Who is the controller
The data controller for the Clincue account you register and the clincue.com marketing site is Ahad Ali, trading as Clincue, based in Ireland ("Clincue", "we", "us", "our"). Any change to the contracting entity will be communicated separately. For privacy questions and data-subject requests, email privacy@clincue.com.
1. Scope of this Privacy Policy
This Privacy Policy applies to personal data processed by Clincue in connection with our AI receptionist platform. It covers:
- The clincue.com marketing website (including subdomains).
- The Clincue web dashboard used by clinics to configure their AI receptionist.
- The branded chat widget, WhatsApp channel, and voice channel used by each clinic's patients ("Patient Channels").
It does not cover any clinic's own website or third-party services the clinic decides to integrate. Where the clinic acts as the data controller of patient records under UK GDPR / EU GDPR (Regulation (EU) 2016/679), that clinic's privacy notice applies to those records — not this one.
2. Data controller and data processor roles
Under UK GDPR / EU GDPR, the distinction between controller and processor is legally significant. In plain English:
- When a clinic signs up for Clincue, Clincue is the data controller for the clinic account itself (the email address, name, role, billing details, and login history of the person who registered).
- When a patient interacts with the Clincue chat/WhatsApp/voice channel of a clinic, the clinic is the data controller and Clincue is the data processor acting on the clinic's documented instructions. Our Data Processing Agreement (see DPA) governs that relationship in detail.
This structure means a patient's data protection rights (access, erasure, rectification, etc.) are normally exercised through the clinic, and Clincue supports the clinic in fulfilling them.
3. Categories of personal data we collect
3.1 Clinic account data (Clincue is controller)
- Full name, email address, hashed password of the account owner and any invited team members.
- Clinic name, clinic type (GP / dental / physio / aesthetics), phone number and location entered during onboarding.
- Branding assets uploaded to personalise the widget (logo, colours, tone).
- Subscription state, plan, and billing metadata — full billing/payment card details are handled by Stripe (our payment partner) and never touch Clincue servers.
- Dashboard usage logs (login times, IP addresses, browser user-agents) kept for security auditing.
3.2 Patient interaction data (clinic is controller, Clincue is processor)
- Chat messages exchanged between a patient and the AI receptionist.
- Booking requests: patient name, preferred contact channel, requested date/time, and any notes the patient volunteers.
- Visitor session identifiers used to keep a single conversation coherent.
- Channel metadata (web widget, WhatsApp, voice).
- Transcripts of voice calls when the voice channel is enabled.
3.3 Data we explicitly do not want
Clincue is an administrative tool, not a medical device. We ask patients not to share diagnoses, symptoms, prescriptions, or other special-category health data through the receptionist. Clinics are contractually required (see Terms) to instruct their patients accordingly and to configure their agent's greeting to reinforce this. If a patient volunteers sensitive information, the clinic remains responsible for identifying an appropriate Article 6 basis and Article 9 condition, assessing access and providing documented processing instructions.
4. Legal bases for processing
Under UK GDPR / EU GDPR Article 6 we rely on:
- Contract (Art. 6(1)(b)) — to provide the dashboard, the chat/WhatsApp/voice channels, and the billing relationship to the clinic that signed up.
- Legitimate interests (Art. 6(1)(f)) — to secure the service, prevent fraud, monitor abuse, and improve the platform's quality. Balanced against the rights of data subjects.
- Legal obligation (Art. 6(1)(c)) — to retain records for tax, accounting, and regulatory purposes.
- Consent (Art. 6(1)(a)) — for optional marketing communications only; every marketing email includes a one-click unsubscribe link.
5. How long we keep data (retention schedule)
| Data category | Retention |
|---|---|
| Clinic account (email, name, login history) | Retained while needed for account administration; deletion requests are reviewed for applicable legal obligations. |
| Billing/tax records | Retained for the period required by the applicable accounting and tax laws. |
| Chat conversations and bookings | As long as the clinic account is active; deletable at any time by the clinic. |
| Voice call transcripts | Retention must be agreed with the clinic; automatic configurable deletion is not currently represented as available. |
| Suppressed email addresses (bounces / opt-outs) | Indefinite — required to honour opt-outs. |
| Security logs and audit trails | Retained as needed for security investigation and applicable legal obligations. |
6. Sub-processors
The current list of sub-processors and their roles lives in the Data Processing Agreement. We commit to giving 30 days' notice of any new sub-processor via in-product notice or email to the clinic account owner.
7. International data transfers
Hosting, model inference and channel services may process data in different regions. Before using patient data, request the applicable provider locations and transfer documentation from privacy@clincue.com.
8. Your rights as a data subject
Where Clincue is the controller (clinic account users), you can exercise all UK GDPR / EU GDPR rights directly with us: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal effect. See GDPR & Data Subject Rights for the procedure and expected timelines.
Where Clincue is the processor (patient data), please contact the clinic directly; we support the clinic in responding within one calendar month.
9. Security
Technical and organisational measures are described in our Security overview: TLS 1.2+ in transit, encryption at rest, row-level security in the database, MFA support for staff accounts, principle of least privilege, and incident-response procedures. Nothing in this Privacy Policy replaces those specifics; they are read together.
10. Cookies and similar technologies
Details of every cookie we set, its purpose, provider, category, and lifetime are documented in our Cookie Policy. We do not use advertising cookies and we do not sell personal data.
11. Changes to this Privacy Policy
Material changes will be communicated to clinic account owners by email at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.
12. Contact and complaints
Privacy Team — privacy@clincue.com. You have the right to lodge a complaint with your local supervisory authority — the UK Information Commissioner's Office (ico.org.uk) or the data protection authority of the EU member state where you live, work, or where the alleged infringement occurred.