Privacy Policy
1. Who we are
Menaela (“Menaela”, “we”, “us”) provides an AI-first practice management platform for clinics. This policy explains how we handle personal data for visitors to this website and for clinics and their patients who use the platform. For platform data, the clinic is the data controller and Menaela acts as a data processor on the clinic’s behalf — see our Data Processing Addendum.
2. Data we collect
- Website visitors: contact details you submit through forms (name, email, phone, message), and basic analytics/technical data such as IP address and browser type.
- Clinic users: account and profile information, and operational data you enter into the platform.
- Patient data (processed on behalf of clinics): contact details, appointments, communications, and clinical documentation the clinic chooses to store. This may include health data, which is treated as a special category requiring additional safeguards.
3. How we use data
- To provide, operate and secure the platform and website.
- To respond to inquiries and provide support.
- To process patient communications, scheduling and documentation on the instructions of the clinic.
- To meet legal, regulatory and security obligations.
We do not sell personal data. AI features operate through controlled, tenant-bound operations and do not grant the model unrestricted access to clinic databases.
4. Legal bases
Where GDPR applies, we rely on consent, performance of a contract, legitimate interests, and — for health data — the specific conditions permitting processing for the provision of healthcare, in each case as instructed by the clinic acting as controller.
5. Sharing and sub-processors
We use vetted infrastructure and service providers (hosting, communications channels such as WhatsApp, speech and language processing) as sub-processors under appropriate agreements. A current list is available on request and maintained in the Data Processing Addendum.
6. Data retention
We retain personal data for as long as needed to provide the service and to meet legal obligations. Clinic and patient data is retained per the clinic’s configuration and instructions, and deleted or returned on termination as set out in the DPA.
7. Security
Each clinic’s operational data is held in a separate database, access is permission-controlled, and agent-originated actions are auditable. We apply technical and organizational measures appropriate to the sensitivity of the data.
8. Your rights
Depending on your jurisdiction, you may have rights to access, correct, delete, restrict or port your personal data, and to object to certain processing. Patients should contact their clinic (the controller); website visitors can contact us directly.
9. International transfers
Where data is transferred across borders, we use appropriate safeguards such as standard contractual clauses.
10. Contact
Questions about this policy: hey@menaela.com.