Privacy Policy

Last updated: 6 August 2026  ·  Effective: 6 August 2026

Clinica by iSolveX is clinic management software with a WhatsApp assistant. This policy explains what personal data we handle, why, how long we keep it, and how you can exercise your privacy rights — including deleting your data.

1. Who we are

iSolveX ("we", "us") builds and operates Clinica, a software platform that dental and medical clinics use to manage appointments, patient records, billing and patient communication over WhatsApp.

2. Data we process

2.1 Clinic staff accounts

• Name, email address and phone number
• Role and permissions within the clinic
• Authentication data (a securely hashed password; we never store it in readable form)
• Activity records — which staff member performed which action, and when

2.2 Patient data, entered by the clinic

• Name, phone number, date of birth, gender and preferred language
• Appointments, treatments, clinical notes and treatment instructions
• Billing records, payments and insurance details
• Feedback and satisfaction responses

2.3 WhatsApp conversations

When a person messages a clinic's WhatsApp number, we process that conversation so the assistant can answer and so clinic staff can take over when needed:

• The sender's WhatsApp phone number and profile display name
• Message content — text, and voice notes where the clinic has enabled them
• Message timestamps and delivery status
• Whether the AI assistant or a human staff member is handling the conversation

2.4 Technical data

• Security and audit logs, including timestamps of privileged actions
• Error and diagnostic logs needed to keep the service running

3. Why we process it

Messaging consent, precisely

• Utility messages (appointment reminders, confirmations, feedback requests) are sent to people who have contacted the clinic, as a service they expect.
• Marketing messages (offers, campaigns, reactivation) are sent only while the recipient has not opted out, and every one of them carries opt-out instructions.
• An opt-out is permanent until the person explicitly opts back in.
• To stop marketing messages at any time, reply STOP or إيقاف to the clinic's WhatsApp number.

4. Artificial intelligence

Clinica uses AI to understand patient messages and draft replies. To do this, message content is sent to third-party AI providers (such as OpenAI or Anthropic) for processing. Where the clinic has enabled voice notes, audio is transcribed to text by the same kind of service.

• AI providers process this content only to return a response to us.
• We use their business/API tiers, under which submitted content is not used to train their public models.
• AI never has the final word on clinical decisions. Staff can take over any conversation at any time.
• A clinic may supply its own AI provider key, in which case that provider's terms also apply to that clinic's traffic.

5. WhatsApp and Meta

Patient messaging runs on the WhatsApp Business Platform, operated by Meta. When a person messages a clinic on WhatsApp, that message passes through Meta's infrastructure and Meta processes it under its own terms.

• We receive messages from Meta through a secured webhook and store them against the clinic that owns the number.
• Each clinic connects its own WhatsApp Business account; access tokens are stored encrypted and are never shared between clinics.
• Meta's handling of message data is governed by the WhatsApp Business Policy and the WhatsApp Privacy Policy.

6. Sharing

We share personal data only with service providers who help us run the platform:

We may also disclose data where we are legally required to, or to establish or defend legal claims. We do not sell or rent personal data to anyone.

7. Security

• Tenant isolation. Every clinic's data is separated at the database level, so one clinic can never read another's records.
• Encryption. Data is encrypted in transit (TLS). WhatsApp access tokens and other clinic secrets are encrypted at rest with per-clinic keys.
• Least privilege. Staff see only what their role allows; sensitive actions are permission-gated and enforced on the server, not just hidden in the interface.
• Auditability. Privileged actions are recorded with the acting user and timestamp.
• Verified webhooks. Incoming WhatsApp requests are signature-verified, so forged requests are rejected before processing.

No system is perfectly secure. If a breach affects your data, we will notify the affected clinic without undue delay so it can inform the people concerned as the law requires.

8. How long we keep data

When a clinic closes its account, its data is deleted or irreversibly anonymised, except where we are legally required to retain specific records.

9. Your rights

Depending on where you live, you may have the right to:

• Know what personal data is held about you and get a copy
• Correct data that is inaccurate or incomplete
• Delete your data — see Data Deletion
• Object to or restrict certain processing
• Withdraw consent for marketing at any time (reply STOP or إيقاف)
• Lodge a complaint with your local data protection authority

Because the clinic is the controller of patient data, start with the clinic where possible. If you cannot reach them, contact us and we will help.

10. International transfers

Our providers operate data centres in several regions, so your data may be processed outside your country. Where that happens we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

11. Children

Clinica is not directed at children. Clinics do treat minors, and a parent or guardian may provide a minor's information as part of that care. In that case the clinic is responsible for obtaining the appropriate consent under local law.

12. Changes to this policy

We may update this policy as the platform evolves. The "last updated" date above always reflects the current version, and we will notify clinics of material changes.