1. Overview

SmartClinic AI HK Limited ("the Company", "we", "us") provides the following two services (together, "the Service"):

• Clinic WhatsApp AI Assistant: WhatsApp AI booking and enquiry service for private medical clinics in Hong Kong.
• Business Inbox (business messaging platform): lets businesses manage their WhatsApp, Facebook Messenger and Instagram direct messages in one place, with automated replies, customer tags, broadcast messages and reports.

This Privacy Policy explains how we collect, use, store and protect personal data in delivering the Service, including data relating to patients, the customers of businesses, and clinic and business staff.

For the personal data of patients or customers, the clinic or business using the Service is the Data User, and the Company acts as a Data Processor that handles such data only on that clinic's or business's instructions. Clinics and businesses should provide their patients or customers with a Personal Information Collection Statement in accordance with the Personal Data (Privacy) Ordinance.

2. Data We Collect

2.1 Clinic WhatsApp AI Assistant

• Patients' WhatsApp phone numbers
• Message content sent by patients (text and images, e.g. insurance cards)
• Appointment details (name, appointment date and time)
• Activity logs of clinic staff using the admin dashboard

2.2 Business Inbox

When a customer chooses to message a business that uses the platform via WhatsApp, Facebook Messenger or Instagram, we process the following data on behalf of that business:

• The customer's WhatsApp phone number, or the Messenger / Instagram scoped ID provided by Meta
• The customer's display name and Instagram username (provided by Meta)
• Message content exchanged between the customer and the business, including text and attachment information
• Message sent, delivered and read status
• Tags, notes and coupon codes set by the business, and the customer's subscription or opt-out status

For the business itself, we collect the business name, staff login emails, passwords in hashed form, the names and IDs of connected Facebook Pages and Instagram professional accounts, and staff activity logs on the platform.

3. How We Use Data

3.1 Clinic WhatsApp AI Assistant

• Processing and confirming patient appointments
• Providing queue management
• Sending follow-up, vaccination or other medical reminders requested by the clinic (patients may reply "STOP" at any time to unsubscribe)
• Helping clinic staff handle patient enquiries, including taking over conversations manually
• Using AI to understand and reply to patient enquiries (all AI replies are subject to medical safety rules and never include diagnosis or medical advice)

3.2 Business Inbox

• Showing customer messages in the business's inbox so that its staff can read and reply to them
• Automatically answering common enquiries using information the business has confirmed; enquiries that cannot be answered are passed to the business's staff
• Sending broadcast messages and coupon codes, on the business's instructions, to customers who have agreed to receive them; customers may opt out at any time
• Providing the business with reports such as message delivery, read rates and usage

3.3 Facebook Messenger and Instagram data

• We only access direct messages that customers send to the business's Facebook Page or Instagram professional account, and the business's replies.
• We do not access posts, comments, friend lists or other profile data of the business or its customers, and we do not publish any content on the business's behalf.
• This data is used only for the purposes above. It is never used for advertising or profiling, never sold or transferred to third parties, and never shared with other businesses.
• A business can disconnect its Page or Instagram account from the platform at any time; we then stop receiving new messages for that account.

We also use system logs for security, abuse prevention and service improvement. We do not use patient or customer data for promotional or advertising purposes unrelated to the above.

4. Data Storage and Security

Data is stored on Google Cloud Platform infrastructure and protected by encrypted transmission (TLS/SSL). Business Inbox data is kept in a dedicated database with each business's data stored separately; access tokens used to connect WhatsApp, Facebook and Instagram are encrypted before storage. Staff must sign in with an account and password, and the system only shows data belonging to their own business.

To provide the Service, some data may be processed on servers outside Hong Kong (for example, AI language processing and message delivery). We apply reasonable technical safeguards, including encrypted transmission and access controls, to protect such data.

Data is generally deleted within 90 days after a clinic or business stops using the Service, except where the law requires longer retention. A clinic or business may also request a different retention arrangement or earlier deletion.

5. Third-Party Services

The following third-party providers process data in delivering the Service:

• Meta Platforms, Inc. — WhatsApp Business Platform, Messenger Platform and Instagram Messaging API, for receiving and sending messages
• Google Cloud Platform — server computing, database storage and AI language processing (Vertex AI)
• Google Workspace — appointment and conversation records for the clinic service (Google Sheets)
• Cloud database provider — clinic master data

Each provider handles data under its own privacy policy. We consider security standards and industry reputation when selecting providers.

6. Data Sharing

We never sell or rent personal data, and we never share data between different clinics or businesses. Data may only be accessed or disclosed:

• To comply with applicable law, court orders or lawful requests from government authorities
• To protect the legitimate rights of the Company, clinics, businesses or others (e.g. to prevent abuse of the Service)
• On the instructions of the clinic or business as the Data User

7. Your Rights and Data Deletion

Under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486), patients and customers generally have the right to:

• Access personal data we hold about them on behalf of a clinic or business
• Request correction of inaccurate personal data
• Request deletion of their personal data (subject to legal retention requirements)
• Unsubscribe from automated reminders or promotional messages at any time (reply "STOP", or contact the clinic or business)

Facebook and Instagram users can also remove this app's access under "Apps and Websites" in their Facebook settings. To delete stored data, please see our Data Deletion Instructions.

To exercise these rights, you may contact the clinic or business that serves you, or contact us using the details below, and we will do our best to assist.

8. Regulatory Reference

The Service is designed and operated with reference to:

• Hong Kong Personal Data (Privacy) Ordinance (Cap. 486)
• Meta Platform Terms and Developer Policies
• The usage and commerce policies of the WhatsApp Business Platform, Messenger Platform and Instagram

This Policy describes our general practice and does not constitute legal advice. Clinics and businesses remain responsible for meeting their own professional and regulatory obligations when using the Service.

9. Changes to This Policy

We may update this Policy from time to time to reflect changes in law, technology, or our business. Material changes will be announced on this website, and the "Last updated" date above will be revised accordingly. Please check back periodically for the latest version.

10. Contact Us