Privacy Policy

1. Information We Collect

When you use our website or appointment-booking services, we may collect information such as:

• Your name
• Your phone number
• WhatsApp account information required to communicate with you
• Appointment service requested
• Preferred appointment date and time
• Appointment confirmation, cancellation or rescheduling information
• Messages you send through the appointment-booking chatbot
• Basic technical information required to operate and secure the service

The basic appointment-booking service is not designed to collect medical records, clinical notes, electronic health records, payment-card information or detailed medical information.

2. How We Use Information

We use information as necessary to provide and operate our services, including to:

• Understand appointment requests
• Check available appointment slots
• Create appointments
• Reschedule or cancel appointments
• Send appointment confirmations
• Provide customer support
• Maintain service security and reliability
• Comply with applicable legal requirements

3. WhatsApp and Meta Integration

Clinic Booking AI may use the WhatsApp Business Platform provided by Meta to send and receive appointment-related messages.

When you communicate with a clinic through WhatsApp, information such as your phone number and message content may also be processed through Meta's WhatsApp infrastructure according to Meta's own terms and privacy policies.

4. Google Calendar Integration

When an authorized operator connects a calendar, Clinic Booking AI reads busy intervals and selected event identifiers, appointment times, status and version information to check availability and manage appointments safely. When identifying older bookings created by the app, it may temporarily read event descriptions, which can contain patient and contact details. Its current Calendar requests exclude unused attendee, organizer and location fields.

For a new appointment, the app writes the supplied patient name, treatment, WhatsApp number, booking reference, appointment times and information identifying the booking as created by the app. Rescheduling changes appointment times, and cancellation removes the Calendar event after the required verification and confirmation steps.

The application stores booking and contact details, Calendar identifiers and event-version information, appointment status and compact change/recovery records in its database. Authorized staff can view booking details and history. Google authorization tokens are stored privately to maintain the Calendar connection. The application's current booking records do not retain full Calendar event snapshots; older backup copies may reflect earlier versions of the application.

5. Messages, Voice and AI Processing

Meta's WhatsApp Business Platform carries messages and voice notes. OpenAI processes voice recordings for transcription and may process the latest typed message or transcript to identify appointment details or the kind of enquiry. These requests can include public clinic/service information and limited workflow context, such as which appointment details are still missing.

Stored Calendar records, event descriptions and Google authorization credentials are not automatically included in those AI requests. However, information that a person includes in a new message or recording—including names, contact details or treatment information—can reach the relevant processing provider.

The application uses configured clinic information for practical answers. It does not use AI to diagnose conditions, decide personal treatment suitability or confirm that a Calendar action succeeded without checking that action.

6. Sharing of Information

We may share limited information with service providers where necessary to operate the service, including providers of:

• WhatsApp and Meta services
• Calendar services
• AI processing
• Database services
• Website and application hosting

We do not sell personal information.

Information may also be disclosed where required by law or where reasonably necessary to protect users, our services or our legal rights.

Clinic Booking AI uses Google for connected Calendar operations, Meta for WhatsApp communication and OpenAI for message understanding and voice transcription. Authorized clinic/demo staff have access to booking information through the staff dashboard. Service providers process information needed for their respective functions under the applicable account arrangements and policies.

Cloudflare R2 stores encrypted backups of the working demo database, Google Calendar authorization tokens and staff login credentials, including the password hash. The database backup includes booking/contact information, conversation state, booking history and records used to prevent duplicate actions. Synthetic test backups are also stored there. Separate encrypted recovery checkpoints preserve the limited identifiers and operational state needed to avoid restoring deleted records or reusing booking references. These checkpoints do not contain treatment descriptions or message content. Backup encryption keys are held separately from R2. A working-demo backup and recovery test have been completed; automatic backup scheduling and automatic record cleanup are not yet enabled. We will update these disclosures when the application hosting or processing arrangement changes.

The app does not maintain its own archive of voice recordings. Voice messages and transcripts can nevertheless be processed or retained by the communication and AI providers under their own applicable arrangements. This statement does not promise immediate deletion from provider systems.

7. Data Retention

We retain personal information only for as long as reasonably necessary to provide the service, maintain appointment records, meet applicable legal obligations, resolve disputes and protect the security of the platform.

Information that is no longer required may be deleted or anonymized.

The current demo does not automatically delete all booking, history and conversation records after a fixed period. Expiry of an appointment verification code prevents its use; it does not itself erase every associated record. Requests concerning stored information can be sent to info@mhteki.com and are reviewed by the demo operator.

Encrypted R2 rehearsal files are configured to expire after seven days. Additional R2 backup categories are configured for seven days for daily copies, 28 days for weekly copies and 30 days for pre-deployment copies; these settings do not mean scheduled backups are already running. Storage-provider expiry can take additional processing time, and these rules do not delete local copies or records held independently by other providers. Recovery checkpoints do not use these automatic backup-expiry rules. Any deletion markers are retained until affected older backups are confirmed expired and an operator has reviewed safe removal; reference-reservation and recovery state is retained while needed for reliable operation. We are finalizing the live demo-record, local-copy and recovery-checkpoint cleanup process before enabling unattended staging use.

8. Data Security

We take reasonable technical and organizational measures to protect personal information against unauthorized access, misuse, alteration or disclosure.

However, no internet-based service can guarantee absolute security.

9. Your Rights

Depending on applicable law, you may have the right to request:

• Access to personal information we hold about you
• Correction of inaccurate information
• Deletion of your information
• Information about how your personal information is processed

10. Data Deletion Requests

If you want to request deletion of personal information from our systems, contact:

info@mhteki.com

You may also review our Data Deletion Instructions.

We may need sufficient information to identify the relevant account or appointment record. Certain information may be retained where required by law or for legitimate security and record-keeping purposes.

11. Third-Party Services

Our services may integrate with third-party platforms such as WhatsApp, Meta, Google and AI service providers.

These third parties may process information according to their own privacy policies and terms.

12. Changes to This Privacy Policy

We may update this Privacy Policy when our services, legal obligations or technology change.

Any updated version will be published on this page with a revised "Last updated" date.

13. Contact Us

For privacy questions or data-related requests: