Privacy Policy

The public product guide provides prepared answers without sending your topic selection to an AI provider. When free-form AI chat is enabled, the text you submit and up to ten recent messages are sent through our Vercel-hosted website to Anthropic (Claude) to generate a product answer. This advisor is separate from patient AI Care and cannot access your clinic CRM or patient records.

We use these messages to answer your request about WithPatient. Do not include patient information, medical records, passwords or payment details. AI answers may contain mistakes; clinical questions belong with your treating clinician and commercial terms must be confirmed by the team.

This website implementation does not save chat transcripts in an application database or browser storage, and does not intentionally log message bodies. The visible conversation is held in the page memory; use the clear button or reload the page to remove it. This does not delete any provider-side records. Hosting security logs and Anthropic processing, retention and international transfers remain subject to the relevant service terms and the account configuration; no specific hosting region or zero-retention arrangement is claimed. For access or deletion requests, contact support@withpatient.com. Do not resend sensitive message contents by email.

This Privacy Policy covers the public website at withpatient.com, the patient portal at app.withpatient.com, clinic administration features and related support, notification, referral, eSIM and integration services (together, the “Services”).

A patient’s clinic normally decides why patient information is used for treatment, travel coordination, aftercare and patient communication. The clinic is therefore normally the data controller, and WithPatient processes that information for the clinic as a data processor/service provider, subject to the clinic agreement and its instructions. A clinic remains responsible for its own privacy notice, lawful basis, clinical records and responses to patient requests.

WithPatient may act as a controller for limited business data it collects for its own purposes, such as demo requests, clinic account administration, billing, security and direct support. The registered legal entity and address will be inserted after company registration. Until then, privacy enquiries should be sent to support@withpatient.com.

Patient and journey information

• Identity and contact details, including name, mobile number, email address, preferred language and CRM identifiers.
• Clinic, coordinator and care-team relationships; appointment, journey-stage and status information.
• Treatment-related information, treatment plans, invoices, warranties, documents, aftercare information and messages made available by the clinic.
• Travel and stay details, such as hotel dates, airport transfers, driver information and optional eSIM requests or activation details.
• Consent records, onboarding completion, support concerns, satisfaction responses, referral/reward activity and communication preferences.
• Questions submitted to AI Care and the limited conversation history sent with a request when that feature is enabled.

Clinic and staff information

• Clinic name, branding, business contacts, locations, specialties, patient volume and service configuration.
• Staff names, roles, business contact details, languages, account identifiers and permissions.
• CRM configuration, authorised modules and fields, integration identifiers and support communications.

Website and technical information

• Demo-request details: name, clinic, WhatsApp number, work email, location, website/social profile, CRM, treatment category, patient-volume range and the message supplied.
• Session and language cookies, login/session identifiers, browser and device information, IP address, timestamps, request/security logs and push-subscription endpoints when notifications are enabled.

Information may come from the patient, clinic staff, the clinic’s connected CRM, the patient’s use of the portal, or a provider used to deliver an optional service.

The current live portal reads configured records from Bitrix24. This may include contact information, the relevant patient/deal record, treatment stage, responsible staff member, products or treatment items, documents, travel/stay fields and timeline activity. Certain enabled features may write a limited operational item back to the CRM, such as a private concern, feedback note or referral lead.

Clinics that connect Zoho CRM. A clinic administrator authorises WithPatient to read CRM records (patients, linked contacts and trip details), read and create fields on the patient module, read the module list, and read the organisation profile and installing user. WithPatient does not write to or delete the clinic’s Zoho patient records.

Requested permissions: ZohoCRM.modules.READ, ZohoCRM.settings.fields.ALL, ZohoCRM.settings.modules.READ, ZohoCRM.org.READ, ZohoCRM.users.READ. Field creation is used during setup; access to patient records is read-only.

What we store. We store the Zoho organisation ID, data centre, integration configuration and OAuth tokens. Tokens are encrypted at rest and are not displayed to clinic staff or patients. Patient records are read from Zoho when the portal needs them rather than copied into a separate patient-record database. Information submitted in WithPatient, such as consent, feedback, surveys, concerns and uploaded images, is stored on the clinic’s behalf.

Sign-in codes. Where code-based sign-in is enabled, a patient enters their registered phone number and receives a short-lived code through an enabled delivery channel using contact details held in the CRM. Code hashes and temporary delivery-limit records are stored to check codes and prevent abuse. Plaintext codes are not stored in the database. Transactional email delivery currently uses Brevo.

Disconnecting. Disconnecting Zoho in WithPatient deletes the stored tokens and stops CRM access. Revoking access in Zoho prevents further authorised access; WithPatient clears its stored credentials when it detects the revocation. CRM fields and their existing data remain in Zoho. Clinics can request deletion of remaining WithPatient data at support@withpatient.com.

Other CRM names shown on the marketing website indicate systems that may be reviewed with a clinic; they do not mean that every connector is currently active.

Depending on the relationship and applicable law, information is processed to perform a clinic or service agreement, follow the clinic’s documented instructions, provide requested features, comply with law, protect the Services, or pursue legitimate business interests that do not override individual rights. Where the law requires consent—particularly for optional communications, certain health-data uses or device notifications—the responsible party must obtain valid consent and allow withdrawal.

• Authenticate eligible patients and staff and maintain sessions.
• Display the clinic-provided treatment, travel, document and aftercare journey.
• Deliver support, private feedback, notifications, referrals, rewards and optional eSIM workflows.
• Operate authorised CRM connections and keep enabled workflow records aligned.
• Respond to demo requests, configure clinics, provide support and administer commercial relationships.
• Prevent misuse, diagnose failures and maintain the availability and security of the Services.
• Meet legal obligations and establish, exercise or defend legal claims.

Treatment details, treatment-stage information, aftercare questions and clinical documents may constitute health data. Health data is a special category of personal data under Article 9 GDPR and special-category personal data under Article 6 KVKK.

Clinics must identify and document an applicable legal basis and an additional condition for health-data processing before enabling live patient data. Depending on the circumstances, this may involve explicit consent or a healthcare-related basis available to a clinic or professional subject to confidentiality obligations. WithPatient does not decide the patient’s diagnosis or the clinic’s legal basis.

Clinics should configure only the minimum fields needed for each workflow, limit staff access and avoid placing diagnosis, medical results, treatment names or other sensitive details in push-notification text. AI Care is intended for general guidance and must not be used as a substitute for clinical advice or emergency services.

Data is disclosed only as needed for an enabled function, a clinic instruction, support, legal compliance or protection of the Services. Depending on configuration, recipients may include:

• The patient’s clinic and authorised staff, who manage the care and patient journey.
• Bitrix24 for the current CRM connection, or Zoho CRM when the clinic has authorised and enabled that connection.
• Vercel for website and application hosting and associated operational request logs.
• Supabase for enabled database, staff-authentication and operational records such as consent, surveys, concerns, referrals and notification subscriptions.
• Anthropic or OpenAI when the configured AI Care provider receives a patient’s submitted messages and the instructions needed to generate a reply. Only one configured provider is used for a request.
• Browser/device push services, which may include Apple, Google or Mozilla infrastructure, after a user opts in. Notification content is designed to avoid patient or treatment details.
• Zoho Mail/SMTP for website demo requests, a clinic-configured mail host for operational alerts, and Brevo for transactional email or SMS only if those features are configured and enabled.
• eSIM and other fulfilment partners only if the relevant optional service is enabled. The clinic and patient must be told the provider and required data before live fulfilment.
• Professional advisers, regulators, courts or public authorities where disclosure is legally required.

Opening external WhatsApp, Google, Trustpilot or map links causes the destination provider to process information under its own terms. WithPatient does not control those independent services.

Some providers or their infrastructure may be located outside the patient’s or clinic’s country. Before live deployment, the clinic and WithPatient must identify relevant storage and processing locations and document an appropriate transfer mechanism where required.

For EEA data, this may require an adequacy decision, Standard Contractual Clauses or another GDPR transfer mechanism. For transfers from Türkiye, the parties must assess Article 9 KVKK and the transfer mechanisms in force, which may include an adequacy decision, the KVKK standard contracts or another permitted safeguard. This draft does not claim that a particular transfer mechanism has already been completed for every clinic or provider.

There is not yet one universal retention period for every clinic and feature. A clinic’s signed order, data-processing agreement and retention schedule must define the production periods before launch.

• CRM and clinical records remain subject to the clinic’s own retention duties and CRM settings.
• WithPatient operational records are kept while needed to provide the enabled feature, maintain an account, meet the clinic’s documented instructions, resolve disputes or satisfy legal obligations.
• Website demo requests are delivered to the WithPatient team by email and should be removed when the sales conversation ends unless needed for an active relationship or legal record.
• Session cookies expire according to their configured duration. Push subscriptions remain until the user disables notifications, the endpoint expires or the record is deleted.
• Provider logs and backups follow the provider configuration and applicable contract; deletion from backups may occur on the provider’s normal rotation cycle.

When the purpose and legal basis end, data should be deleted, destroyed or anonymised under the applicable clinic schedule. Under the KVKK disposal rules, the responsible controller must also follow applicable periodic-disposal and request deadlines and retain records of disposal operations where required.

WithPatient uses measures visible in the current product architecture, including server-side CRM credentials, signed patient sessions, role/tenant-scoped access paths, input validation and restricted service credentials. Clinic staff access and provider settings must also be configured correctly.

No internet service can guarantee absolute security. This draft does not claim a security certification, a specific data-residency location, end-to-end encryption, or compliance status that has not been independently verified. Security obligations and incident procedures will be defined in clinic agreements and reviewed as the company and Marketplace integrations are completed.

Patients should normally contact their clinic first because the clinic controls the treatment relationship and the source CRM record. A request may also be sent to support@withpatient.com. Please state the clinic, the right being exercised and enough information to verify identity. Do not send medical records by ordinary email.

Depending on applicable law, rights may include access, correction, deletion, restriction, objection, portability, withdrawal of consent and a complaint to a competent authority. Under KVKK Article 11, rights also include learning whether data is processed, the purpose and recipients, requesting correction or deletion, and objecting to an adverse result produced exclusively through automated analysis. Rights may be limited by legal retention duties and the rights of others.

WithPatient will forward processor-held requests to the relevant clinic and assist it as required by the applicable agreement. Requests concerning data controlled directly by WithPatient will be handled after identity and scope are verified.

The Services use necessary cookies or similar storage for signed sessions, language preference, consent status and interface state. The current public website does not describe advertising cookies. If analytics or marketing technology is added, this notice and any required consent controls must be updated before activation.

Push notifications are optional and require device/browser permission. Users can withdraw permission in their browser or device settings.

The Services are intended for clinics and their authorised patients. A clinic must apply the rules governing children and parental responsibility in the relevant country before creating access for a minor.

This draft is informed by the EU General Data Protection Regulation, the EDPB’s controller and processor guidance, Türkiye’s Personal Data Protection Law No. 6698, and the KVKK disposal rules. Application depends on the parties, location, purpose and facts.

Questions and privacy requests: support@withpatient.com.