Trust

What happens to your money and to your patients' data on Miadi, in plain words. The binding versions are our Terms of Service and our data processing agreement.

Where your money goes

Your plan price covers what WhatsApp (Meta) charges, Twilio's fee for carrying messages, and the AI that writes replies (Anthropic). You never get a separate bill from any of them. WhatsApp and Twilio set their own prices, which change and differ by country.

The rest of your plan price pays for hosting, support, payment fees and building Miadi. During your free trial, these costs are ours.

No WhatsApp bill and no per-message fees on top. WhatsApp's and Twilio's fees are in your plan price. If you go past your plan's allowance, use keeps going up to 150% of your allowance and top-ups, then that part pauses until you choose to top up or upgrade. Use over your allowance and top-ups is priced at the extra rates on our website, and we tell you before asking you to pay it (Terms, section 5). Nothing is charged automatically.

How we protect patient data

These are the measures the service takes today. Each one is built into Miadi, and our automated tests check the code behind each one. The same list is Annex 2 of our data processing agreement.

• Passwords are never stored in readable form: we keep only a scrambled version (an scrypt hash with a random salt).
• Signing in gives a random key kept in a cookie that the page's scripts can't read, sent only over secure connections. We store only a scrambled version of the key, and sessions expire.
• Only Miadi's named admins can open our admin area, and repeated wrong passwords are slowed down.
• Each business sees only its own patients and chats. A patient's details can only be downloaded or deleted by the business they wrote to.
• Every table in our database has row level security switched on with no public rules, so the database's public web access can't read any of it.
• Messages and payment notices that Twilio, WhatsApp and Paystack send us are checked against their signature. Any that don't match are refused.
• Sign-in, sign-up, password reset and other forms limit how often they can be tried, which slows down guessing.
• Sensitive actions, such as downloading or deleting a patient's data, are recorded in an audit log, without patient names, numbers or messages.
• Owners can download everything Miadi keeps about a patient, or delete it from Miadi for good, from the Inbox. We also ask Twilio or WhatsApp (Meta), whichever carried them, to delete the photos and documents the patient sent. WhatsApp and Twilio keep their own records under their terms.
• Regular clean-ups delete ended sign-ins, the website demo's chats after a day, and the WhatsApp demo's scrambled phone numbers after two days.
• A booking's private link stops showing any details 30 days after the visit.
• Push alerts on the team's phones and computers, and alert emails, carry no patient names and nothing a patient wrote: the team opens Miadi to see them.
• Our test site refuses to use the live database, so testing never touches businesses' records.
• Every page is sent with security settings that stop other sites showing it inside theirs and stop browsers guessing file types.
• The connection between our servers and the database is encrypted.

Who handles data for us

We use these providers to run Miadi. Each one handles data to do its job for us, under its terms with us. WhatsApp is also your patients' own app: WhatsApp (Meta) and Twilio keep their own records of messages under their own terms.

Where the table says "Being confirmed", we are checking the exact location with that provider, and we will update this page. Before we add or replace a provider that handles patient data, we email business owners at least 14 days ahead (Annex 3 of the agreement).

Data sent abroad

We run Miadi from Kenya, and our providers are in other countries, so your patients' data usually leaves your country. How it is protected depends on where your business is: Annex 4 of our data processing agreement sets it out for each region. Where a question is still with our lawyers, such as whether and how patients in Kenya must agree before their health details go abroad, Annex 4 says so. In the United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Bahrain, Oman, Indonesia and Vietnam, going live is on hold for now, until local health-data rules are cleared.

If something goes wrong

• If patient data is lost, leaked or seen by someone who shouldn't see it, we tell your business without delay, and within 48 hours of finding out, with what we know and what we are doing, so you can meet your own duty to your data protection authority. This is section 7 of our data processing agreement.
• If WhatsApp can't deliver a message from your assistant, the chat is marked as needing a reply in your Inbox, with the reason, and your dashboard's home page asks your team to call the patient. Our team is alerted too, so we can check the number and the provider's account.

What we don't claim

We hold no security certificate and haven't had an outside security audit yet. We don't say that using Miadi meets any country's health or privacy law for you: that depends on how your business uses it, and our data processing agreement sets out what we do.

Miadi isn't a WhatsApp or Meta partner and shows no badge from either. It uses WhatsApp's Business Platform as any business can: through Twilio, or directly with Meta. Miadi isn't available to businesses in mainland China or the United States, including US territories (our Terms say why).

What we do instead: every week, and before each release, we run scripted patient chats through the assistant (bookings, prices, opening hours, emergencies, languages and more), each on a made-up test business. Nothing is sent on WhatsApp and no real chat is read. Our founder sees the results in Miadi's own admin area and is emailed about any chat that didn't pass, and a release waits until it is fixed and passes.

Questions

Ask us anything at hello@miadi.care. More detail is in our Privacy notice and Your patients' data.