Privacy Policy

1. Who is responsible for your data

The controller of the data collected on this website is Ilan Souffir, Osek Patur (Israeli VAT-exempt sole proprietor), registered office 22 Geula Street, Tel Aviv, Israel, registered with Israeli Tax Authority under number 342615648.

For any question about this policy or to exercise your rights, write to clinicplusai@gmail.com.

2. Two very different roles

When you browse this website or contact us, we act as the controller: we decide what is collected and why.

When a clinic uses ClinicPlusAI to answer its patients, the clinic remains the controller of the patient data. We act as a processor and only handle that data to deliver the service, on the clinic's documented instructions, under a data processing agreement signed with the clinic.

3. What we collect

The data below is collected either directly from you or automatically while you use the site or the service.

• Identification and contact details: first name, last name, clinic name, role, email address, phone number.
• Commercial exchanges: messages sent through our contact channels, call notes, quotes and subscription details.
• Billing data: plan, billing cycle, currency, invoices. Card details are handled by our payment provider and never stored on our servers.
• Technical data: IP address, browser, device type, pages viewed, approximate country derived from the IP address in order to display prices in the right currency.
• Service data, for clinics: WhatsApp conversations, appointment details, waiting list entries and any information a patient chooses to send to the clinic's assistant.

4. Why we use it, and on what legal basis

• To reply to your requests and prepare a quote: performance of pre contractual steps taken at your request.
• To provide, operate and support the service: performance of the contract signed with the clinic.
• To bill and keep accounting records: legal obligation.
• To keep the service secure, prevent abuse and debug incidents: our legitimate interest in a reliable and safe product.
• To measure audience and improve the site: your consent, given through the cookie banner.
• To send you news about the product: your consent, or our legitimate interest when you are already a customer. Every message carries an unsubscribe link.

5. Health data

Patient conversations may contain health related information. That data is processed only for the clinic that operates the assistant, only for the purposes the clinic defines, and it is never sold, rented or used to advertise.

Access is restricted to the staff members who need it to run and support the service, under confidentiality obligations. Clinics remain responsible for informing their patients and for collecting any consent required by their own regulations.

6. Cookies and audience measurement

The site works without any tracking cookie. Audience measurement is loaded only after you accept it in the cookie banner, and refusing has no effect on how the site behaves.

You can change your choice at any time from the cookie preferences link in the footer, or by clearing the site data in your browser.

7. Who we share data with

We only share what is necessary, with providers bound by contract and acting on our instructions.

• Hosting and delivery: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.
• Messaging: Meta Platforms, through the WhatsApp Business Platform, for sending and receiving messages.
• AI processing: the language model providers used to draft the assistant's replies, under agreements that forbid using the content to train their models.
• Payment and invoicing: our payment provider, for subscriptions and receipts.
• Public authorities, when a law or a court order requires it.

8. International transfers

Some of our providers are located outside the European Economic Area, in particular in the United States. Those transfers rely on the European Commission standard contractual clauses or on an adequacy decision, together with the additional safeguards required by the provider's terms.

You can ask us for a copy of the safeguards that apply to a given transfer.

9. How long we keep data

• Prospect and contact data: three years after the last exchange.
• Customer and contract data: for the duration of the contract, then the applicable limitation period.
• Invoices and accounting records: ten years, as required by law.
• Service data belonging to a clinic: for the duration of the subscription, then deleted or returned within thirty days of termination, unless the clinic asks otherwise in writing.
• Audience measurement: thirteen months maximum.

10. Security

Data is encrypted in transit, access is restricted and logged, and administrative access requires strong authentication. Backups are encrypted and tested.

No system is perfect. If a breach is likely to put your rights at risk, we notify the supervisory authority and, where required, the people concerned.

11. Your rights

Depending on where you live, you can ask to access your data, correct it, delete it, limit or object to its use, receive it in a portable format, and withdraw a consent you had given.

Write to clinicplusai@gmail.com. We answer within one month. If our answer does not satisfy you, you can lodge a complaint with your national supervisory authority, for instance the CNIL in France or the Privacy Protection Authority in Israel.

If your request concerns data handled on behalf of a clinic, we forward it to that clinic, which answers as the controller.

12. Minors

The service is aimed at healthcare professionals and is not intended for unsupervised use by minors. When a clinic treats minor patients, the clinic remains responsible for the consent of the legal guardians.

13. Changes to this policy

We update this policy when the service changes. The date at the top of the page always reflects the version in force, and material changes are announced to our customers before they take effect.