Key points
- Census 2020 counted 1,982,112 people in Kuala Lumpur, 10.5% of them non-citizens.1
- The Personal Data Protection (Amendment) Act 2024 came into force in three stages, on 1 January, 1 April and 1 June 2025.4
- A data controller now tells the Commissioner within 72 hours of a personal data breach, and affected people within seven days of that notice.5
- Private clinics in Kuala Lumpur answer to the Ministry of Health under the Private Healthcare Facilities and Services Act 1998, in force since 1 May 2006.2
- wai drafts, a person at the clinic approves and sends, the doctor signs, and records stay in Malaysia.
Summary
A Kuala Lumpur clinic can use AI for notes and the front desk in 2026 under the Personal Data Protection Act 2010 as amended in 2024, and the Private Healthcare Facilities and Services Act 1998. The doctor signs every note, a person at the clinic approves every message, and records stay in Malaysia.
Kuala Lumpur clinics now answer an evening enquiry within minutes and take the booking deposit in ringgit before the patient arrives, and doctors leave with every note signed. wai drafts the replies and the notes, a person at the clinic approves or signs each one, and the records stay in Malaysia under the amended PDPA.
Part of the MOH and MSQH hub, with the framework explained, a readiness checklist and 7 guides.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee an evening WhatsApp enquiry from Mont Kiara become an approved booking with a ringgit deposit, in fifteen minutes with a clinician who uses wai daily.
| Body or law | Rule | What to ask | How wai meets it |
|---|---|---|---|
| Malaysian Medical Council | Doctors hold full or specialist registration | Which registered doctor signs each note | Every note a draft until the doctor signs it |
| Act 586, Ministry of Health | Private clinics registered and inspected | Can the clinic show its records on inspection | Every record and action exportable |
| PDPA, as amended by Act A1727 | Amendments in force from 1 June 2025 | Who is the clinic's data protection officer | Role-based access enforced in the database |
| Commissioner's breach circular | Commissioner told within 72 hours, patients within seven days | Who sends each notice | Every message, draft and approval logged |
| Hosting | Records held under Malaysian rules | Where is every copy held | Records hosted in Malaysia, set up with the clinic |
The private care market in Kuala Lumpur
Census 2020 counted 1,982,112 people in the Federal Territory of Kuala Lumpur, and 10.5% of them were non-citizens.1 By ethnic group, the census dashboard shows 47.7% Bumiputera, 41.6% Chinese and 10.0% Indian.1
Kuala Lumpur clinics also serve visitors. The Malaysia Healthcare Travel Council, set up under the Ministry of Health in 2009, counts 82 member hospitals and has named 2026 Malaysia Year of Medical Tourism.6 It reported that healthcare travel revenue from China passed RM200 million for the first time in 2025, and that revenue from that market grew by 23% in the first quarter of 2026.6
The rules a clinic in Kuala Lumpur works under
Doctors register with the Malaysian Medical Council, which keeps provisional, full and specialist registers.3 Clinics answer to the Ministry of Health's Private Medical Practice Control Section, which has branches at headquarters and in each state and Federal Territory health department.2 It enforces the Private Healthcare Facilities and Services Act 1998, Act 586, which came into force on 1 May 2006 and covers private clinics, private hospitals and other private healthcare facilities.2
The Personal Data Protection Act 2010 was amended by Act A1727 in 2024. The Minister of Digital brought its sections into force on 1 January, 1 April and 1 June 2025.4 Under the Commissioner's circular on breach notification, a controller tells the Commissioner within 72 hours of a breach, and tells affected people within seven days of that notice where the breach involves sensitive personal data or is likely to cause significant harm.5 A breach affecting more than 1,000 people counts as significant in scale, and failing to notify the Commissioner can bring a fine of up to RM250,000, up to two years in prison, or both.5
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic. wai is compliant with these rules and built for clinics in Kuala Lumpur. Every message, draft, approval and signature sits in a log the clinic can export for a breach review.
The languages Kuala Lumpur patients write in
The census dashboard records Kuala Lumpur by community rather than by language. Its figures, with Bumiputera, Chinese and Indian communities living side by side and one resident in ten a non-citizen, show the mix a front desk reads every day.1 Healthcare travellers from China add to it.6
wai works in any language. A patient can answer intake questions by voice in their own language, and the doctor reads the answers in English before the visit.7 Each reply is drafted in the language the patient wrote in, and the team approves it before it is sent.
What a demo shows in Kuala Lumpur
A WhatsApp message arrives at 10pm from a mother in Mont Kiara asking whether her daughter's eczema can be seen on Saturday morning. wai keeps it in the family's thread, reads the dermatologist's busy times from Google Calendar, Outlook or Apple Calendar, and drafts a reply with the two earliest open slots and a booking link. The front desk approves it before closing up.
The booking link takes the deposit the clinic sets, in ringgit, through the clinic's own Stripe account, and the family receives a confirmation, a receipt and an intake questionnaire. On Saturday the scribe drafts the note, the dermatologist edits and signs it, and the invoice and the insurer's claim are prepared from the signed note for the team to check. See payment links and deposits for how clinics set the amount.
For health systems, government and insurers in Kuala Lumpur
Hospital groups, insurers and public programmes can commission a system built on wai for one defined care pathway, such as international patient intake, with records hosted in Malaysia and data, configuration and model rights agreed in the contract. See wai for organisations.
Where to start
First, write the clinic's breach routine around the 72-hour notice to the Commissioner and the seven-day notice to patients.5 Second, confirm the clinic's registration under Act 586 is current with the Federal Territory health department.2
Third, set the deposit amount for new patient bookings. Fourth, count last month's enquiries by channel, language and hour, then book a Kuala Lumpur demo and bring that count.
Bring a week of Kuala Lumpur enquiries, in every language they arrived in, and see the drafts your front desk would approve.
Frequently asked questions
When did the PDPA amendments take effect?
In three stages, on 1 January, 1 April and 1 June 2025, under the Minister of Digital's order P.U. (B) 522.4
How fast must a clinic report a data breach in Malaysia?
Within 72 hours to the Commissioner, and within seven days of that notice to affected patients where the breach is likely to cause significant harm.5
Which law licenses private clinics in Kuala Lumpur?
The Private Healthcare Facilities and Services Act 1998, Act 586, enforced by the Ministry of Health's Private Medical Practice Control Section.2
Can a Kuala Lumpur clinic take a deposit at booking?
Yes. wai Checkout takes the deposit the clinic sets through the clinic's own Stripe account, and the clinic stays the merchant of record.
Can patients write in their own language?
wai works in any language, and a person at the clinic approves each reply before it is sent.7
Who signs a note the scribe drafts?
The registered doctor. Every note stays a draft until the doctor reviews, edits and signs it.
Sources
- 1Department of Statistics Malaysia, OpenDOSM, 2022Kawasanku, W.P. Kuala Lumpur, Population and Housing Census 2020Read 15 October 2026Read source
- 2Ministry of Health Malaysia, 2026Pengenalan CKAPS, Private Medical Practice Control Section (Malay)Read 15 October 2026Read source
- 3Malaysian Medical Council, 2026Malaysian Medical Council, home pageRead 15 October 2026Read source
- 4Attorney General's Chambers, Federal Government Gazette, 2024Personal Data Protection (Amendment) Act 2024, appointment of date of coming into operation, P.U. (B) 522Read 15 October 2026Read source
- 5Personal Data Protection Commissioner, Malaysia, 2025Personal Data Protection Commissioner's circular on data breach notification, 2025 (Malay)Read 15 October 2026Read source
- 6Malaysia Healthcare Travel Council, 2026Malaysia Healthcare targets Greater Bay Area demand through MH Week Shenzhen 2026Read 15 October 2026Read source
- 7wai, 2026wai changelog, intake answered by voice in any languageRead 15 October 2026Read source
Every Kuala Lumpur enquiry answered the same evening, every booking paid before the patient arrives.
Fifteen minutes with a clinician who uses wai daily, on your own enquiries, diary and payments. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits