Your patients' data

Patients tell your clinic things they wouldn't tell anyone else. Here is exactly what happens to their messages on Miadi, in plain words. The binding version is our data processing agreement, which you can accept in your dashboard under Account.

Your patients' chats are yours

Your clinic decides how its patients' information is used (in law, you are the data controller). Miadi handles it only to run your assistant: answering, booking, reminding and passing messages to your team (we are your data processor, under Kenya's Data Protection Act, 2019, and similar laws where you work). We never sell it or use it for advertising.

Who can see a chat

• Your team: only the people you give a login to, and only your own clinic's chats.
• Miadi's team: our tools have no screen for reading your chats. We open a particular chat only if you ask us to help with it, or if we must to keep the service safe or working, and then we tell you.
• Other clinics: never. Each clinic sees only its own patients.

Where a message goes to be answered

We won't pretend that no one but you is involved: a message has to pass through a few services to be answered. It travels through WhatsApp (Meta) and Twilio, Anthropic's AI reads its text only to write the reply, and it is stored in our database (Supabase) so your team can read the conversation. Photos and documents stay with WhatsApp's provider (Twilio, or Meta), and we keep only a reference to each. At a pharmacy that has prescription summaries switched on, the AI also reads a photo or document the customer sends, to write a short summary that only the pharmacy's team sees. Our website and dashboards run on Vercel. Under our agreement with it, the AI provider does not use your patients' messages to train its models.

In the European Union, patients are told at the start that the assistant is an AI.

Every provider, what it does and where, is on our Trust page and in Annex 3 of the agreement. Some of them are outside your country and outside Kenya: how your patients' data is protected when it goes abroad is in Annex 4.

Health details stay with your team

The assistant never diagnoses or gives medical advice. When a patient describes a problem, it writes a short summary for your team, and only your team sees it. Anything that sounds like an emergency gets emergency advice straight away (the local emergency numbers where we have checked them, otherwise to go to the nearest hospital emergency department) and is marked urgent for your staff.

You stay in control

• Download or delete any patient's information from the Inbox, whenever you or the patient want.
• If a patient agrees to check-up reminders, we keep when and how they agreed or stopped.
• At a pharmacy, the same goes for refill reminders and back-in-stock messages, with what each one was for. These, the customer's orders and any prescription summaries are in the patient's download and are deleted with them.
• If Coach's nudges from patients' questions are on for your business, we note on a chat, for 30 days, which of your unanswered quick questions the patient asked (for example parking), never what they wrote. It is in the patient's download and is deleted with them.
• If a patient asks to go on your waiting list for appointments, we keep what they asked for (the service, the place for a doctor, the days and when they asked), what became of it, and each offer of a free time sent to them with their answer, only to offer them a time that frees up. They get at most one offer in 24 hours, only between 7am and 9pm, and come off the list when they book from it, reply STOP or their last day passes. The entry is deleted 90 days after that. It is in the patient's download and is deleted with them.
• Close your account from Account in the dashboard, and your patients, chats, bookings, team logins and settings are deleted straight away. Only payment records are kept, as accounting law requires, and a scrambled form of the business's own phone numbers (never patients' numbers) for 12 months from its free trial, so each number gets one free trial.
• If patient data is ever lost, leaked or seen by someone who shouldn't see it, we tell you without delay, and within 48 hours of finding out, so you can meet your own duty to your data protection authority (in Kenya, the Data Commissioner).

Questions

Ask us anything at hello@miadi.care. More detail is in our Privacy notice.