Privacy policy
Effective 17 October 2026 · Last updated 17 October 2026
This policy explains how Hey Mag handles personal data in AnaXS, a booking platform in Singapore where clinics request an anaesthetist for a procedure. It is written for the people who use AnaXS: clinic staff, anaesthetists and the operator team. It also meets the notice expected under the Personal Data Protection Act 2012 of Singapore (PDPA).
Who we are
AnaXS is operated by Hey Mag, which is the data controller for the personal data described here. AnaXS connects clinics with anaesthetists: a clinic sends a request, anaesthetists are offered the case over WhatsApp and the web, the first valid acceptance gets the case, and both sides are reminded until the day. Each of clinics, anaesthetists and the operator team has its own web portal, and anaesthetists can optionally add their bookings to Google Calendar. Invoices are issued monthly.
Contact: lex@heymag.app
What personal data we collect
We collect only what is needed to run the service:
- Account details for clinic staff, anaesthetists and operator staff: name, email address, mobile number (required for anaesthetists), role, and which clinics a person belongs to. Passwords are handled by our sign-in provider and stored in a protected form; we cannot read them.
- Professional details for anaesthetists: name, mobile number, email address, Singapore Medical Council registration (MCR) number, the tags and affiliations that decide which clinics are offered to them first, and the minimum patient age they will take.
- Clinic details: clinic name, address, WhatsApp number and email address, affiliations, and the clinic's list of favourite anaesthetists.
- Booking records: the Case ID, date, time, length, location, procedure, the name of the requesting doctor, short non-clinical remarks, who was offered the case and who accepted, declined or acknowledged it, cancellations and their reasons, and a history of every change.
- Message records: each WhatsApp message and email we send (recipient number or address, template, the case details inside it, and delivery receipts showing whether it was sent, delivered and read), and the replies we receive, such as an Accept or Decline button tap, with the sender's number and WhatsApp profile name.
- Sign-in and security records: when a person accepted the terms of use, with the network (IP) address and browser details at that time; invitations (email address, role, expiry); one-time login links (we keep only a scrambled copy of the link); and an audit log of important actions, recording who did what and when.
- Invoices: invoice number, period, the clinic or anaesthetist invoiced, the amounts, and the Case IDs billed.
- Google Calendar connection, only for anaesthetists who choose to connect it. See Google user data.
Our hosting provider also keeps standard server logs of requests to the site, as most web hosts do.
What we do not collect
AnaXS does not collect patient information. A request has no field for a patient's name, NRIC or medical details. Clinics must confirm on every request that its remarks contain no patient information, the form rejects entries that look like an NRIC number, and our WhatsApp messages never include patient details. Please never put patient information in a request, a remark or a message. If you see some, tell us at lex@heymag.app.
Why we use personal data
- To create and run accounts, and to invite people to AnaXS.
- To offer cases to the right anaesthetists, record the first valid acceptance, confirm bookings, send reminders and ask for acknowledgement, and handle cancellations.
- To contact people about a booking by WhatsApp, email or on the web.
- To keep a reliable record of who was offered, who accepted and what was sent, so that disputes can be settled.
- To issue monthly invoices and keep financial records.
- To keep the service secure and working: the operator team is alerted when something fails, for example a message that could not be sent.
- To add bookings to an anaesthetist's Google Calendar, if they choose to connect it.
- To meet our legal obligations.
We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models. We use your details only for the purposes above or others you agree to.
WhatsApp messages
Offers, results, reminders and alerts are sent as WhatsApp Business messages. We send them through the WhatsApp Business Platform, operated by Meta, using an authorised messaging provider. A message contains case details such as the Case ID, clinic, requesting doctor, procedure, location, time and remarks, and a link to open the case. When you reply or tap a button, WhatsApp passes your reply, your number and your profile name back to us. WhatsApp's own privacy policy applies to your use of WhatsApp. If you do not want WhatsApp messages from AnaXS, tell us (see Your rights); anaesthetists who stop receiving them will not receive offers.
Where your data is stored
Our database is hosted with Supabase in Singapore (AWS region ap-southeast-1). The AnaXS application runs on Vercel in its Singapore region. Some of the service providers listed below may process data outside Singapore. Where personal data is sent overseas we take steps to make sure it receives protection comparable to the standard under the PDPA.
How long we keep it
- Booking records and message records are kept for 7 years, as proof of who was offered a case, who accepted it and what was sent.
- Invoices are kept as financial records.
- Accounts and roster details are kept while the person or clinic uses AnaXS, and then as long as needed for the records above.
- Invitations and one-time login links expire after 7 days.
- Google Calendar connection: until you disconnect it. See Google user data.
Removing your details on request
You can ask us to remove your personal details. We cannot delete the booking and message records, because the other people in a booking rely on them and we must keep proof of what happened. Instead we anonymise you, which means:
- Replaced or cleared: your name becomes “Removed user”; your mobile number and email address are replaced with placeholders; your MCR number and tags are cleared; your login is closed, your clinic memberships and login links are removed, and any Google Calendar connection is deleted.
- Also searched: we look through our message records, delivery logs, audit log and operator alerts for your name, number and email address, and replace them wherever they appear.
- Kept: the booking itself and the proof around it: Case IDs, dates and times, statuses, and the receipts showing that messages were sent, delivered and answered, now without your details. Invoices already issued are also kept, because they are financial records.
This works on the details we hold for you. It may not catch a name written in another form, such as a first name on its own, or personal details someone typed into free-text remarks. Tell us if you find any and we will remove them.
Your rights
Under the PDPA you may ask us to:
- tell you what personal data we hold about you and how we use it;
- correct personal data that is wrong or out of date;
- stop using or disclosing your personal data, by withdrawing your consent (we will tell you what that means for your use of AnaXS, for example that you could no longer receive offers); and
- anonymise your details, as described above.
Email lex@heymag.app. We will confirm who you are first, and we aim to reply within 30 days. If you are not satisfied with our reply you can contact Singapore's Personal Data Protection Commission at pdpc.gov.sg.
How we protect it
- Connections to AnaXS are encrypted.
- People sign in with an email address and password, or with a one-time link that works once, expires after 7 days, and is stored only in a scrambled form.
- Invitations expire after 7 days.
- Access depends on role. Clinic staff see their own clinic's cases, anaesthetists see cases offered to them or booked with them, and the operator team has wider access. These limits are enforced in the database as well as on the screens.
- Google refresh tokens are stored encrypted.
- Incoming WhatsApp notifications are checked before we act on them.
- Important actions are written to an audit log.
No system is completely secure. If a data breach occurs that the law requires us to report, we will notify the Personal Data Protection Commission and the people affected as the PDPA requires.
Google user data
Connecting Google Calendar is optional and available only to anaesthetists, from their profile page. If you never connect it, AnaXS receives no data from Google. You can always add a case to a calendar yourself with the download and “Add to calendar” buttons on its page, which need no connection.
What AnaXS asks Google for. AnaXS requests the Google Calendar scope calendar.app.created, plus openid and email, which let us show which Google account is connected. Nothing else.
What AnaXS does with it. AnaXS creates one secondary calendar in your Google account named “AnaXS bookings”. It adds, updates and removes your booking events in that calendar only. This scope does not let AnaXS see or change any of your other calendars or events, and AnaXS does not read events from your Google Calendar. Each event carries the booking details you already see in AnaXS: a title of location, procedure and requesting doctor, the Case ID, the clinic, your name, any remarks, and a link to the case page. It never contains patient information.
What AnaXS stores. The email address of the Google account you connected, the identifier of the “AnaXS bookings” calendar, and an encrypted refresh token that lets AnaXS keep that calendar up to date without asking you to sign in each time. The token is encrypted before it is stored and is never shown to anyone.
How it is used and shared. Google user data is used only to provide this calendar feature. It is not sold, not used for advertising, and not used to train AI models, and it is not shared with anyone except as needed to provide the feature (our hosting and database providers store it on our behalf, and Google receives the calendar updates). Our staff do not read it unless you ask us to, it is needed to investigate abuse or a security problem, or the law requires it.
Stopping it. Press Disconnect on your AnaXS profile page. This deletes the “AnaXS bookings” calendar from your Google account, revokes AnaXS's access and deletes the stored refresh token. You can also remove AnaXS's access at any time at myaccount.google.com/permissions; if you do that, AnaXS stops updating the calendar, and events already in it stay until you delete the calendar yourself. If you ask us to anonymise your details, we also delete the connection.
AnaXS's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Changes to this policy
We may update this policy as AnaXS changes. The “Effective” and “Last updated” dates at the top show which version you are reading. If a change is significant we will tell AnaXS users, for example by email or in the app, before it takes effect.
Contact
Questions, requests or complaints about personal data: Hey Mag, lex@heymag.app.