1. Information We Collect

We collect information you provide directly and information generated while you use the platform:

• Account information — name, email address, phone number, organization details, and login credentials you provide when registering or contacting us.
• Billing information — subscription plan, invoices, and payment references. Card details are handled by our payment providers and are never stored on our servers.
• Clinic and business data — records your organization creates inside the platform, such as appointments, staff, inventory, and financial documents.
• Patient data — clinical and personal records entered by clinics. We process this data solely on behalf of the clinic that owns it (see Section 3).
• Usage and device data — log data, IP address, browser type, pages visited, and actions performed, used for security, diagnostics, and product improvement.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the platform and its features.
• Set up and manage your organization's account, subscription, and billing.
• Send service communications such as verification emails, renewal reminders, and important product or security notices.
• Provide customer support and respond to your requests.
• Monitor performance, prevent abuse and fraud, and keep the platform secure.
• Improve our products, including aggregated, de-identified analytics.

3. Patient Data — Our Role as Processor

Clinics using Calaix AI remain the owners and controllers of their patients' data. We act as a data processor: we store and process patient records only to deliver the service, on the instructions of the clinic, and we never sell patient data or use it for advertising.

Each tenant's data is logically isolated, encrypted in transit, and accessible only to the users the clinic authorizes through its own role and permission settings.

4. Cookies

We use cookies and similar technologies that are necessary for the platform to function — such as keeping you signed in, remembering your language preference, and securing your session. Optional analytics cookies, where used, help us understand how the site is used so we can improve it. You can control cookies through your browser settings; disabling essential cookies may prevent parts of the platform from working.

5. Sharing and Third Parties

We do not sell your personal information. We share information only with:

• Service providers who help us operate the platform — such as cloud hosting, payment processing, and SMS, email, and WhatsApp delivery providers — bound by contractual confidentiality and used only as needed to deliver the service.
• Legal authorities, when required by applicable law or a valid legal process.
• A successor entity, in the event of a merger or acquisition, subject to this policy.

6. Data Security

We protect your data with industry-standard measures, including encryption in transit, tenant isolation, role-based access control, audit logging, and continuous monitoring. No system is perfectly secure, but we work to protect your information against unauthorized access, alteration, disclosure, or destruction.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. When a subscription ends, organization data is retained for a limited grace period to allow reactivation or export, then deleted in accordance with our retention schedule.

8. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details below. Patients should direct requests about their medical records to their clinic, which controls that data — we will support the clinic in fulfilling them.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and notify you through the platform or by email where appropriate. Continued use of the service after changes take effect constitutes acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us through the Contact Us page or by phone. We aim to respond to all privacy inquiries promptly.