Privacy Policy

1. Who we are

This Privacy Policy explains how Najah AI ("we", "us", "our") collects, uses, and protects information when you interact with the AI Clinic Agent platform, including our website, web chat, WhatsApp Business messaging, voice / telephony channels, and related clinic-facing tools (together, the "Services").

Website: https://clinic.najahai.com
Privacy contact: admin@najahai.com
General support: admin@najahai.com

2. Scope

This policy applies to:

• Visitors to our marketing website and product UI
• Patients and users who chat with the AI receptionist (web, WhatsApp, or phone)
• Clinic staff who use admin / configuration features
• Integrations with Meta WhatsApp Business Cloud API and similar messaging providers

Where a clinic (our customer) configures the Service for their practice, that clinic is typically the data controller for patient records. We act as a processor / service provider on their behalf, except for account and platform data we control directly.

3. Information we collect

3.1 Information you provide

• Name, phone number, email, preferred language
• Appointment preferences, health-related concerns you choose to share in chat
• Messages, voice transcripts, and attachments sent through the assistant
• Account credentials and profile details for clinic staff

3.2 Information collected automatically

• Technical logs (IP address, browser/device type, timestamps, error diagnostics)
• Usage events needed to operate chat, booking, and security features
• Cookies or similar storage required for session / authentication on the website

3.3 Information from messaging platforms (e.g. Meta WhatsApp)

• WhatsApp phone number ID and message content you send to the business number
• Delivery / read status metadata provided by the platform
• Webhook verification and security headers required by Meta

4. How we use information

• To answer questions, schedule or manage appointments, and route requests to clinic staff
• To operate speech-to-text / text-to-speech features when voice is enabled
• To improve reliability, safety (including emergency escalation), and service quality
• To secure the Service, prevent abuse, and comply with legal obligations
• To communicate operational notices related to your use of the Service

We do not sell personal information. We do not use patient chat content for third-party advertising.

5. AI processing

Conversations may be processed by AI model providers (for example OpenAI or other configured providers) solely to generate responses and extract booking-related details. Providers are used under contractual terms that restrict use of customer content for their own advertising. Do not submit information you do not want processed for these purposes.

6. Legal bases (where applicable)

Depending on applicable law, we process data based on:

• Performance of a contract / provision of requested healthcare coordination services
• Legitimate interests in operating a secure, reliable clinic assistant
• Consent, where required (for example certain messaging or marketing communications)
• Legal obligations (security, fraud prevention, regulatory requests)

7. Sharing

We may share information with:

• The clinic that configured the assistant for your care pathway
• Infrastructure and AI subprocessors needed to run the Service
• Messaging providers such as Meta (WhatsApp) when you use those channels
• Professional advisers or authorities when required by law

8. International transfers

Servers or subprocessors may be located outside the United Arab Emirates. Where required, we use appropriate safeguards consistent with applicable data-protection requirements.

9. Retention

We retain conversation and booking-related data for as long as needed to provide the Service, meet clinic operational needs, resolve disputes, and comply with legal retention requirements. Clinics may request deletion of their tenant data subject to legal holds.

10. Security

We use administrative, technical, and organizational measures designed to protect personal data (access controls, encrypted transport, least-privilege operations). No method of transmission or storage is perfectly secure.

11. Your rights

Depending on your location and the clinic's role as controller, you may have rights to access, correct, delete, or restrict processing of your personal data, and to withdraw consent where processing is consent-based. Contact admin@najahai.com or the clinic that treated you. We may need to verify your identity before fulfilling a request.

12. Children

The Service is not directed at children under 16 without involvement of a parent / guardian or clinic staff. If you believe we have collected a child's data inappropriately, contact us to request deletion.

13. Third-party links and platforms

WhatsApp, Apple, Google, and other platforms have their own privacy policies. This Policy covers our processing only. Review Meta's and Apple's policies for how those companies handle your data on their networks.

14. Changes

We may update this Policy from time to time. The effective date above will change when we do. Continued use of the Services after an update constitutes acceptance of the revised Policy where permitted by law.

15. Contact

Privacy requests: admin@najahai.com
Support: admin@najahai.com
Web: https://clinic.najahai.com