Your data, handled with care

HeyDo is an online booking, front desk and checkout service for appointment businesses such as salons, dental clinics, massage and reflexology centres and spas, provided by Cloudkia Solutions Sdn. Bhd. (Registration No. 201601032857), Kuching, Sarawak, Malaysia ("HeyDo", "we", "us").

This policy explains what personal data we handle when you use the HeyDo website (www.heydo.asia), the merchant portal, the HeyDo Merchant app, and the booking pages of businesses that use HeyDo (for example yourcode.heydo.asia). It is written to meet the Personal Data Protection Act 2010 (PDPA) of Malaysia.

HeyDo is used by two kinds of people, and our role is different for each:

• Businesses: the salons, clinics, spas and other businesses that sign up for HeyDo, and their owners and team. For business account data, HeyDo decides how the data is used and is responsible for it.
• Clients: people who book with, or are recorded by, a business that uses HeyDo. The business decides what it does with its clients' data; HeyDo stores and processes that data on the business's behalf and only as needed to run the service. If you are a client, the business you book with is your first point of contact for questions about your data. You can also contact us and we will help.

Businesses, owners and team members

• Business details: business name and type, merchant code, outlets and their addresses, opening hours, logo, brand colour and description.
• Login details: name, email address, mobile number, password (stored only as a secure hash) and role.
• Team profiles shown on the booking page, if the business adds them: photo, title, bio, experience, languages, specialties and portfolio photos.
• Business records created in HeyDo: services and prices, products, working hours and leave, bookings, invoices, payments and reports.
• Plan and billing: plan, invoices and payment status for HeyDo plans.

Clients of businesses that use HeyDo

• Contact details: name, mobile number and email address, and, if given, gender, date of birth and IC or passport number.
• Bookings: services, dates and times, the team member, status, and notes from the client or the business.
• Health information: dental clinics, massage centres and spas may record medical alerts, allergies or health notes so they can treat clients safely. This is sensitive personal data. The business is responsible for getting the client's consent to record it; HeyDo stores it only for that business and shows it only to its team.
• Visits and payments: invoices, amounts paid and owed, and payment method. HeyDo does not take or store card details.
• Booking page sign-in: phone number, an optional password (stored only as a secure hash) and one-time sign-in codes sent by WhatsApp.

Website visitors

• The website does not use advertising or analytics trackers. If you use the contact form, it opens WhatsApp or your email app with your message; we receive only what you choose to send.
• Our hosting and security providers keep standard technical logs (such as IP address and browser type) to keep the service running and protected.

• To provide the service: show booking pages, take and manage bookings, work out free times, check clients in, record visits and payments, print receipts and produce reports.
• To send sign-in codes and appointment reminders to clients on WhatsApp on the business's behalf. Clients can turn reminders off in their profile.
• To create and manage business accounts, plans and billing, and to provide support.
• To keep HeyDo secure: prevent misuse and keep audit records of important account changes.
• To meet legal, tax and accounting obligations.

We do not sell personal data, and we do not use clients' data to advertise to them. Businesses may contact their own clients about their bookings; any marketing by a business is the business's responsibility.

We share personal data only as needed to run HeyDo, with:

• The business you book with (for clients), and the business's own team according to their roles.
• WhatsApp messaging: our WhatsApp messaging provider and WhatsApp (Meta), to deliver sign-in codes and reminders.
• Hosting and infrastructure: Amazon Web Services (servers, database and file storage in Singapore) and Cloudflare (website delivery and security).
• Authorities, when the law requires it.

These providers may process data outside Malaysia (for example in Singapore). We use providers that protect data to a standard comparable to the PDPA.

• Business data is kept while the business's account is open.
• When a business account is deleted, its data is deleted with it, except records we must keep by law.
• Records we must keep by law, such as invoices for HeyDo plans, are kept for the period the law requires (generally 7 years in Malaysia).
• One-time sign-in codes expire within minutes. Security and audit logs are kept for a limited time and then deleted.

Under the PDPA you may ask to access and correct your personal data, and you may withdraw consent for its use, which may mean we can no longer provide the service to you.

• Businesses and team members can update most details in the merchant portal or the HeyDo Merchant app.
• Clients can update their profile on the business's booking page, or ask the business.

To make a request, email [email protected]. We may need to confirm your identity first, and we will reply within 21 days.

• Business account (the business and everything in it): the owner can email [email protected] from the owner's email address with the merchant code. We confirm the request and delete the account and its data within 30 days, except records we must keep by law. See Delete your account.
• Team login: ask the business owner or a manager to remove you, or email us.
• Client account: ask the business, or email us with the business name and your mobile number. We delete your sign-in and profile; the business may keep the records it needs for its own accounts and, for clinics, the medical records the law requires it to keep.

Data is sent over encrypted connections (HTTPS). Passwords are stored as secure hashes. Each business's data is kept in its own database. Access to our systems is limited to staff who need it. No system is completely secure, so please keep your password private and tell us straight away if you think your account has been misused.

Business accounts must be opened by adults. Businesses that serve children (for example a children's haircut or a dental check-up) record them through a parent or guardian, and are responsible for that consent. If you believe a child has given us personal data directly, contact us and we will delete it.

We may update this policy as HeyDo changes. The date at the top shows the latest version. If a change matters to how your data is used, we will tell businesses by email or in the portal before it takes effect.

Cloudkia Solutions Sdn. Bhd. (Registration No. 201601032857)
Kuching, Sarawak, Malaysia
Email: [email protected]
WhatsApp: +60 12-337 0366