Privacy Policy

Klinea is an artificial intelligence–based customer relationship management (CRM) platform developed for health tourism, aesthetic, and dental clinics, and it is offered as part of Weezboo. We attach great importance to your privacy and to the security of your data. This Privacy Policy explains how we collect your personal data, for what purposes we process it, with whom we share it, and how we protect it when you use our platform, our website, and our related services. By using Klinea, you acknowledge that you have read this policy and understood the data practices described herein. This document has been prepared in compliance with Law No. 6698 on the Protection of Personal Data (KVKK) and, to the extent applicable, the European Union General Data Protection Regulation (GDPR).

Our capacity as data controller and data processor

Klinea acts in two distinct roles. With respect to the staff accounts created by your clinic and to billing and service-usage information, we act as the data controller; with respect to the patient and prospective-patient data that your clinic enters into the platform or that arrives through integrated channels, we act as the data processor. In this second case, responsibility for patient data lies with the clinic (the data controller); Klinea processes such data solely on the clinic's instructions and within the framework of the agreement between us, for the purpose of providing the service.

Data we collect

When you create an account with Klinea, we collect the basic information required to provide the service, such as your name, email address, phone number, clinic details, and billing information. While you use the platform, we automatically collect technical data such as your IP address, browser and device information, and session and usage logs; this data helps us improve your experience and ensure the security of the platform. In addition, your clinic may enter into the platform, or transfer from these channels, the content of messages, appointment, offer, and patient-journey data arising from the patient communication it conducts over WhatsApp, Instagram, email, and other connected channels. Health and communication data processed in this context may be considered special categories of personal data under the applicable legislation and are processed only on the clinic's instructions and under additional security measures.

Meta platforms and messaging channels

Klinea integrates with the WhatsApp Business Platform and Instagram (Meta Platforms, Inc.) and with other channels such as email, SMS, and Telegram so that your clinic can carry out its patient communication. The message content and communication data received through these channels are processed solely for the purpose of providing the service and in accordance with the instructions of the clinic (the data controller). We do not use this data for advertising or marketing purposes, and we do not transfer it to third parties for any purpose other than the provision of the service. When using these integrations, Klinea undertakes to comply with the relevant platform rules, including the Meta Platform Terms and the WhatsApp Business Messaging Policy. The processing of data from these channels within Meta's own systems is subject to Meta's own terms and privacy policy. Providing the necessary disclosures to, and obtaining the explicit consents of, end users (patients) is the responsibility of the clinic, as required by the applicable legislation and platform rules.

Purposes for which we process data

We process your personal data primarily to provide our service: multi-channel communication in a single dashboard, patient-journey tracking, appointment and offer management, and generating message drafts and reply suggestions through our artificial intelligence agents. We also use your data to communicate with you regarding service updates, security notifications, and billing, to provide customer support, to resolve technical issues, to improve the functionality of the platform, and to comply with our legal obligations. Our artificial intelligence features process the content provided in order to generate responses aligned with your clinic's tone; we do not use your patient data to train our models without your consent.

Data security

Klinea applies industry-standard security measures, including encryption in transit and at rest, access controls, regular security testing, and authorization layers. We store your data on secure servers with multi-layered protection, accessible only when necessary for the provision of the service and only by authorized personnel. We continuously update our security protocols against evolving threats. In the event of a data breach, we undertake to inform affected users and the relevant authorities (for example, the Personal Data Protection Authority) within the periods prescribed by the legislation.

Data sharing

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We share your data only with trusted service providers who help us deliver our service (such as cloud infrastructure providers, payment institutions, messaging channel providers, and customer support tools); these providers are subject to strict confidentiality obligations and use your data only for the specified purposes. We may need to disclose your data where required by a legal obligation, to protect our rights, or in the context of a business transaction such as a merger or transfer. Where data is transferred abroad, we provide the appropriate safeguards required by the KVKK/GDPR.

Your rights

Under the KVKK and applicable data protection legislation, you have the right to access, rectify, erase, or restrict the processing of your personal data, to request the portability of your data, and to object to processing. You may update your account information at any time from your dashboard settings; you may contact our support team to export your data or to suspend or permanently delete your account. In addition, if you believe that your request has not been adequately addressed, you have the right to lodge a complaint with the Personal Data Protection Authority or the competent supervisory authority. We respond to all data-subject requests within the periods prescribed by the legislation.

Retention periods

We retain your personal data only for as long as the purposes for which it was collected require, or for the retention periods prescribed by applicable legislation. Once that period ends, your data is deleted, destroyed, or anonymized. The patient data we process in our capacity as data processor for your clinic is retained for the duration of the agreement between us and in accordance with the conditions set out in that agreement; following the termination of the agreement, and subject to statutory retention obligations, it is returned or destroyed upon your request.

Data deletion requests

You may request the deletion of your personal data at any time. You can update or delete the data relating to your clinic account from your dashboard settings, or request the complete closure of your account. In addition, both you and an end user (patient) whose data is processed through our clinic may request the deletion of data by sending an email to [email protected]. We resolve requests within 30 days at the latest, subject to our statutory retention obligations. For step-by-step instructions, please see our Data Deletion Instructions page.

Changes and contact

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or legal requirements. When we make a significant change, we will notify you by email or through a prominent notice on the platform before the changes take effect. We recommend that you review this policy regularly so that you remain informed about how we protect your privacy. For questions about this Privacy Policy or our data practices, you may reach us at [email protected].