Template, not yet legally reviewed. This notice describes how the product works at launch. Have a qualified lawyer review and adapt it to your registered entity and data-protection registration, then set PRIVACY_REVIEWED=true to remove this banner.
Privacy notice
Miadi provides an assistant that helps clinics answer patient messages, book appointments and send reminders. This notice explains what information is handled and why. Contact: hello@miadi.care.
Who is responsible for patient data
Each clinic decides why and how its patients' information is used, and is the data controller for it. Miadi acts as the clinic's data processor and only handles patient information on the clinic's instructions.
What we handle
- Patients: phone number, WhatsApp profile name, the name given for a booking, appointment details, and the content of messages exchanged with the clinic's assistant.
- Booking cards: each booking has a private web link that shows the clinic, the service, the date and time, the patient's first name and a short reference to show at reception. Anyone with the link can open it, so patients should keep it to themselves. It is hidden from search engines and stops showing any details 30 days after the visit.
- Clinic staff and owners: name, email, phone number (optional) and a securely hashed password, plus the payment history of the account.
- Businesses that list themselves in the public directory: the business name, type, area, address, public phone number, hours, service names and description they choose to publish, plus, if they choose, their map position and their next open appointment time. No patient information is ever published.
- People who use the Find an appointment page: if you tap "Use my location", your device's position is sent to us only to sort that one list of businesses. It is not saved, not logged and not put in the page address. We keep only counts (for example, how many searches there were, which kind of care was chosen, and which named area was searched). Tapping a business's WhatsApp, call or directions button is counted for that business, without any detail about you. If you then message a business on WhatsApp, the business and its assistant handle that conversation as described above.
- Website visitors who request an audit: the details they enter in the form.
The assistant is designed for scheduling only. It does not ask for or give medical information. Patients are told not to share health details in chat, and unexpected messages are passed to clinic staff.
Why
To book, change and remind patients of appointments, to answer questions about the clinic, and to let clinic staff follow the conversation. We do not sell personal data or use it for advertising.
Who else processes data
- WhatsApp (Meta) carries the messages between patients and the clinic.
- An AI model provider processes message text to compose replies. Message content is sent to it only to produce the reply.
- A payment provider processes subscription payments by M-Pesa or card. It receives the account owner's email and the amount, and never any patient information.
- A hosting and database provider stores the data, encrypted in transit and at rest.
Access and security
Staff sign in with a password, and each clinic can only see its own patients and conversations. Sessions expire, and passwords are never stored in readable form.
How long we keep it
Patient and appointment records are kept while the clinic is a customer and then deleted or returned to the clinic on request. Audit requests are kept until the conversation with the clinic ends.
Your rights
Under Kenya's Data Protection Act, 2019, and similar laws elsewhere, you can ask to see, correct or delete your information, and object to its use. Patients should contact their clinic first. You can also write to us at the address above.