Roles
Your clinic is the controller of its patients' personal data. Healy is the processor and acts only on the clinic's documented instructions, which are the configuration and settings the clinic chooses in Healy.
What we process
- Patients' WhatsApp numbers and their messages with the clinic.
- Appointment details read from and written to the clinic's own system.
- Consent records for reminders and the clinic's staff accounts.
How we protect it
- Each clinic's data is isolated from every other clinic at the database level.
- Staff access is role-based and every action is recorded in an append-only audit trail.
- Data is encrypted in transit; message contents are deleted after the retention period.
- Healy staff do not access a clinic's patient data without the clinic's permission.
Sub-processors
Healy uses sub-processors for hosting, WhatsApp messaging (Meta) and AI language processing. The current list is available on request.
Incidents
If a personal data breach affects your clinic, we notify your administrators without undue delay with the information you need to meet your own obligations.
End of the service
When a clinic closes its account, we revoke connections to its systems, provide an export on request and delete its data according to the retention schedule.
Need a signed copy? Contact us.