Dockie-talkie Agent Whenever Service Privacy Notice

1. Scope and roles

• The customer healthcare institution retains control of its WhatsApp Business Account, patient communications, approved information, schedules, and clinical decisions.
• AetherHeal Global Inc. is the technology provider authorized by the customer institution to deliver the service. We process the Platform Data needed to provide that service on the customer's behalf.
• Meta and WhatsApp apply their own terms and privacy policies to the platform services they provide.
• The connection covered by this notice is the WhatsApp Business Platform. KakaoTalk, Telegram, LINE, WeChat, and a chat widget on the institution's website are within the service's designed scope, and each would require its own authorization from the healthcare institution before it is connected. Platform Data from the WhatsApp connection is not merged with patient conversations on any other channel.
• The service does not independently diagnose, recommend treatment, or make clinical decisions.

2. Information processed

3. Purposes

• Receive patient-origin inquiries and maintain the conversation flow.
• Prepare institution-approved operational information and booking-workflow entry in English, the initial automated-reply scope.
• Route Korean and other unsupported languages through a defined safety path to authorized staff at the healthcare institution.
• Route questions requiring clinical judgment, exceptions, and urgent signals to authorized staff at the healthcare institution.
• Prevent duplicate processing and maintain the records needed for security, troubleshooting, audit, and customer support.
• We do not sell Platform Data or use it for advertising or cross-customer profiling.

4. Processing flow and necessary providers

After the customer healthcare institution authorizes the connection, the WhatsApp Business Platform delivers messages to the service's authenticated webhook. The service verifies the authorized customer account and bound phone number, then processes messages and conversation state to prepare a response or a handoff to people.

• Hosting and database providers may process data as necessary for message receipt, storage, and recovery.
• Contracted AI processing providers may process the conversation context necessary to prepare replies and classifications.
• A staff communication channel authorized by the customer receives the inquiries and necessary conversation summaries that require human handling. That handoff is carried out on the customer institution's instructions, and where it passes through an external provider it is limited to a contracted provider handled in line with WhatsApp's third-party provider requirements.
• Before production onboarding, we document the fields and conversation context sent to each provider and verify that the scope has been minimized. The customer agreement and patient notice identify the applicable providers, cross-border processing, and legal basis.

5. Retention and deletion

At the current pre-launch stage, there is no customer Platform Data retained in a production environment.

Before real-patient processing begins, we and the customer healthcare institution define retention periods for message content, conversation state, handoff records, and audit records and publish them in the patient notice. Real-patient processing is not activated unless the service retention setting, published notice, and verified deletion procedure agree.

There is not yet a deletion or de-identification procedure for production customer data. Before real-patient processing, we create and test a procedure covering requester and institution authority, legal retention duties, deletion or de-identification scope, any narrowly retained audit records, and verification of completion.

6. Data-subject rights and requests

• A patient may ask the healthcare institution they contacted for access, correction, deletion, restriction, or withdrawal of consent.
• To contact AetherHeal directly, email drjeeju@aetherheal.com with the institution name, the request, and the minimum information needed to verify the requester. Do not include message content or health information in the email.
• Because there is currently no customer Platform Data in a production environment, AetherHeal can confirm that status. Before real processing, we finalize how requests are received, authorized, carried out under the customer's instructions, and verified as complete.
• The activation conditions include a path for institution staff to respond directly when a patient withdraws consent or declines automated processing, without the choice itself creating a disadvantage.

7. Safeguards and activation conditions

• Controls verified in the current runtime: signed webhook verification and checks for the authorized customer account and bound phone number
• Controls verified in the current runtime: duplicate-processing controls, a final authorization check before sending, and a disable control
• Controls verified in the current runtime: a separate operational audit record designed not to contain patient message bodies
• Conditions to verify before a real-patient connection: encryption across the production transport path, including ingress, customer-data separation, and least-privilege access
• Conditions to verify before a real-patient connection: provider-specific data minimization and verified retention and deletion procedures
• Conditions to verify before a real-patient connection: a separate notice and consent process for sensitive health information included in pre-visit intake
• Independent technical, privacy, and clinical-safety review before a real-patient connection

No technical measure guarantees absolute security. If an incident is suspected, we work with the customer healthcare institution to determine scope and notify and respond as required by applicable law and contract.

8. Clinical boundary and emergencies

• The service is designed to provide only operational information approved by the healthcare institution.
• Diagnosis, treatment recommendations, and patient-specific clinical judgment remain with authorized clinical staff at the healthcare institution.
• A WhatsApp conversation is not an emergency medical channel. A person with urgent symptoms or immediate risk should contact local emergency services without delay.

9. Changes and contact

If customer connections, processing providers, retention periods, or service scope change, we update this notice before the change applies and display the effective date and version.

Questions about this notice or service data processing may be sent to drjeeju@aetherheal.com.

Privacy contact