Security
How we protect your patients' data and your clinic
This is how the system is built today. The first six points matter to every clinic owner; the rest are technical details for anyone who wants to know more.
The essentials
What you should know
-
The AI talks to patients; it doesn't run your clinic.
The assistant only arranges patients' bookings. Staff commands, like closing a day or pausing bookings, go through a closed command system it has no access to. Every command has to be confirmed within 15 minutes, or it cancels itself.
-
A patient's appointment opens for them only.
An appointment can only be viewed, changed or cancelled from the same account that booked it, on WhatsApp or Instagram. Even if someone knows the patient's number.
-
Nothing happens behind your back.
Every command that opens or closes time is logged, and a copy reaches the clinic owner on WhatsApp right away.
-
A view-only portal, without chat transcripts.
Even if someone got into the clinic owner's account, they couldn't change an appointment or delete anything. The portal doesn't show a single word of patients' conversations, and their numbers are masked.
-
Each clinic's data is isolated.
Every operation in the system is scoped to the clinic's ID, so no message, patient or appointment shows up at another clinic.
-
The assistant says what it is.
The first message to every patient tells them they're talking to an automated assistant, with a link to the privacy policy.
Technical details
Under the hood
-
Connection keys are protected.
WhatsApp and Instagram keys are stored encrypted, and the assistant itself can't read them. If a key is missing, the system stops booking and raises an alert, instead of working the wrong way.
-
An encrypted connection to the appointment system, or no connection.
The system talks to the clinic's calendar over HTTPS only. If it's pointed at an unencrypted address, booking stops by itself rather than sending patient data over an open connection.
-
A failure gives nothing away.
Error messages are cleaned of any link, key or login token before they're stored. The patient never sees a technical error; they get a normal reply.
-
Protected against query injection.
Every step that talks to the database passes data as separate parameters, and no query is built from the patient's text. A malicious message is stored as plain text and is never run.
-
Fake names don't get through.
The assistant turns down names like “I want 2” and asks for the real name, and strips links from the data before it's saved.
-
Clean records, no duplicates.
The patient's number is cleaned and converted to international format before it's matched, so an appointment isn't linked to the wrong patient and their file isn't duplicated in the clinic's system.
-
Every update is checked before it ships.
An internal scanner looks for any key or password exposed in the code. If it finds one, the update doesn't ship.
-
Portal accounts protected to modern standards.
An encrypted connection, passwords stored in a way nobody can read, not even us, protection against password guessing, and two-step verification for the admin account.
-
The database isn't open to the internet.
Only the system itself can reach it, from inside the server.
Privacy policy
What data we process, why, who sees it, and your patients' rights.