Privacy Policy

For account and clinic-configuration data, AIrila ([Legal name], [Tax ID], Madrid, España) acts as the data controller. For patient data collected in a conversation (name, phone, treatment of interest, messages), the clinic using AIrila is the data controller, and AIrila acts as data processor on its behalf.

Depending on how the service is used, we may process:

• Client clinic data: name, contact details, dashboard login credentials, configured services, pricing, hours and FAQs.
• Patient or website visitor data: name, phone, email, treatment of interest, preferred date and the content of the conversation with the AI receptionist.
• Appointment data: date, time, service and booking status, synced with the clinic's calendar.
• Technical data: IP address and session identifiers, used in a limited way to prevent abuse of the service (e.g. request rate limiting).

• Responding to inquiries made during the conversation.
• Checking availability and booking appointments on the clinic's calendar.
• Saving the lead and conversation history to the clinic's dashboard.
• Sending the clinic notifications about new leads or appointments.
• Maintaining and improving the service's operation and security.

We process patient data based on the consent given when starting a conversation with the receptionist or submitting the contact form, and on the clinic's legitimate interest in managing its inquiries and appointments. Client clinic data is processed for the performance of the service agreement.

We do not sell personal data. To provide the service, we work with external providers that process data on our behalf, including:

• Supabase — database hosting and authentication.
• OpenAI— generating the AI receptionist's replies.
• Google Calendar — syncing appointments with the clinic's calendar.
• Resend — sending email notifications.
• Meta (WhatsApp / Instagram) — only if the clinic enables integration with these channels.

These providers only access the data necessary to provide their service and are subject to their own privacy policies and data processing agreements.

Some of the providers above may process data outside the European Economic Area. In those cases, we rely on the safeguards those providers offer for international data transfers (such as standard contractual clauses).

We retain conversation, lead and appointment data for as long as the clinic keeps its account active, or for the period the clinic itself configures. Once the relationship ends, data is deleted or anonymized within a reasonable period, unless we are legally required to retain it for longer.

If you're a patient of a clinic using AIrila, you can exercise your rights of access, rectification, erasure, objection, restriction and portability by contacting the relevant clinic directly, as the controller of your data. If you're a client clinic, you can exercise these rights over your account data by writing to us at hello@airila.es.

Access to each clinic's admin dashboard requires authentication, and each clinic's data is kept separate from the rest. We apply reasonable technical and organizational measures to protect data against unauthorized access, loss or alteration, although no system can guarantee absolute security.

AIrila is not directed at minors. If a clinic treats patients who are minors, it is responsible for obtaining the necessary consent from their legal guardians before sharing data through the AI receptionist.

AIrila's website uses technical cookies necessary for it to function. If we add analytics or third-party cookies in the future, we will disclose this in a dedicated cookie policy and request your consent where required.

We may update this policy to reflect changes in the service or in applicable regulations. We will publish any relevant change on this same page along with the last-updated date.

For any question about this policy or how we handle your data, write to us at hello@airila.es.