Privacy Policy
Last updated 21 July 2026
byJelly is practice management software for freelance Traditional Chinese Medicine practitioners, operated by Spectrality Enterprise in Malaysia. This policy explains what we collect, why we collect it, and what you can ask us to do with it.
Two different roles
This distinction matters, so we state it up front. When you sign up as a practitioner, we decide how your account data is handled — we are the data controller for that information.
When you enter patient records into byJelly, you remain the data controller for those records. We only store and process them on your behalf, under your instructions. Your patients' relationship is with you, not with us.
We do not use patient records for any purpose of our own. We do not analyse them, sell them, share them, or use them to train machine learning models.
What we collect
Account and profile information you give us:
•
Your name, email address, and password (stored only as a cryptographic hash).
•
If you sign in with Google: your name, email address, and profile picture. Nothing else.
•
Clinic details, availability, booking link, and any profile text or images you add.
Practice data you enter:
•
Patient names, contact details, appointments, treatment notes, and health information.
•
Invoices, payments, sales records, and payout figures.
•
Documents and images you upload.
Technical data generated automatically:
•
Session tokens stored in your browser or device so you stay signed in.
•
Basic server logs — IP address, timestamp, and error details — used to keep the service running and to investigate faults.
We do not use advertising cookies, third-party analytics trackers, or any form of cross-site tracking.
Signing in with Google
Choosing “Continue with Google” lets you use your Google account instead of a separate password. We request only your basic profile and email address.
We do not request, receive, or have any ability to read your Gmail messages, Google Calendar, Google Drive, or Google Contacts. Sign-in is handled by Google and by Supabase, our authentication provider; we never see your Google password.
You can disconnect byJelly at any time from your Google account permissions page. Doing so stops future Google sign-ins but does not delete your byJelly account.
Why we use it
•
To create and secure your account and keep you signed in.
•
To provide the features you use — patients, appointments, invoices, documents, analytics.
•
To send service messages such as email verification, password resets, and booking notifications.
•
To fix faults, prevent abuse, and keep the service available.
•
To handle subscription billing once paid plans begin.
We do not send marketing email unless you ask us to, and we do not sell personal data to anyone, ever.
Who else processes your data
We keep the list of third parties deliberately short. Each one acts on our instructions under contract:
•
Supabase — database, file storage, and authentication. Your account data and practice data are stored here.
•
Vercel — hosting and delivery of the web app at tcm.spectramsia.com.
•
Google — only if you choose “Continue with Google”, and only for sign-in.
We are not currently charging for byJelly. When paid plans begin we expect to use HitPay as our payment gateway, and may also accept bank transfer or e-wallet payments. Card and banking details will be handled directly by the payment provider — they will not pass through or be stored by byJelly. We will update this policy before any of that goes live.
Some of these providers operate servers outside Malaysia, so your data may be stored or processed abroad. We choose providers that offer appropriate contractual safeguards.
How we protect it
•
All traffic is encrypted in transit using HTTPS.
•
Database row-level security means one practitioner cannot read another practitioner's records.
•
Passwords are hashed, never stored in readable form.
•
Administrative access is limited to the people who need it to operate the service.
No system is perfectly secure. If a breach ever affects your data, we will tell you and the relevant authorities without undue delay.
How long we keep it
We keep your account and practice data for as long as your account is active. If you close your account, we delete or irreversibly anonymise your data within 90 days, except where we must keep records longer to meet Malaysian tax or accounting obligations.
You can export your practice data at any time while your account is active. Ask us and we will help.
Your rights
Under the Malaysian Personal Data Protection Act 2010 you may:
•
Ask what personal data we hold about you and request a copy.
•
Ask us to correct data that is inaccurate or incomplete.
•
Withdraw consent or ask us to limit how we process your data.
•
Ask us to delete your account and its data.
Email support@spectramsia.com and we will respond within 21 days.
If you are a patient of a practitioner who uses byJelly, please contact that practitioner directly. They control your records; we cannot amend or release them without their instruction.
Children
byJelly is a professional tool intended for practitioners aged 18 and over. We do not knowingly create accounts for anyone under 18. Practitioners may record patient information for minors, and remain responsible for obtaining consent from a parent or guardian where the law requires it.
Changes to this policy
If we make a material change we will update the date at the top of this page and notify active practitioners by email before the change takes effect.
Spectrality Enterprise (SSM 202403201869 · IP0599248-P), registered in Malaysia.
Questions about this document? Email support@spectramsia.com