Open Clinic
Privacy Policy
This explains what we do with personal data — the patients' data a clinic trusts us to automate around, and the little we collect from visitors to this website. It is written to be read, not to be survived.
The single most important fact: for the clinics we work with, we do not hold a copy of the patient database. It lives in the clinic's own Google account. We are granted access to it, and that access can be revoked by the clinic at any time, without asking us.
1. Who we are, and which hat we are wearing
Open Clinic is an AI automation agency for medical, dental and aesthetic clinics: we build and run the automations a clinic needs. We handle personal data in two quite different roles, and the distinction matters:
- For a clinic's patient data, we are a processor. The clinic decides what happens to it. We act only on their written instructions, which are their Data Processing Agreement and Order Form with us. If you are a patient and want your data changed or erased, your clinic is the right first contact — though you can also reach us and we will help.
- For our own marketing, we are the controller. That is the contact form on this website and our sign-up forms on Facebook and Instagram (section 6), and nothing else.
2. What we handle for a clinic
| Category | Examples |
|---|---|
| Identity | Patient name |
| Contact | Mobile number, and the language they write in |
| Appointment | Date, time, service, provider, attendance, amount |
| Message content | What the patient sent, and what was sent to them |
| History | Last visit and last treatment, where the clinic uses recall |
| Health | What a patient says about how they feel after a procedure, and the words that triggered an escalation to a clinician — only where the clinic uses aftercare |
That last row is health data about identifiable people. Nothing in our system interprets it, diagnoses from it, or reassures anyone about it. It is passed to a named human clinician at the clinic who has agreed, personally, to answer.
3. Where it lives
In the clinic's own Google account. The spreadsheet and the calendars belong to them, not to us.
In addition, we hold only:
- Credentials to reach that account, on our own automation server.
- Message content in transit, inside workflow execution logs, kept for 14 days and then deleted automatically.
- A patient list export, if a clinic sends one to start recall. This is the only bulk copy we ever hold. It is deleted within 7 days of being loaded, and we confirm the deletion in writing.
4. Who else can see it
| Who | What they see | Why |
|---|---|---|
| Meta (WhatsApp Business Platform) | Phone numbers and message content | It is the messaging channel. The clinic holds this account itself. |
| Everything in the spreadsheet and calendars | It is the clinic's own account. | |
| Our hosting provider | Data in transit and in execution logs | It runs the automation. |
We tell a clinic in writing before adding any sub-processor that can see patient data, and they may object. We do not sell personal data, and we do not use it to train machine-learning models.
5. Google user data
Where a clinic connects their Google account, we request access to Google Sheets and Google Calendar so the system can read availability, write bookings, and keep the clinic's own records current. We ask for the narrowest scopes that make those things work.
Open Clinic's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms: we use Google data only to provide the features the clinic asked for, we do not transfer it to anyone else except as described above, we do not use it for advertising, we do not sell it, and no human at Open Clinic reads it except where it is necessary for support the clinic has asked for, for security, or where the law requires it. A clinic can disconnect our access at any time from their own Google account security settings.
6. Visitors to this website
This site sets no cookies, runs no analytics, and stores nothing in your browser. The only personal data it collects is what you type into the contact form: your name, clinic, phone number, email or website if you give one, what you need, and your message.
That goes to our own automation server so we can reply to you. We keep it for as long as we are in contact plus 12 months, and then delete it. If you would rather not use the form, message us on WhatsApp instead. The link is in the footer.
Sign-up forms on Facebook and Instagram
If you sign up for the free 1am Test through one of our forms on Facebook or Instagram, we receive what you entered: your name, phone number, clinic name, your role, the type of clinic, how many doctors work there, and roughly how many calls it misses. We use these only to contact you by phone or WhatsApp about the 1am Test and our service. We keep them for as long as we are in contact plus 12 months, then delete them. We don't sell or share them.
For the test itself, we send your clinic's public number one WhatsApp message, one night between 1 and 2 AM. We don't book a real appointment, and we delete the test chat once we have sent you the report.
7. How long we keep things
| What | Kept for |
|---|---|
| Everything in the clinic's Google account | As long as the clinic wants — it is theirs |
| Workflow execution logs | 14 days |
| A patient list export | 7 days from loading |
| Contact form enquiries | Our contact plus 12 months |
| 1am Test sign-ups (Facebook and Instagram forms) | Our contact plus 12 months |
8. Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. If you are a patient of one of our clinics, ask the clinic — they control the data and can act immediately, and we will help them do it. If they cannot reach us, or you would rather come to us directly, message us on the WhatsApp number below and we will respond within 30 days.
A patient can also stop all automated messages permanently at any time by replying to stop. That opt-out is honoured across every part of the system, not just the message it came from.
9. Security
Traffic is encrypted in transit. Credentials are held encrypted on our server and are never written into a workflow or shared. Access is limited to the people who need it to run the service. No system is perfect; if we ever have a breach that affects a clinic's patients, we tell that clinic without undue delay.
10. Changes
If we change this policy we update the date at the top. If a change materially affects how patient data is handled, we tell affected clinics directly rather than relying on them to re-read this page.
11. Contact
Open Clinic — WhatsApp +20 128 834 4214, or email hello@openclinichq.com. For anything about erasure or access, start your message with “data request” and it gets handled first.
This policy describes what our system actually does, which is the part a template cannot do. It has not been reviewed by an Egyptian lawyer.