Privacy Policy

This policy describes information handled by CytoWorld AI through our public website, business accounts and enabled services. It covers business representatives, authorized team members, and people who contact a business using our service.

For account administration, enquiries and service security, we handle information to operate our service. For a clinic’s patient calls, appointments and business records, the clinic determines the purposes of its service and we process information under the service arrangements with that clinic. This policy does not replace the clinic’s own privacy notice.

The information involved depends on the features enabled for your business and what you or a caller provides. It may include:

• Account and business details: names, email addresses, roles, store information, configuration and support correspondence.
• Call and message details: telephone numbers, call times, messages, AI summaries, transcripts and, where recording is enabled and properly disclosed, audio recordings.
• Scheduling information: doctor names, consultation methods, schedules, appointment requests and their processing status. Information a caller volunteers may include health-related details.
• Connected-calendar information: authorization credentials, calendar identifiers, names, timezones, access permissions, busy intervals and event details needed for the enabled calendar functions.
• Technical information: IP addresses, browser or device details, session information, access logs and diagnostic records needed to operate and protect the service.

We use information to provide the features a business has enabled: answering calls, handling enquiries and messages, managing appointment requests, presenting authorized records, and connecting calendars. We also use necessary information to administer accounts and permissions, provide support, investigate faults or misuse, and meet applicable obligations.

A call summary or transcript can contain errors. Businesses should verify important details before relying on them. People contacting a clinic should provide only the information needed for their enquiry and follow the clinic’s instructions for sensitive information.

AI reception, transcription, summaries and call recording depend on the business’s enabled services and configuration. Callers should receive an appropriate notice about AI reception and any recording or processing. A recording notice is not a promise that all records share one retention period.

If you do not wish to continue a recorded or AI-handled call, follow the call’s instructions to contact the business through an available staff channel. Do not use an AI receptionist for an emergency; call 911 in Canada or your local emergency number.

Information is made available to the relevant business and its authorized team according to their access rights. We use service providers for hosting, account authentication, telephony, speech and AI processing, and calendar services. Depending on enabled functions, these can include Clerk, Twilio, ElevenLabs and Google, together with the infrastructure and AI providers involved in delivering those functions.

Only information needed for the relevant purpose should be shared. Information may also be disclosed where required by applicable law or necessary to address fraud, abuse or security incidents. Google API data remains subject to the specific restrictions described above.

Retention depends on the type of record, the business’s instructions, the active provider settings, service arrangements and applicable obligations. There is no single retention period stated here for every data type. Please ask the business or contact us about the settings and arrangements relevant to a particular record.

Recordings, transcripts, CRM records, messages, appointments and backups can be stored separately. Changing a provider’s retention setting, disconnecting Google, removing a team member or ending a service does not automatically erase all copies or related records.

For a deletion request, we first verify the requester’s identity and authority and assess the records involved. We will explain the available action, timing and any information that must remain for legal, security or operational reasons. Removal from backups may follow a different lifecycle from active systems.

We use technical and organizational safeguards appropriate to the information involved, including authenticated access, role and location permissions, encrypted storage of Google authorization credentials, and protected network connections. Access to sensitive records is governed by the business’s permissions and configuration. No system can guarantee complete security.

Account holders should keep credentials secure, grant access only to appropriate team members and notify us promptly of suspected unauthorized access.

Our business and service providers may process information in Canada and other countries. Applicable laws and access rules can differ between jurisdictions. This policy does not promise that every copy is stored only in Canada. If your organization requires a particular processing location, confirm a suitable service arrangement before providing the information.

You may ask about access, correction, available export or deletion arrangements, or raise a privacy concern. For patient information held for a clinic, contact the clinic first; we can assist under the clinic’s instructions and applicable requirements. We may need to verify identity and authority before acting.

Business accounts are intended for authorized representatives. A clinic may handle information about patients of different ages, including through a parent or authorized representative, under its own responsibilities and privacy arrangements.

Necessary cookies and browser storage can support sign-in, session security and language preferences. Your browser provides controls for these technologies; blocking them may affect the relevant functions.

This policy takes effect on the date shown above. We will communicate material changes where appropriate. If a new use of Google data requires consent, we must obtain that consent before starting the new use.

For privacy questions, contact CytoWorld AI using the email below. To help protect your information, do not include passwords, verification codes, full medical records or other unnecessary sensitive details in an initial email.