Privacy Policy
1. Who we are
Clinic Robo ("Clinic Robo", "we", "us") is a customer relationship management (CRM) service for medical-aesthetics clinics, a product operated by Cosmique Aesthetic Dermatology Clinic Co. LLC, a company registered in the United Arab Emirates (Beach Park Plaza Centre, Jumeirah 2, Dubai, United Arab Emirates).
Clinics use Clinic Robo to manage enquiries they receive, for example through Facebook, Instagram, Messenger and WhatsApp. For the personal data of a clinic's patients and enquirers, the clinic is the data controller (each clinic for its own patients) and Clinic Robo processes that data on the clinic's behalf. For the accounts of clinic staff who log in to Clinic Robo, we are the controller.
2. Data we collect
- Contact details of people who contact a clinic: name, phone number, email address.
- Lead form answers submitted through Meta Lead Ads forms, and the campaign, ad and form the enquiry came from.
- Messages sent and received through WhatsApp, Messenger and Instagram Direct, including images and voice notes, and platform identifiers (Page-scoped and Instagram-scoped IDs).
- Appointment, call and visit records that clinic staff create, including call recordings and their transcripts where the clinic records calls.
- Health-related information that people choose to share, such as the treatment they are interested in. We do not ask for this beyond what a person volunteers or a clinic records for their care.
- Clinic staff accounts: name, work email, role, login activity.
- Meta connection data: when a clinic connects its Facebook Page, Instagram account or ad account, we store the access tokens Meta issues, the Page, Instagram and ad-account IDs, and the Facebook user ID of the person who connected them.
3. How we use it
- To show each clinic its enquiries in one inbox, reply to them and route them to the right staff member.
- To send replies and follow-up messages, including automated replies written with artificial intelligence (see section 5).
- To book and manage appointments and record outcomes.
- To report to the clinic on its enquiries, campaigns and advertising spend.
- To keep the service secure and working.
The legal basis is the person's consent when they submit a form or start a conversation, the clinic's legitimate interest in answering and managing enquiries, and, for clinic staff accounts, our contract with the clinic.
We use data received from Meta only to provide these features to the clinic that connected it. We do not sell personal data, use it for unrelated purposes, or use it to make eligibility decisions about anyone.
4. Who we share it with
We share personal data only with service providers that process it on our instructions to run Clinic Robo:
- Supabase, Inc.: database, storage and server infrastructure.
- Anthropic, PBC: AI models that draft replies to messages and classify enquiries.
- OpenAI, L.L.C.: speech-to-text for voice notes and call recordings.
- AiSensy: WhatsApp Business messaging.
- SalesTrail: call logging for clinic phones.
- Meta Platforms, Inc.: to receive leads and messages and to send replies. For clinics that advertise on Meta, we may send Meta hashed (SHA-256) contact identifiers and non-medical event information (such as "appointment scheduled") through the Conversions API to measure advertising. We never send treatment or health details to Meta.
We may also disclose data where the law requires it; we review such requests for legality and disclose only the minimum necessary.
5. Automated replies
Clinics can let Clinic Robo reply to messages automatically using AI. Staff can see every automated reply, turn automation off for any conversation, and take over at any time.
6. Retention
Enquiry and conversation data is kept for as long as the clinic uses Clinic Robo and as needed for the clinic's legal and medical-record obligations. A clinic can delete records at any time. Meta access tokens are deleted when a clinic disconnects its account or when the person who connected it removes the Clinic Robo app from their Facebook settings.
7. Your rights and deleting your data
You can ask to access, correct, restrict or delete your personal data, object to its processing, receive a copy of it, or withdraw consent to messages, at any time. See Data Deletion for how to request deletion; we respond within 30 days. You may also complain to a data protection authority.
8. Security
Data is encrypted in transit and at rest. Access is limited to authorised clinic staff, and each staff member sees only what their role allows.
9. Applicable law
We comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, where applicable, the EU General Data Protection Regulation (GDPR).
10. Changes
We will post any changes on this page and update the date above.
11. Contact
Cosmique Aesthetic Dermatology Clinic Co. LLC (Clinic Robo)
Beach Park Plaza Centre, Jumeirah 2, Dubai, United Arab Emirates
Email: info@clinicrobo.ai