1Who we are and what this policy covers
This Privacy Policy explains what personal information ClinicEngines collects, how we use and share it, how we protect it, and the choices and rights you have.
ClinicEngines LLC ("ClinicEngines," "we," "us," or "our") is a Wyoming limited liability company. We provide clinics with an automated messaging assistant that runs on WhatsApp and, where a clinic chooses, on Facebook Messenger and Instagram. The assistant answers patient questions, books, reschedules, and cancels appointments, sends appointment reminders and follow-up messages, and alerts clinic staff when needed (together, the "Services").
This Policy applies to:
- Clinics that subscribe to our Services, and their staff ("Clinics").
- Patients and prospective patients who message a Clinic that uses our Services ("Patients").
- Visitors to our website at clinicengines.com ("Visitors").
This Policy does not describe how a Clinic itself handles your information. Each Clinic has its own privacy practices, and we encourage Patients to review them.
2Our role: clinic data vs. our own data
Patient information belongs to the Clinic. We process it only on the Clinic's behalf and under its instructions.
| Type of information | Our role | Who to contact |
|---|---|---|
| Clinic account, billing, and contact information | We decide how it is used ("business" or "controller") | ClinicEngines |
| Patient messages, appointments, and reminders | We act for the Clinic ("service provider" or "processor") | The Clinic you messaged |
| Website visitor information | We decide how it is used | ClinicEngines |
When we act as a service provider for a Clinic, we:
- Use Patient information only to provide the Services to that Clinic, as set out in our agreement with it.
- Do not sell it, use it for advertising, or combine it with information from other Clinics.
- Access message content only as needed to maintain the Services, fix a problem, or follow the Clinic's instructions.
If you are a Patient and want to exercise a privacy right, please contact the Clinic directly. If you contact us instead, we will forward your request to the Clinic within 5 business days.
3Information we collect
We collect only what we need to run the Services. We do not ask Patients for medical history.
| Category | Examples | Source |
|---|---|---|
| Clinic account information | Business name, contact person, phone numbers, email addresses, authorized staff numbers, billing and payment records | The Clinic |
| Clinic configuration | Services, prices, durations, opening hours, practitioners, scheduling-system connection details | The Clinic |
| Business verification | Information and documents Meta requires to verify the Clinic's business account | The Clinic |
| Patient identifiers | Name, phone number, WhatsApp, Messenger, or Instagram account identifier | The Patient |
| Patient messages | Message content, requested service and practitioner, requests to speak with staff | The Patient |
| Appointment information | Appointment details, reminders sent, and replies to them | The Patient and the Clinic's scheduling system |
| Website information | Information you submit through forms, browser type, device information, pages visited, and essential cookie data (see Section 9) | Website Visitors |
| Communications with us | Emails, messages, and support requests you send us | You |
4How we use information
We use personal information only for the purposes below, and not for unrelated purposes.
- Providing the Services: setting up, operating, and maintaining the assistant for each Clinic.
- Answering Patients: responding to inquiries and booking, rescheduling, or cancelling appointments on the Clinic's behalf.
- Reminders and notices: sending appointment reminders and notices when an appointment changes or a practitioner is unavailable.
- Follow-ups: sending a limited number of follow-up messages to a Patient who started an inquiry but did not book, where the Clinic has enabled this feature.
- Staff alerts: notifying Clinic staff when a Patient asks for a person or shows strong interest.
- Support and quality: troubleshooting, fixing errors, and improving the accuracy of replies for the same Clinic.
- Security: detecting and preventing misuse, fraud, and unauthorized access.
- Business operations: billing, accounting, and communicating with Clinics about their account.
- Legal compliance: meeting legal obligations and responding to lawful requests.
We do not use Patient information to market our own products, and we never use one Clinic's Patient information to serve another Clinic.
5AI and automated messaging
Patients chat with an automated assistant, and can ask to speak with a Clinic staff member at any time.
- Understanding messages: The assistant uses an artificial intelligence model to understand each message and draft a reply.
- Booking decisions: The AI model does not book appointments on its own. Our system checks every request against the Clinic's actual calendar and business rules, and confirms an appointment only after it has been recorded.
- Disclosure: At the start of a Patient's first conversation with a Clinic, the assistant tells the Patient that it is automated and links to this Privacy Policy (see the Appendix).
- Human handoff: When a Patient asks for a person, Clinic staff receive an immediate alert.
- AI provider: We use OpenAI models through OpenAI's business API and send only the message text needed to draft a reply. OpenAI does not use data submitted through its business API to train its models by default.
The Services do not provide medical advice or diagnosis, and they do not make automated decisions that produce legal or similarly significant effects on Patients.
6How we share information
We do not sell personal information, and we do not share it for cross-context behavioral or targeted advertising. We share it only with the parties below.
Service providers that help us run the Services
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms (WhatsApp, Messenger, Instagram) | Delivering messages between the Clinic and Patients through official accounts and approved message templates | United States and other countries |
| OpenAI | Understanding messages and drafting replies | United States |
| Cloud hosting provider | Running our systems and database | European Union |
| The Clinic's scheduling system (for example, Odoo) | Checking availability and recording appointments | Where the Clinic hosts it |
Other disclosures
- The Clinic: Patient conversations and appointment information are available to the Clinic that the Patient messaged.
- Legal requirements: When required by law, subpoena, or court order, or to protect the rights, safety, or property of ClinicEngines, our Clinics, or others.
- Business transfers: In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
- With consent: When you direct us to share information.
We notify Clinics at least 14 days before adding a new service provider that processes their Patients' information.
7Health information and HIPAA
We treat any health-related information that appears in a conversation as sensitive, even when a Patient shares it voluntarily.
A conversation may reveal the cosmetic, dental, or medical service a Patient is interested in, or health details the Patient chooses to mention. To limit this:
- The assistant does not ask for medical history or records, and does not give medical advice.
- Access to this information is limited to authorized personnel who need it.
- We ask Patients not to send medical records or photos through the assistant, and to contact the Clinic directly about medical matters.
HIPAA: The Services run on third-party messaging platforms, including WhatsApp, whose providers do not sign HIPAA business associate agreements. The Services are therefore not designed to transmit protected health information on behalf of HIPAA covered entities. Each Clinic is responsible for deciding whether the Services fit its legal obligations.
State health privacy laws: Where state laws protect consumer health data, we process that data only as a processor on the Clinic's behalf and under its instructions.
8Appointment reminders and follow-up messages
On a Clinic's behalf, the Services send three types of messages. Follow-ups are limited to two messages per inquiry.
| Message type | When it is sent |
|---|---|
| Appointment reminder | 24 hours and 3 hours before the appointment |
| Change or cancellation notice | When an appointment changes or a practitioner is unavailable, with alternative times offered |
| Inquiry follow-up | Up to two messages after a conversation stops without a booking, if the Clinic has enabled follow-ups |
If you do not want follow-up messages, tell the Clinic and it will stop them. Clinics can also turn off follow-ups for all Patients at any time. This does not affect reminders for appointments you have booked.
Messages sent outside an open conversation use templates approved by Meta and follow Meta's messaging policies.
9Cookies, Do Not Track, and Global Privacy Control
Our website uses only the cookies it needs to work. We do not use analytics, advertising, or social media tracking tools.
- Cookies: We use only essential cookies that make the website function. You can block or delete cookies in your browser settings, though some parts of the site may not work.
- Third-party tracking: We do not allow third parties to collect information about your online activities over time and across other websites through our website.
- Do Not Track: Because there is no common industry standard for Do Not Track browser signals, our website does not respond to them. We do not track Visitors across third-party websites in any case.
- Global Privacy Control: Where the law requires, we treat a Global Privacy Control signal as a request to opt out of the sale or sharing of personal information. We do not sell or share personal information, so the signal does not change how we handle your data.
10Data retention
We keep personal information only as long as we need it, then delete it or de-identify it so it can no longer be linked to a person.
| Information | How long we keep it |
|---|---|
| Patient conversation content | 90 days after the last message |
| Appointment and reminder records in our system | For the life of the subscription plus 30 days (appointments themselves remain in the Clinic's scheduling system) |
| Data of a Clinic whose service has stopped, whether for non-payment or cancellation | 3 months after the last day of service, so the Clinic can reactivate. During this period, the Clinic may request a copy of its data stored in our database. The data is then deleted. |
| Backups | Deleted automatically within 30 days after the original data is deleted |
| Billing and payment records | As long as tax and accounting laws require |
11Data security
We use technical and organizational safeguards designed to prevent unauthorized access. No system is perfectly secure, but we take protecting your information seriously.
- Encryption of data in transit over the internet.
- Access limited to authorized personnel, each with individual credentials.
- Secure storage of API keys and passwords, which are never shown in messages or logs.
- Separation of each Clinic's data from other Clinics' data.
- Regular database backups.
- Testing of every system update before it reaches Clinics.
- Confidentiality obligations for everyone who works with us.
If we discover a security incident affecting a Clinic's Patient information, we notify the Clinic without undue delay and give it the information it needs to meet its own notification obligations. We notify affected individuals and regulators where the law requires us to.
12Where we process information
We and our service providers process information in the United States, the European Union, and other countries where those providers operate.
These countries may have data protection laws that differ from the laws where you live. When we transfer information, we rely on written agreements with our service providers that require them to protect it and use it only to provide services to us.
13Your privacy rights
Depending on where you live, including California, Virginia, Colorado, Connecticut, and other states with privacy laws, you may have the rights below. We honor these requests regardless of your state where we reasonably can.
| Right | What it means |
|---|---|
| Know and access | Learn what personal information we hold about you and get a copy |
| Correct | Ask us to fix inaccurate information |
| Delete | Ask us to delete your information, unless we must keep it by law |
| Portability | Receive your information in a usable format |
| Opt out | Opt out of the sale or sharing of personal information, targeted advertising, and certain profiling. We do not do any of these. |
| Limit sensitive data use | Limit how sensitive information is used, where the law provides this right |
| Appeal | Appeal our decision if we decline your request |
How to make a request
- Patients: Contact the Clinic you messaged, which controls your information. You can also email us at ismail@clinicengines.com, and we will forward your request to the Clinic and help it respond.
- Clinics, their staff, and Visitors: Email us at ismail@clinicengines.com.
We will verify your identity before acting on a request, and respond within 45 days, or longer where the law allows and we tell you why. You may use an authorized agent, who must provide proof of authorization. To appeal a decision, reply to our response with "Appeal" in the subject line, and we will respond within the time the law requires.
We will not discriminate against you for exercising any of these rights.
14Children's privacy
Our website and Services are not directed to children under 13, and we do not knowingly collect personal information directly from them.
A Clinic may serve minor patients. When a minor's information reaches us through a Clinic, the Clinic is responsible for obtaining any parent or guardian consent the law requires. If you believe a child under 13 has given us personal information directly, contact us at ismail@clinicengines.com and we will delete it.
15Changes to this policy and how to contact us
We post every update on this page with a new effective date, and we notify Clinics by email at least 14 days before a material change takes effect.
If you have questions about this Policy or our privacy practices, contact us:
- Company: ClinicEngines LLC
- Mailing address: [Registered agent address, Wyoming]
- Email: ismail@clinicengines.com
This Policy is also available in Arabic. If the two versions differ, the English version controls.
AAppendix: opening notice for patients
The assistant sends this notice once, at the start of a Patient's first conversation with a Clinic: