Privacy policy

For the personal data of clinic owners and staff, and of visitors to this website, Cliniwo is the controller.

For patient data processed through the service — messages, appointments, records, documents, invoices — the Clinic is the controller and Cliniwo is the processor. We process that data only to provide the service and on the Clinic’s instructions.

From clinics: the buyer’s name, email, phone number, clinic name and business details (commercial registration, VAT number, national address) needed for invoicing, plus login and usage records. Card details are entered directly with our licensed payment provider; we store only a payment token, the card brand and the last four digits.

From patients, on behalf of the Clinic: WhatsApp phone number and name, message content including voice notes and images the patient sends, appointment details, and any clinical notes, documents or insurance card images the Clinic files. The assistant is designed not to read national ID numbers from images.

From website visitors: contact form entries and, only after consent, analytics and advertising cookies.

To provide the service: answering patients, booking appointments, sending reminders, keeping records and issuing invoices. To bill and to meet tax obligations, including issuing ZATCA-compliant invoices. To secure the service, prevent abuse and keep an audit trail. To respond to requests and support. With consent, to measure our website and advertising.

We do not sell personal data and we do not use patient data to train AI models.

The assistant uses large language models to understand and answer messages. Message content is sent to the model provider for the purpose of generating a reply and is not retained by them for training. Each reply is written to the Clinic’s inbox where staff can review it and take over at any time.

Data is stored on established cloud infrastructure and encrypted in transit and at rest. Each clinic's data is separated inside the database, and access is limited to what the service needs.

We use specialist providers for hosting, payments, WhatsApp message delivery, e-mail and AI processing. Each is bound by contract to process data only on our instructions.

Where processing takes place outside the Kingdom, it is done under the PDPL's rules on cross-border transfer.

Clinic data is kept for as long as the subscription is active and for 30 days after termination so it can be exported, then deleted. Invoices and payment records are kept for the period required by Saudi tax law. Audit logs are kept for the life of the account. Website leads are kept for 12 months.

Under the PDPL you may ask to access, correct or delete your personal data, to withdraw consent, or to object to certain processing. Clinic owners and staff can exercise these rights through the Requests section of their panel or by contacting us. Patients should contact the Clinic that treats them; we help clinics respond to such requests.

Our website sets only essential cookies until you consent. If you accept, we load analytics and advertising measurement tools that set their own cookies. You can withdraw consent at any time by clearing cookies; the banner then appears again.

We will post changes here and, for material changes, notify clinics in their panel. Questions about this policy and requests about your data can be sent through the contact page or your panel.