Privacy Policy
Epi AI Agency ("we", "us") is a sole proprietorship registered in India (Udyam UDYAM-TS-25-0092478), based in Hyderabad, Telangana. We make software that answers a clinic's WhatsApp messages on the clinic's behalf, using Meta's WhatsApp Business Platform. This policy explains what data the software handles and what we do with it.
Who is responsible for what
When you message a clinic that uses our software, the clinic decides what information it collects from you and why. Under India's Digital Personal Data Protection Act, 2023, the clinic is the Data Fiduciary and we process your data on the clinic's instructions. For the business details of clinics that connect to our software, we are responsible ourselves.
What we collect from clinics
- The identifiers Meta returns when a clinic connects its WhatsApp Business account: business portfolio ID, WhatsApp Business Account ID and phone number ID.
- The access token Meta issues so the software can send and receive messages for that account.
- The clinic details the clinic gives us to set up replies: name, address, timings, services, fees and staff numbers for alerts.
What we handle for people who message a clinic
- Your WhatsApp phone number and profile name.
- The messages you send the clinic, the software's replies, and replies the clinic's staff send from the WhatsApp Business app (so the software knows a person has taken over).
- Information you choose to give while booking: your name, age, reason for the visit and referring doctor.
- Your appointment details.
- Contact names saved in the clinic's WhatsApp Business app, so returning patients are greeted by name.
- When a clinic first connects, Meta can share up to 180 days of past chats. We keep only that a chat exists and when the last message was sent, not what it said.
How we use it
Only to run the service for the clinic: replying, booking, sending reminders and alerting the clinic's staff. We do not sell data, show advertising, or use it to train AI models. The software follows fixed rules written for each clinic and does not send your messages to an AI model.
Who we share it with
- The clinic you messaged.
- Meta Platforms, which delivers WhatsApp messages. Meta's own handling is covered by the WhatsApp Business policies.
- The clinic's booking calendar provider (for example Setmore), when the clinic uses one, to create your appointment.
- ngrok, a secure tunnelling service that routes incoming WhatsApp traffic to our server.
Requests from authorities
We share data with authorities only when Indian law requires it. If a government or law-enforcement authority asks us for personal data, we:
- check that the request is lawful under Indian law before we act on it;
- disclose only the minimum data the request needs;
- keep a record of each request, what we disclosed and why.
Where it is kept and how it is protected
Data is stored on equipment we control in India. Traffic between Meta and our server is encrypted in transit. Your reason for the visit and referring doctor are also encrypted at rest (AES-256-GCM). Only we can access the stored data.
How long we keep it
For as long as the clinic uses our software, unless you or the clinic ask us to delete it sooner. When a clinic stops using our software, we delete its data within 30 days.
Your rights
You can ask for a summary of the data held about you, ask us to correct it, or ask us to erase it. You can also raise a grievance with us, and if it is not resolved, with the Data Protection Board of India. To do any of this, contact the clinic you messaged or email us at chaital.business@gmail.com. See Data deletion for the steps.
Changes
If this policy changes, we will update this page and the date at the top.
Contact
Epi AI Agency, Hyderabad, Telangana, India
chaital.business@gmail.com