Privacy Policy

Who we are

Receptys.ai is operated by C-Vids Productions (Singapore business registration UEN 53119647W), 9002 Tampines Street 93, #03-36, Singapore 528836. Under the Personal Data Protection Act 2012, your clinic decides how its patients' data is used; C-Vids Productions processes that data on your clinic's behalf, only to run the service.

1. Information We Collect

We collect information you provide directly when creating an account or configuring your clinic, including:

• Account data: name, email address, and password.
• Business data: clinic name, services, operating hours, and promotional content you enter into the platform.
• Patient conversation data: messages sent to your AI receptionist via Telegram, Instagram, Facebook Messenger, or your clinic's web chat / QR chat page (receptys.ai/c/your-clinic), together with the name, mobile number and optional email a patient provides for a booking.
• Booking data: appointment records created through the platform.
• Payment data: billing information processed by Stripe. We do not store card numbers on our servers.
• Usage data: log files, IP addresses, browser type, and interactions with the dashboard (for analytics and debugging).

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Receptys.ai platform.
• Power the AI receptionist, including understanding patient queries and booking appointments.
• Send appointment reminders and notifications on your behalf.
• Process payments and manage your subscription.
• Respond to support requests and troubleshoot issues.
• Comply with legal obligations.

We do not sell your data or your patients' data to third parties. We do not use conversation data to train AI models beyond your specific clinic context.

3. Data Storage and Security

All data is stored on Supabase infrastructure, hosted on AWS in the Tokyo, Japan region (ap-northeast-1). We implement industry-standard security measures including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Row-level security policies restricting data access to authenticated users.
• Service role keys stored as environment variables, never exposed to clients.
• Regular security reviews and dependency updates.

No security system is infallible. In the event of a data breach we will notify affected users within 72 hours as required by applicable law.

4. Third-Party Services

Receptys.ai integrates with the following third-party services. Each operates under its own privacy policy:

• Meta (Facebook & Instagram): When you connect your Facebook Page or Instagram Business account, we receive and store a page access token and may process messages sent to those accounts. Data is subject to Meta's Data Policy.
• Google Calendar: With your explicit authorisation, we read and write to your Google Calendar to check availability and create bookings. We request only the minimum required scopes.
• Stripe: Payment processing is handled entirely by Stripe. We receive subscription status and billing metadata but never store payment card details.
• Supabase: Our primary database and authentication provider. Data is stored in their managed Postgres infrastructure.
• OpenAI: Patient messages may be sent to OpenAI's API to generate AI responses. OpenAI does not use API data to train its models by default. We recommend reviewing OpenAI's enterprise privacy commitments.
• Vercel: Hosting of the application and cookieless web analytics (no cookies, no cross-site tracking).
• Resend: Sends booking reminders by email and account emails.
• Telegram: Bot API, for clinics that connect a Telegram bot; messages pass through Telegram's servers under Telegram's privacy policy.

5. Data Retention

We retain your data for as long as your account is active. If you cancel your subscription:

• Your account and associated data are retained for 30 days to allow reactivation.
• After 30 days, business configuration data, conversation logs, and booking records are deleted.
• Billing records may be retained for up to 7 years to comply with financial regulations.

You may request immediate deletion of your data at any time by contacting us at the address below.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data (right to be forgotten).
• Restrict or object to certain processing activities.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at support@receptys.ai. We will respond within 30 days.

7. Cookies

We use session cookies required for authentication. We do not use tracking or advertising cookies. We use Vercel Web Analytics and Speed Insights, which are cookieless and do not identify individual visitors.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or an in-dashboard notice at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

9. Contact Us

For any privacy-related questions or requests, please contact:

10. Google API Services and Limited Use

Receptys.ai uses Google API Services to provide calendar-based appointment booking for our aesthetic clinic customers. When you connect your Google account, we request the following OAuth scopes:

• https://www.googleapis.com/auth/calendar.events.owned — to create, update, and delete appointment events on calendars the clinic or practitioner owns.
• https://www.googleapis.com/auth/calendar.freebusy — to see busy and free times only, with no event details, for availability checks.
• https://www.googleapis.com/auth/userinfo.email — to identify which Google account was connected.

How we use Google user data:

• We read calendar events only to determine which time slots are free when a patient requests an appointment.
• We create, update, and delete calendar events that we ourselves originate through bookings made via our AI assistant.
• We store OAuth access tokens, refresh tokens, the connected email address, and the calendar ID in our encrypted Supabase Postgres database (AES-256 at rest, TLS 1.2+ in transit).
• We do NOT copy, cache, or persist the contents of calendar events beyond the event IDs of events we ourselves create.

How we protect Google user data:

• We do NOT sell, rent, trade, or otherwise transfer Google user data to any third party for advertising or any other purpose.
• We do NOT use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.
• Access to production databases is strictly limited to authorised engineering personnel.
• Users may disconnect Google Calendar at any time from their dashboard. On disconnection, OAuth tokens are revoked and deleted from our systems within 24 hours.
• On account deletion, all associated Google user data is deleted within 30 days.

Compliance statement: Receptys.ai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (link: https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Contact: For data access, correction, or deletion requests related to Google user data, contact support@receptys.ai. We respond within 30 days.