Healthcare AI B2B Platform • Last updated: September 25, 2026
1. Introduction
ICDBolt ("we," "our," or "us") is a healthcare AI B2B platform operated by Value Creating Solutions Sdn Bhd (A company incorporated in Malaysia), with its registered office at Level 8, MCT Tower, Sky Park, One City, Jalan USJ 25/1, 47650 Subang Jaya, Selangor D.E., Malaysia. ICDBolt provides AI-powered medical coding services to healthcare organizations, billing companies, and health systems across multiple jurisdictions including Malaysia, the United States, India, Singapore, the United Kingdom, the European Union, Saudi Arabia, and the United Arab Emirates. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform, with particular attention to the distinction between Personally Identifiable Information (PII) and Protected Health Information (PHI) as defined under applicable healthcare regulations.
Scope: This policy applies to all users of ICDBolt, including healthcare organizations, their employees, and authorized personnel who access our platform for medical coding purposes. Our compliance framework addresses the regulatory requirements of the markets in which we and our customers operate. Where Malaysian law applies to our role as data controller / data user, the Personal Data Protection Act 2010 (PDPA) is primary; tenant contracts and Business Associate Agreements may impose additional requirements (e.g. HIPAA) for PHI processed on behalf of customers.
2. Data Collection: PII vs PHI
Important Distinction
ICDBolt processes both Personally Identifiable Information (PII) and Protected Health Information (PHI). PHI is subject to stricter regulatory requirements under HIPAA and regional data protection laws.
2.1 Personally Identifiable Information (PII)
PII refers to information that can be used to identify an individual but is not directly related to health conditions or medical treatment. We collect:
Account Information: Name, email address, organization name, job title, department
Communication Data: Support tickets, feedback, and correspondence
Billing Information: Payment method details (processed through secure third-party processors)
2.2 Protected Health Information (PHI)
PHI is health information that can be linked to a specific individual. Under HIPAA, PHI includes any information about health status, provision of healthcare, or payment for healthcare that can be used to identify a person. We process PHI only when:
Clinical Documentation: Clinical notes, medical histories, and diagnostic information submitted for coding
Medical Codes: ICD-10 codes, CPT codes, and related medical coding data associated with patient records
Patient Identifiers: Medical record numbers, patient names, dates of birth, and other identifiers when included in clinical documentation
Treatment Information: Procedures, diagnoses, medications, and treatment plans
HIPAA Business Associate Agreement (BAA)
All healthcare organizations using ICDBolt must execute a BAA with us. This agreement ensures that we handle PHI in compliance with HIPAA requirements and establishes our role as a Business Associate.
2.3 How We Collect Data
Directly from You: Account registration, clinical note submissions, support requests
Through Your Organization: Bulk data uploads, EMR integrations, API connections
Automatically: Usage analytics (with consent), system logs, performance metrics
From Third Parties: Authentication providers (SSO), payment processors (billing only)
3. Regional Compliance
ICDBolt is designed to comply with healthcare data protection regulations across multiple jurisdictions. Our compliance framework includes:
🇺🇸 USA
3.1 HIPAA Compliance (United States)
Health Insurance Portability and Accountability Act (HIPAA) requires us to:
Execute Business Associate Agreements (BAAs) with all covered entities
Implement Administrative, Physical, and Technical Safeguards as per 45 CFR §164.308-312
Maintain minimum necessary standards for PHI access and disclosure
Provide breach notification within 60 days of discovery
Enable patient rights to access, amend, and request restrictions on PHI
Maintain comprehensive audit logs of all PHI access and modifications
Your Responsibilities: As a covered entity or business associate, you must ensure that your use of ICDBolt complies with your HIPAA obligations, including obtaining patient authorizations where required.
🇸🇦 Saudi Arabia
3.2 Saudi PDPL Compliance
Personal Data Protection Law (PDPL) of Saudi Arabia requires:
Explicit consent for processing personal data, including health data
Data localization requirements for sensitive personal data (health information)
Appointment of a Data Protection Officer (DPO) for organizations processing health data
Right to access, rectify, and erase personal data
Data breach notification to the Saudi Data and AI Authority (SDAIA) within 72 hours
Cross-border data transfer restrictions without adequate safeguards
Data Residency: For Saudi Arabia pilot programs, all data is hosted locally on Oracle Cloud KSA to comply with PDPL data localization requirements.
🇦🇪 UAE
3.3 UAE PDPL Compliance
Federal Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) requires:
Lawful basis for processing personal data, including health data
Data minimization and purpose limitation principles
Data subject rights including access, correction, deletion, and objection
Data breach notification to the UAE Data Protection Authority within 72 hours
Data localization for critical information infrastructure (health data may qualify)
Cross-border transfer restrictions without adequate protection measures
Data Residency: For UAE pilot programs, all data is hosted locally on Azure UAE to comply with UAE PDPL data localization requirements.
🇪🇺 European Union
3.4 GDPR Compliance (European Union)
General Data Protection Regulation (GDPR) requires:
Lawful basis for processing (consent, contract, legal obligation, vital interests, public task, legitimate interests)
Data subject rights (access, rectification, erasure, portability, objection, restriction)
Data Protection Impact Assessments (DPIAs) for high-risk processing
Data breach notification to supervisory authority within 72 hours
Privacy by design and by default principles
Appointment of Data Protection Officer (DPO) where required
Cross-border transfer safeguards (Standard Contractual Clauses, adequacy decisions)
Special Category Data: Health data is considered "special category data" under GDPR Article 9, requiring additional safeguards and explicit consent or other lawful basis.
🇬🇧 United Kingdom
3.5 UK GDPR Compliance
UK GDPR and Data Protection Act 2018 require:
Compliance with UK GDPR standards post-Brexit
Data subject rights including access, rectification, erasure, and portability
Data breach notification to the Information Commissioner's Office (ICO) within 72 hours
Appointment of Data Protection Officer (DPO) where required
Cross-border data transfer safeguards for transfers outside the UK
Special category data (health data) requires explicit consent or other lawful basis
🇮🇳 India
3.6 Digital Personal Data Protection Act (DPDPA) Compliance
India's Digital Personal Data Protection Act (DPDPA) requires:
Explicit consent for processing personal data, including health data
Data principal rights including access, correction, and erasure
Data breach notification requirements
Compliance with Ayushman Bharat (AB PM-JAY) ecosystem requirements
Support for HBP 2.1 procedure coding and NHA standard treatment guidelines
Data localization requirements for sensitive personal data
Ayushman Bharat Integration: ICDBolt supports the Ayushman Bharat (AB PM-JAY) ecosystem, ensuring compatibility with India's national health insurance program requirements.
🇲🇾 🇸🇬 Malaysia & Singapore
3.7 Regional PDPA Compliance
Malaysia's Personal Data Protection Act (PDPA) and Singapore's Personal Data Protection Act (PDPA) require:
Explicit consent for processing personal data, including health data
Data subject rights including access, correction, and deletion
Data breach notification requirements
Compliance with MOH hospital billing standards (Malaysia and Singapore)
Support for MY-DRG / casemix coding workflows in Malaysia (ICD-10-AM)
Support for ICD-11 transition roadmaps in Southeast Asia
Data localization requirements where applicable
Regional Standards: ICDBolt supports MY-DRG and ICD-10-AM for Malaysia, MOH hospital billing for Singapore, and ICD-11 transition roadmaps across Southeast Asia.
4. Data Residency and Hosting
ICDBolt offers region-specific hosting options to comply with data residency requirements across GCC, Southeast Asia, India, and other pilot jurisdictions.
4.1 United States Hosting
Data is hosted in US-based data centers with full HIPAA compliance and SOC 2 Type II certification. All PHI is encrypted at rest and in transit.
4.2 Saudi Arabia (KSA) - GCC Pilot Programs
Local Hosting Certified: For Saudi Arabia pilot programs, all data (including PHI and PII) is processed and stored locally on Oracle Cloud KSA to comply with Saudi PDPL data localization requirements and national data sovereignty laws.
Data remains within Saudi Arabian borders
Compliance with Saudi Vision 2030 healthcare digitization goals
NPHIES integration support for digital claim submission
SBS (Saudi Billing System) compliance
4.3 United Arab Emirates (UAE) - GCC Pilot Programs
Local Hosting Certified: For UAE pilot programs, all data (including PHI and PII) is processed and stored locally on Azure UAE to comply with UAE PDPL data localization requirements and national data sovereignty laws.
Data remains within UAE borders
DOH (Department of Health Abu Dhabi) modifier compliance
DHA (Dubai Health Authority) eClaimLink integration
Support for AI-first clinical documentation standards
4.4 European Union Hosting
Data is hosted in EU-based data centers with full GDPR compliance and regional data residency guarantees. All data transfers outside the EU are subject to appropriate safeguards.
4.5 United Kingdom Hosting
Data is hosted in UK-based data centers with full UK GDPR compliance and Data Protection Act 2018 compliance. All data processing follows UK data protection standards.
4.6 India Hosting
Data hosting options available in India to comply with DPDPA requirements. Full support for Ayushman Bharat (AB PM-JAY) ecosystem, HBP 2.1 procedure coding, and NHA standard treatment guidelines.
Ayushman Bharat (AB PM-JAY) ecosystem compatibility
HBP 2.1 procedure coding support
NHA standard treatment guidelines compliance
4.7 Malaysia & Singapore Hosting
Data hosting options available in Malaysia and Singapore to comply with regional PDPA requirements. Support for MY-DRG / ICD-10-AM (Malaysia), MOH hospital billing standards, and ICD-11 transition roadmaps.
MOH hospital billing standards compliance
ICD-11 transition roadmap support
Regional PDPA compliance
On-Premise Deployment: ICDBolt also supports on-premise deployments for organizations with strict data sovereignty requirements. Contact us to discuss on-premise deployment options.
5. Your Rights
Depending on your jurisdiction and the type of data we process, you have the following rights:
5.1 Right to Access
You have the right to request access to your personal data (PII) and, where applicable, PHI. This includes:
Confirmation of whether we process your data
Access to copies of your personal data
Information about how we use your data
Details of third parties with whom we share your data
For PHI: Under HIPAA, patients have the right to access their PHI. Requests should be made through your healthcare organization, which is the covered entity.
5.2 Right to Correct (Rectification)
You have the right to request correction of inaccurate or incomplete personal data. We will:
Verify the accuracy of the data you wish to correct
Update your data within 30 days of your request
Notify relevant third parties of corrections where required
Maintain an audit trail of all corrections
For PHI: PHI corrections must be made through your healthcare organization, which maintains the official medical record.
5.3 Right to Delete (Erasure)
You have the right to request deletion of your personal data, subject to legal and regulatory requirements. We will delete your data when:
It is no longer necessary for the original purpose
You withdraw consent (where consent was the lawful basis)
You object to processing and there are no overriding legitimate interests
Data was processed unlawfully
Important Limitations: We may be required to retain certain data (including PHI) for legal, regulatory, or contractual reasons, such as:
HIPAA retention requirements (typically 6 years)
Audit trail requirements for compliance
Legal hold obligations
Billing and payment records
5.4 Additional Rights
Right to Data Portability: Request your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests or for direct marketing
Right to Restrict Processing: Request limitation of processing in certain circumstances
Right to Withdraw Consent: Withdraw consent for processing where consent was the lawful basis
Right to Lodge a Complaint: File a complaint with your local data protection authority
How to Exercise Your Rights
To exercise any of these rights, please contact us at:
Subject Line: "Data Subject Rights Request - [Your Request Type]"
Response Time: We will respond within 30 days (or as required by applicable law)
Verification: For security purposes, we may require verification of your identity before processing your request.
6. Data Security
We implement comprehensive security measures to protect your data:
Encryption: End-to-end encryption for all PHI at rest (AES-256) and in transit (TLS 1.3)
Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA), and least privilege principles
Audit Trails: Immutable logs of all data access, modifications, and system events
Certifications: SOC 2 Type II certified infrastructure, HIPAA-compliant architecture
Regular Audits: Third-party security assessments and penetration testing
Incident Response: 24/7 security monitoring and rapid response procedures
Data Backup: Regular encrypted backups with disaster recovery procedures
7. Data Retention
We retain data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law:
PII: Retained for the duration of your account plus 7 years for legal and audit purposes
PHI: Retained per HIPAA requirements (typically 6 years) or as specified in your BAA
Usage Data: Retained for 2 years for analytics and service improvement
Audit Logs: Retained for 7 years for compliance and security purposes
8. Contact Us
If you have questions, concerns, or wish to exercise your rights under this Privacy Policy, please contact Value Creating Solutions Sdn Bhd (trading as ICDBolt):
ICDBolt · Value Creating Solutions Sdn Bhd
Level 8, MCT Tower, Sky Park, One City
Jalan USJ 25/1
47650 Subang Jaya, Selangor D.E.
Malaysia
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:
Posting a notice on our platform
Sending an email to your registered address
Updating the "Last updated" date at the top of this policy
Your continued use of ICDBolt after such changes constitutes acceptance of the updated policy.