Privacy Policy
This Privacy Policy explains how Serve.chat and, where relevant, the business operating the assistant collect, use, store, share, and protect personal information when someone interacts with the assistant through WhatsApp or related booking flows. If a clinic, practice, or other business uses this assistant for its own customer communications, that business may also be a controller of the information it collects from you.
1. Who this policy applies to
This policy applies to anyone who messages the assistant, sends voice notes, images, documents, or booking details, receives automated or staff replies, or otherwise interacts with the service through Meta WhatsApp messaging or related landing pages. It also applies to appointment requests, scheduling updates, and customer support exchanges handled through the assistant.
2. Information we collect
Depending on how you use the service, we may collect and store the following categories of information:
- Your WhatsApp phone number, display name, profile details made available through WhatsApp, and message metadata such as timestamps and message identifiers.
- Chat content, including text messages, booking requests, answers to FAQs, follow-up replies, and any information you voluntarily include in messages.
- Media you send, such as voice notes, images, documents, and audio files, together with related technical metadata.
- Appointment and contact details, such as your full name, email address, preferred time slots, booking status, service requested, and related notes.
- Technical and security data, including logs, IP address, browser information, webhook activity, and device/session data needed to operate, secure, and troubleshoot the service.
- Potentially sensitive or health-related information if you choose to include it in a message. Please do not send unnecessary sensitive data.
3. How information is collected
Information is collected directly from you when you message the assistant, submit booking details, upload media, or interact with website or booking interfaces. Information may also be received from Meta as part of WhatsApp message delivery, from scheduling providers when appointments are created or updated, and from internal staff members when they review or respond to conversations.
4. How we use personal information
We use the information described above to operate the assistant, answer questions, provide business information, suggest or manage appointments, send reminders, process conversations through AI models, let human staff review or continue support, improve reliability, detect misuse, prevent fraud, investigate incidents, and comply with legal, regulatory, contractual, and operational requirements.
5. Legal bases for processing
Where data protection law requires a lawful basis, we generally rely on one or more of the following: performance of a contract or steps requested before entering into one, legitimate interests in operating and securing the assistant, consent where required, and compliance with legal obligations. If you provide health-related or otherwise sensitive information, we will only process it where permitted by applicable law and for the limited purposes needed to handle your request.
6. AI processing and automation
We use OpenAI models to help classify messages, draft answers, support FAQ automation, and process booking-related interactions. AI outputs are generated from the information provided in the conversation and may be reviewed or supplemented by human staff. Automated processing may help triage or structure your request, but the assistant should not be relied on as the sole source for medical, legal, financial, or emergency decisions.
7. Third-party services and disclosures
We may share relevant information with trusted providers only where needed to operate the service, including Meta for WhatsApp messaging, OpenAI for AI processing, hosting and database providers, logging and storage providers, calendar and scheduling providers, and professional advisers, regulators, courts, or law enforcement where required or reasonably necessary.
8. International transfers
Because the service uses cloud infrastructure and third-party providers, your information may be processed or stored in countries other than the one where you live. When transfers are made, we aim to use appropriate contractual, technical, and organizational safeguards required by applicable law.
9. Data retention
We keep chat history, booking records, support logs, and related metadata for as long as reasonably necessary to provide the service, maintain business records, investigate issues, comply with law, enforce agreements, and support legitimate operational needs. Retention periods may vary depending on the nature of the message, whether an appointment was booked, whether the record is needed for safety or dispute handling, and any legal recordkeeping obligations that apply to the business using the assistant.
10. Security
We use reasonable administrative, technical, and organizational measures intended to protect information against unauthorized access, loss, misuse, alteration, and disclosure. These measures may include access controls, encryption in transit, credential management, logging, and environment-level security practices. No system can be guaranteed to be completely secure, so please avoid sharing unnecessary sensitive information through messaging channels.
11. Cookies, sessions, and local storage
If you access related web pages or booking interfaces, the service may use necessary cookies, session technologies, or similar local storage mechanisms to keep the website functioning, maintain session state, support security, and remember essential preferences. We do not rely on optional tracking technologies unless the website separately notifies you and, where required, obtains consent.
12. Your rights and choices
Depending on your location and applicable law, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent where relevant, and the right to complain to a competent data protection authority. Requests may be limited where records must be retained for legal, safety, contractual, or healthcare-related reasons.
13. Children and vulnerable users
The service is not directed to children to use independently unless a parent, guardian, or authorized representative is involved and applicable law allows such use. If you believe a child or vulnerable person has provided information inappropriately, contact us so we can review the situation.
14. Changes to this policy
We may update this Privacy Policy from time to time to reflect service changes, legal developments, or operational needs. When we do, we will publish the updated version on this page and update the effective date above. Material changes may also be communicated through the website, WhatsApp, or other reasonable notice channels where appropriate.