Privacy Policy

We collect two categories of data:

• Client clinic data: contact name, email address, WhatsApp number, clinic address, service list, pricing, opening hours, and clinic FAQs.
• Client patient data: name, WhatsApp number or messaging channel, conversation history, bookings, and service requests. This data is processed on behalf of the client clinic as data controller, and Arcana acts as processor.

Data is used strictly to provide receptionist-automation services: answering patient messages, creating and syncing bookings, sending follow-ups, and updating the client clinic's CRM and calendar.

We do not sell data, share it for third-party marketing, or use it to train AI models shared with other clinics.

To provide the service, we use the following processors:

• Meta Platforms (WhatsApp Business API, Instagram, Messenger) — for message delivery and receipt.
• Google (Google Calendar) — for booking calendar sync.
• AI model providers (OpenAI, Anthropic, or equivalent) — for natural-language processing of incoming messages and reply generation.
• Infrastructure providers (DigitalOcean or equivalent) — for hosting and encrypted data storage.

Data is encrypted in transit (TLS 1.2+) and at rest. Conversation data is stored for the duration of the client clinic's active subscription. When the subscription ends, the data is exported back to the client clinic and deleted from our systems within 30 days, unless law requires longer retention.

As a data subject under UU PDP, you have the right to:

• Receive information about the data we process about you.
• Access, update, or correct your data.
• Withdraw consent and request deletion of your data.
• Restrict or object to certain processing.
• Receive a copy of your data in a machine-readable format (data portability).

To exercise the rights above, contact us by email at bigcheese@indomustrading.com. We will respond within 30 days as required by UU PDP.

In the event of a data breach with material impact, we will notify affected client clinics and the relevant authorities within 3 × 24 hours, as required by UU PDP.

This policy may be updated from time to time. The latest version will be published on this page with the updated effective date.