Privacy policy

Who is responsible

KlinikSuite. Responsible parties: Angel Alberto Vladimir Aguilar Martinez and William Evans. You can reach us at hola@kliniksuite.com.

What data we handle

Depending on your relationship with us:

• Client clinics: practice name, contact details, domain, site content, booking hours, and credentials for the services you connect.
• Assistant conversations: the messages exchanged, the language, and — only if the person provides them — their name and a contact detail.
• Appointments: date and time, mode (in person or online), and the name, email or phone the person gives so the booking can be confirmed.
• Patient records (an optional feature a clinic switches on): name, contact, notes and documents the clinic itself uploads.
• Technical data: IP address and browser, recorded alongside document access so it can be audited.

Sensitive and health data

Records and documents a clinic uploads may contain sensitive personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties. We handle them only on the clinic's instructions, with these specific measures:

• Documents are encrypted before storage (AES-256-GCM), not held in the clear.
• Every view, download, upload and deletion is recorded with who, when, from which IP and with which browser.
• The AI assistant has no access to patient records or documents. They are outside its technical reach, so it cannot read them or quote them in a conversation.
• Our support staff have no routine access. An emergency access path exists which requires a written reason to be recorded before a file can be opened, and that reason is stored with the log entry.

What we use data for

We do not sell personal data. We do not use it for advertising. We do not train AI models on patient data or on conversations.

• Running the clinic's site and assistant: answering questions, booking and rescheduling appointments.
• Sending confirmations, reminders and calendar invitations.
• Supporting the clinic and fixing faults.
• Meeting legal obligations.

Cookies and measurement

When you visit the public pages, this site sets no advertising or measurement cookies unless you agree to them. On your first visit we show a notice with two choices, “Accept” and “Decline”. If you decline, or don’t answer, none of those tools is loaded.

This is everything this site may store in your browser:

• ks_session — strictly necessary. Created only when a client clinic signs in, and keeps that session open. It is httpOnly (the page’s own JavaScript cannot read it), travels only over an encrypted connection, and expires on sign-out or when its term runs out. It holds no personal data and cannot be used to follow you across other sites.
• Your cookie choice (ks-analytics-consent) — kept in your browser’s local storage so we don’t ask again. It is not a cookie and never leaves your device.
• The assistant conversation identifier (clinickit_session_…) — kept in local storage so the assistant remembers the conversation while you browse, and renewed after 4 hours of inactivity. It identifies the conversation, not you, and leaves your device only to send your own messages to the assistant.
• Where your visit came from (ks_attribution) — if you arrive from an ad or a link with campaign tags, we keep that click’s identifiers (gclid, gbraid, wbraid, fbclid) and its utm_* tags, with the date, in local storage. It is not a cookie, it is deleted after 90 days and it is never sent to Google or Meta; it only travels with your messages to the assistant, so that if you book a call or leave your details we know which ad brought you.
• Google Analytics (_ga, _ga_*) — only if you accept. Measures how many people visit the site and which pages they view. Provider: Google LLC. Lasts up to 2 years.
• Google Ads (_gcl_au, _gcl_aw and other _gcl_*) — only if you accept. Advertising measurement: tells Google whether a click on our ads led to a booked call or a WhatsApp contact. Provider: Google LLC. Lasts 90 days.
• Meta Pixel (_fbp, _fbc) — only if you accept. Measures whether our Facebook and Instagram ads bring visits and enquiries. Provider: Meta Platforms, Inc. Lasts 90 days.

Analytics

With your consent, we use Google Analytics, Google Ads and Meta Pixel to learn what works on this site and in our ads. We record visits and a few actions: opening the assistant chat, tapping a WhatsApp link, choosing a plan and booking a call. These records do not include your name, phone number, email address or the content of your conversations.

Google and Meta handle that information under their own privacy policies and may link it with other data they already hold about you. We do not sell data or use it for any other purpose.

You can withdraw your consent at any time with the “Change cookie preferences” button on this page, or delete the cookies in your browser settings. Declining or withdrawing consent does not affect your use of the site or the assistant.

Who we share it with

Only the providers needed to run the service, and only the data each one needs:

• Vercel — site hosting and file storage.
• Neon — database.
• Anthropic — the language model that answers in the chat. It receives the conversation message; it does not receive patient records or documents.
• Resend — sending confirmation and notification emails.
• Meta (WhatsApp Business) — only if the clinic switches on WhatsApp.
• Google — only if the clinic connects its calendar; see the next section.
• Google (Analytics and Ads) and Meta (Pixel) — only if you accept measurement cookies on this site; see “Analytics”.

Google Calendar data

If a clinic chooses to connect its Google calendar, this is the part to know precisely:

• We request the availability (freebusy) scope. That scope returns busy and free intervals only.
• We cannot read event titles, guests, notes or attachments. That is a technical limit rather than a promise: the scope we request does not expose them.
• We use those intervals for one purpose: stopping the assistant from booking over an existing commitment.
• If event writing is also enabled, we create and update only the appointment events our system generates, marked as ours. We do not modify or delete events you created.
• The access token is stored encrypted and can be revoked at any time from your Google account settings or by asking us. Once revoked, we stop reading the calendar.
• We do not use Google Calendar data for advertising, do not sell it, do not transfer it to third parties, and do not use it to train models.
• Our use of information received from Google Workspace APIs, whether raw or derived, adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use or transfer that data — raw, aggregated or derived — to create, train or improve any foundational or generalized artificial intelligence or machine learning model, our own or a third party's.
• Para referencia en español: el uso que hacemos de la información recibida de las API de Google Workspace cumple con la Política de Datos de Usuario de los Servicios de API de Google, incluidos los requisitos de Uso Limitado.

How long we keep it

We keep data while the clinic's account is active and while it remains necessary for the purposes described. Today we do not automatically delete conversations or appointments after a fixed period: they are kept until the clinic or you ask for deletion, or the account is closed.

We would rather state that than advertise a retention period the system does not enforce. If we implement automatic deletion, we will update this policy.

Your rights

You may request access to, correction of, cancellation of, or object to the processing of your personal data, and withdraw consent (ARCO rights under Mexican law). Write to hola@kliniksuite.com and we will respond.

If you are a patient of a clinic, please contact that clinic first: it is the controller of your record and we act on its instructions. If you write to us directly, we will help route your request.

You may also complain to the competent data protection authority.

International transfers

Our providers run servers outside Mexico, primarily in the United States. By using the service, the data described is processed on that infrastructure in accordance with this policy.

Changes to this policy

If we change this policy we will update the date in the header. Where a change is substantial, we will tell client clinics by email.