Legal

Privacy Policy

Last updated: 15 June 2026  ·  Applies to clinicbot-ai.com and all embedded widgets

1. Who we are

ClinicBot ("we", "us", "our") operates the website clinicbot-ai.com and provides white-label AI chat services to healthcare clinics. For GDPR purposes, ClinicBot acts as a data controller for data collected on this website, and as a data processor on behalf of clinics that use our widget.

Contact: info@clinicbot-ai.com

2. What data we collect

When you visit this website:

• Browser type, device type, and approximate location (country level) via server logs
• Pages visited and time spent (analytics — see section 5)
• Cookie preferences you set via our cookie banner

When you use the chat widget (on this site or a clinic's site):

• The messages you type during a conversation
• The clinic ID associated with the widget
• Timestamps of conversations

When you submit a lead capture form (Book a consultation):

• Your name, email address, and phone number (if provided)
• The question or topic you asked about

When you purchase a subscription:

• Email address and payment details are collected and processed by Stripe (we never store card numbers)
• Clinic name and configuration details you provide

3. How we use your data

• To provide and improve the ClinicBot service
• To forward patient enquiries to the relevant clinic (lead capture)
• To process subscription payments via Stripe
• To respond to support or sales requests
• To comply with legal obligations

4. Legal basis for processing

We rely on the following legal bases under GDPR Article 6:

• Contract performance — to deliver the service you subscribed to
• Legitimate interests — to operate and improve the platform, prevent fraud
• Consent — for analytics cookies (you can withdraw at any time via the cookie banner)
• Legal obligation — where required by EU or Spanish law

5. Cookies and analytics

We use the following cookies:

• Strictly necessary — language preference (cb-lang), cookie consent choice. These are always active and do not require consent.
• Analytics (optional) — we use Google Analytics to understand how visitors use our site (pages visited, session duration, traffic sources). These cookies are only set if you accept analytics in the cookie banner. You can change your preference at any time.

No advertising or third-party tracking cookies are used.

6. Third-party services

• Anthropic (Claude AI) — chat messages are processed by Anthropic's Claude API to generate responses. Anthropic's data processing agreement applies. Data is processed in the USA under standard contractual clauses.
• Supabase — our database provider. Data is stored on servers in the EU.
• Stripe — payment processing. Stripe is PCI-DSS Level 1 certified.
• Vercel — our hosting provider, with global edge network. Data may pass through servers in the US and EU.
• Google Analytics — only activated with your consent (see section 5).

7. Data retention

• Chat conversation logs: retained for 12 months, then deleted
• Lead capture data: retained for 24 months or until the clinic requests deletion
• Subscription and billing data: retained for 7 years to comply with tax obligations
• Cookie consent records: retained for 12 months

8. Your rights under GDPR

If you are based in the EU/EEA, you have the right to:

• Access — request a copy of your personal data
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to limit how we process your data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — for analytics cookies, via the cookie banner at any time

To exercise any of these rights, email info@clinicbot-ai.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (in Spain: AEPD — Agencia Española de Protección de Datos).

9. Data security

We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, access controls, and regular security reviews. No system is completely secure, and we cannot guarantee absolute security.

10. Children's privacy

ClinicBot is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe a child has submitted data through our service, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the website. The "last updated" date at the top of this page always reflects the most recent version.

12. Contact

For any privacy-related questions or to exercise your rights:

info@clinicbot-ai.com