Privacy Policy

OpsPilot ("OpsPilot", "we", "us") provides a staff-facing front desk workspace for clinics — inbox, AI drafts, approvals, escalations, appointments, waitlist, reminders, audit, and lead-recovery tools. This policy covers two kinds of people: clinic staff who use OpsPilot directly, and patients/contacts whose messages, bookings, and contact details a clinic processes through OpsPilot on the clinic's behalf.

For most patient data, the clinic is the data controller and OpsPilot is the data processor / service provider acting on the clinic's instructions. Questions about a specific clinic's use of patient data should go to that clinic first; this policy describes OpsPilot's own handling of the platform and the data the clinic entrusts to it.

• Account and staff data: name, email, phone, role, and authentication data for people who log in to OpsPilot.
• Tenant/clinic configuration: business details, plan and billing status, connected-provider configuration (which channels are enabled, not the provider credentials themselves — see §6).
• Patient/contact data processed on a clinic's behalf: names, contact details, appointment and booking history, and message content sent through WhatsApp, SMS, email, Instagram, Facebook, voice, or the web chat/booking widgets a clinic enables.
• Usage and log data: feature usage, approval/escalation activity, and technical logs needed to operate and secure the service. Audit log entries are redacted before storage — see §6.

• To operate the front desk workspace: routing messages, drafting replies, scheduling, reminders, and recovery workflows a clinic has configured.
• To maintain approvals, escalations, and audit trails so clinic staff can verify how patient-facing communication was handled.
• To secure the service: authentication, fraud/abuse prevention, and monitoring for safety-relevant events.
• To bill for and support the subscription a clinic has purchased.
• To improve the product, using aggregated or de-identified signals wherever possible — never real patient message content used to train a model without a clinic's separate, explicit consent.
• To see which parts of OpsPilot clinic staff use: when a signed-in staff member opens a page, we record which kind of page it was (for example “contacts”, never which record, search text or patient detail), their clinic and their user account, and keep it for up to 13 months.

OpsPilot uses AI providers (which may include a deterministic mock provider in development/testing, and real providers such as OpenAI or Gemini in production) to classify messages and draft replies. AI assists clinic staff; it does not replace them. AI does not diagnose, prescribe, or make clinical decisions, and a deterministic safety detector — not the AI provider — is the sole authority on clinical or legal-dispute risk classification.

By default, every AI-drafted patient-facing message requires a human staff approval before it is sent. A small number of narrowly scoped, tenant-opted-in exceptions exist (for example, fixed reminder/recall templates, or grounded answers built only from a clinic's own staff-approved knowledge base) — never a general license for AI to send anything it composes without safeguards. Full detail on these exceptions is published in-product on the Trust Center page.

We share information only as needed to run the service a clinic has configured, and never sell personal data. Depending on which channels a clinic enables, information may flow to:

• Messaging and telephony providers (e.g., Meta/WhatsApp, Instagram, Facebook, Twilio) to send and receive patient communications.
• Email delivery providers (e.g., SendGrid) for transactional and reminder email.
• Calendar providers (e.g., Google, Outlook) for appointment scheduling a clinic connects.
• Payment processors (e.g., Stripe) for billing.
• AI providers configured by the clinic, for classification and drafting as described in §4.
• Infrastructure and hosting providers that run OpsPilot's servers and databases.

A provider only receives data once a clinic has actively connected it through its own onboarding/Settings flow with real, encrypted credentials — connecting a live provider is always a deliberate action the clinic takes, never a side effect of using another feature.

• Tenant isolation: every clinic's data is scoped to that clinic. Cross-tenant access is designed to fail closed (not found), never to fail open.
• Role-based access: staff only see and act on what their role permits, enforced server-side, not just hidden in the interface.
• Redacted audit logs: logs of state-changing actions (drafts, approvals, escalations, sends, integration changes) are kept, but audit metadata excludes raw message bodies, raw provider payloads, secrets, tokens, and full phone numbers.
• Secrets handling: real provider credentials are stored encrypted or in a managed secrets system — never in logs, audit records, or plain configuration files.
• Synthetic test data: automated tests and local development use synthetic data only; real patient data is never used to test or develop the product.

OpsPilot is built to be compliance-conscious — designed with HIPAA/GDPR/UK GDPR/Australia Privacy Act principles in mind — but it is not independently compliance-certified. Using OpsPilot does not by itself satisfy a clinic's own legal or regulatory obligations; those remain the clinic's responsibility, informed by its own legal and security review.

We retain account, patient/contact, and audit data for as long as a clinic's subscription is active and as needed to provide the service, meet legal/audit obligations, and resolve disputes. A clinic may request deletion or export of its data on account closure, subject to any minimum retention period required by applicable law or needed to preserve an audit trail for a period after an action was taken.[Clinic-specific retention periods to be finalized with legal review.]

Depending on applicable law, individuals may have rights to access, correct, export, or request deletion of their personal data. A patient/contact should generally direct these requests to the clinic they interact with, since the clinic controls that relationship; OpsPilot supports clinics in fulfilling those requests within the platform. Clinic staff can manage their own account data from Settings, or contact us directly (§12).

OpsPilot is not directed at children as users of the platform itself — staff accounts require a clinic employment relationship. Patient records processed on a clinic's behalf may include minors, consistent with normal clinic operations; a clinic is responsible for obtaining any parental/guardian consent required by law for communicating with or about a minor patient.

Depending on where a clinic and its patients are located and which providers a clinic connects, data may be processed in a different country than where the patient is located. Where required, we intend to rely on appropriate transfer safeguards (such as standard contractual clauses); the specific mechanisms for a given deployment should be confirmed as part of that clinic's own compliance review.[Region/hosting details to be finalized per deployment.]

We may update this policy as the product or its provider integrations change. We will update the "Last updated" date above when we do, and, for material changes, aim to notify clinic administrators in-product or by email.

Questions about this policy, or a request related to your data, can be sent to [privacy@your-domain.example].