Account Privacy Notice.

1. If either party changes a purpose or activity so that these roles no longer

fit, it must notify the other and the parties must document the correct role before the new processing begins.

2. Documented instructions

The Clinic instructs QueueIn to process Clinic Data only to:

• accept and manage queue entries, status, position, timing, and related outlet

operations;

• show a customer waiting page and maintain an authorised queue session;
• provide staff dashboard, kiosk, real-time customer/staff updates, optional

browser/push notifications, and enabled WhatsApp queue updates;

• host, transmit, encrypt/protect, back up, troubleshoot, restore, and support

the service;

• apply the Clinic's configuration, access roles, retention/deletion request,

and permitted export; and

• comply with a binding legal requirement, after informing the Clinic before

processing unless law prohibits notice.

The subscription contract, account configuration, authorised support request, and written instruction from an authorised Clinic owner are documented instructions. QueueIn must inform the Clinic if it reasonably believes an instruction violates applicable data-protection law and may pause that instruction while the parties resolve it.

3. Processing details

4. Clinic obligations

The Clinic must:

• provide a lawful, clear, bilingual notice where required and establish a

valid basis for Clinic Data and each optional notification channel;

• collect only data necessary for queue operation and configure reasonable

retention, access, and staff roles;

• ensure instructions, uploaded data, and recipient details are lawful,

accurate, and not misleading;

• respond to data subjects and the Commissioner, including breach assessment

and notification duties that belong to the Clinic;

• protect account credentials/devices and promptly remove staff access;
• avoid using QueueIn as a medical record or clinical-decision system; and
• notify QueueIn promptly of an unlawful instruction, compromised account, or

suspected incident.

5. QueueIn obligations

QueueIn must:

• process Clinic Data only on documented instructions and only for the stated

purpose;

• restrict access to personnel and subprocessors who need it and are bound by

confidentiality;

• apply practical security under section 6 and the PDPA Security Principle;
• keep Clinic Data logically scoped to the Clinic and prevent one clinic from

accessing another's data;

• not sell Clinic Data, use it for unrelated advertising, build patient

profiles, or identify Clinic patients from de-identified aggregate data;

• notify and assist the Clinic under sections 8 and 9; and
• return/delete Clinic Data under section 12.

6. Security

QueueIn will maintain practical technical and organisational measures appropriate to the nature, location, volume, and potential harm of Clinic Data, including:

• role/account scoping, least-privilege access, and authentication controls;
• encrypted network transport and protection of designated sensitive stored

fields;

• separation of customer SSE and staff Socket.IO authorisation paths;
• signature verification for raw provider webhooks before general parsing;
• restricted production access, secure credential/secret handling, and

redaction/exclusion of Clinic Data from ordinary logs and credit ledgers;

• audit events for material staff/operator actions without raw patient PII;
• dependency/patch, backup/recovery, security review, and incident procedures;
• retention and deletion jobs with evidence and exception review; and
• periodic review of measures as risk and the Alpha product change.

QueueIn does not promise a particular certification unless it has been issued and is listed in an Order Schedule. On reasonable request, QueueIn will provide a current high-level security description without exposing secrets or creating security risk.

7. Personnel and confidentiality

QueueIn will authorise access only for personnel who need it to provide, secure, or support the service. Those persons must receive appropriate privacy and security instructions and be bound by contractual, professional, or statutory confidentiality that continues after access ends.

8. Personal-data incidents

1. QueueIn will notify the Clinic without undue delay after credible detection

of a personal-data incident affecting its Clinic Data. QueueIn's contractual target is an initial factual notice within 24 hours of credible detection; incomplete facts may be updated in phases.

1. The notice will include, to the extent known: nature and time window;

affected data/records and approximate number; likely consequences; measures taken/planned; information needed for the Clinic's risk assessment; and a response contact.

1. QueueIn will investigate, contain, preserve proportionate evidence,

remediate, and give reasonable updates. It will not notify patients or a regulator on the Clinic's behalf unless instructed and legally permitted.

1. The Clinic remains responsible for its own assessment and notice. The

current JPDP guideline requires qualifying controller notification as soon as practicable and no later than 72 hours from occurrence, with data-subject notice without unnecessary delay where significant harm is caused or likely. Each party must obtain advice for the facts of an incident.

1. Notice is not an admission of fault or liability.

9. Assistance with data-subject and regulatory duties

QueueIn will, taking account of the processing and information available:

• forward a patient request that it can reasonably link to the Clinic;
• provide self-service functions or reasonable assistance for access,

correction, deletion, restriction/withdrawal records, and technically feasible portability/export;

• assist with a complaint, investigation, breach assessment/notification,

transfer assessment, and data-protection impact assessment relating to the service; and

• avoid responding as controller for Clinic Data unless legally required.

The Clinic must verify the requestor and decide the response. Routine self-service and reasonable requests are included. QueueIn may charge a fair, pre-agreed amount for unusually extensive, repetitive, or bespoke work not caused by QueueIn's breach, subject to law.

10. Subprocessors

1. The Clinic gives general written authorisation for QueueIn to use the

subprocessors in the verified public schedule to provide the service.

1. QueueIn will contractually require each subprocessor to protect Clinic Data

and meet materially equivalent confidentiality, security, incident, assistance, and deletion duties appropriate to its function. QueueIn remains responsible for its subprocessor to the extent required by the contract and law.

1. QueueIn will give at least 30 days' notice before a new subprocessor begins

materially processing Clinic Data, unless an urgent security/provider replacement makes that impracticable. The Clinic may object on reasonable data-protection grounds within 14 days. The parties will try a reasonable alternative; if none exists, either may terminate the affected feature or service without penalty.

1. A provider that independently determines its own purpose may be a separate

controller rather than a subprocessor for that activity. QueueIn will label the role accurately in the schedule.

Provisional subprocessor schedule — must be verified before acceptance

No schedule containing “verify” may be used as a final signed schedule.

11. Cross-border handling

Before transferring Clinic Data outside Malaysia, QueueIn will:

• identify the receiving country, recipient, data, purpose, and section 129

condition relied on;

• tell the Clinic and support required patient-notice content;
• perform and retain the required transfer/receiver assessment and records;
• use secure transfer and contractually require an appropriate protection

level; and

• stop or remediate a transfer if the receiver materially fails its protection

obligations and no lawful safeguard remains.

The Clinic authorises only the verified countries and receivers in the subprocessor/transfer schedule. An optional provider feature is not authorised until its entries are complete.

12. Return, retention, and deletion

1. If QueueIn voluntarily decides to permanently close the service, it will

give the Clinic at least 30 days' written notice under the Business Subscription Terms and make the available export route accessible during that notice period so far as reasonably practicable.

1. During the service and for 30 days after termination, the Clinic may request

an available structured export of its Clinic Data.

1. QueueIn will delete Clinic Data from active systems within 30 days after the

export window ends, unless the Clinic requests earlier deletion or law requires limited retention.

1. Backup copies will cycle out within 90 days and will not be restored to

ordinary service except for disaster recovery; if restored, deletion instructions are re-applied.

1. Shorter product retention applies where published/configured, including

data minimisation for non-needed contact and messaging evidence.

1. Any legally retained copy is isolated from ordinary use, kept only for the

required purpose/period, and deleted afterward. Tax/accounting retention of business records does not justify keeping Clinic patient data.

1. On reasonable request, QueueIn will confirm completion or identify the

lawful exception.

Launch gate: QueueIn must verify the export, active-system deletion, and

backup-cycle capability before accepting this DPA.

13. Audit and evidence

Once per 12 months, and additionally after a substantiated material incident or regulator request, the Clinic may request reasonable evidence of QueueIn's compliance with this DPA. QueueIn may satisfy the request with current policies, security/retention descriptions, subprocessor/transfer records, test or audit summaries, incident evidence, and a written questionnaire.

An onsite or intrusive audit requires at least 30 days' notice, normal business hours, confidentiality, no access to another customer's data or secrets, and must not unreasonably disrupt service. It is available only where documentary evidence is insufficient or law/regulator requires it. The Clinic pays its cost unless the audit finds QueueIn in material breach, in which case QueueIn bears reasonable audit cost attributable to that breach.

14. Liability, termination, and survival

The liability provisions in the Business Subscription Terms apply to this DPA, subject to law. A material DPA breach follows the cure and termination process in those Terms, except an urgent security/privacy risk may be suspended immediately. Confidentiality, legally required assistance, liability, and deletion duties survive for as long as relevant data or claims remain.

15. Contact and signatures

QueueIn privacy contact: [email protected], subject “DPA/privacy”.

The DPA is accepted with the Order Schedule and recorded clickwrap evidence, or by signatures below.