Privacy Policy

1. Introduction & Scope

This Privacy Policy applies to the Docly SaaS platform, including our web applications, appointment booking portals, AI receptionist services, WhatsApp & Instagram integrations, and administrative dashboards (collectively, the “Platform”).

In this policy, “Clinic” or “Customer” refers to the healthcare practice, physician, or clinic administrator holding an account with Docly. “Patient” refers to any individual scheduling or inquiring about an appointment with a Clinic via the Platform.

2. Information We Collect

We collect only the minimum information necessary to deliver autonomous scheduling and patient communication services:

• Clinic & Practitioner Data: Full name, professional license details, clinic name, physical address, business phone number, email address, working schedule, service catalog, and consultation fees.
• Patient Appointment Data: Patient name, phone number, email address, requested consultation type, appointment date/time, and optional pre-visit intake questionnaire responses.
• Communication & Messaging Data: Messages transmitted between Patients and the Docly AI assistant or clinic staff across WhatsApp Business API, Instagram DM, SMS, or web booking widgets, strictly for the purpose of booking and answering clinic FAQs.

3. How We Use Information

We process collected data solely to:

• Coordinate, reserve, reschedule, and cancel clinic appointments autonomously.
• Synchronize calendar slots in real-time with Google Calendar and connected practice systems.
• Dispatch automated confirmation messages, 24-hour and 2-hour appointment reminders, and telehealth video links (Zoom/Google Meet).
• Answer patient administrative inquiries based on the clinic’s designated knowledge base.
• Prevent double bookings and detect scheduling conflicts.
• Provide aggregated practice analytics (no-show rates, peak booking hours, channel performance).

4. HIPAA Compliance & Protected Health Information (PHI)

Where Docly handles Protected Health Information (PHI) on behalf of a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA), Docly acts as a Business Associate.

We execute standard Business Associate Agreements (BAAs) with eligible healthcare organizations. Under HIPAA, we implement administrative, physical, and technical safeguards that reasonably protect the confidentiality, integrity, and availability of electronic PHI that we create, receive, maintain, or transmit.

5. Third-Party Service Providers & Sub-processors

To provide reliable omnichannel services, we partner with industry-leading sub-processors adhering to stringent security standards:

• Meta Cloud API (WhatsApp & Instagram): For transmitting patient appointment messages via WhatsApp Business.
• Google Cloud & Google Calendar API: For infrastructure hosting and two-way practitioner calendar synchronization.
• Twilio: For automated SMS reminder transmissions.

6. Data Security & Encryption

Docly enforces robust security controls across every tier of our architecture:

• Encryption in Transit: All communications with our servers use modern TLS 1.3 encryption.
• Encryption at Rest: All database volumes, backups, and patient records are encrypted using AES-256.
• Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA), and automated audit logs for sensitive actions.

7. Patient & Clinic Rights (GDPR & CCPA)

Depending on your jurisdiction, you and your patients have the right to:

• Request access to personal data held by Docly.
• Request correction of inaccurate or incomplete records.
• Request deletion of personal data (“Right to be Forgotten”), subject to medical record retention obligations mandated by law.
• Export patient communication history and appointment archives in structured format.

8. Data Retention

We retain appointment records and clinic configurations for as long as the clinic’s account remains active. Upon account termination, data is scheduled for secure purging within 90 days, unless a longer retention period is required by healthcare regulatory compliance.

9. Contact Our Data Protection Officer (DPO)

If you have questions regarding this Privacy Policy, your rights, or HIPAA compliance, please contact our privacy office: