Privacy Policy

1. Introduction

We provide an AI-powered sales workforce platform for premium clinics. Our services involve processing personal data of two main groups:

• Clinic Clients — businesses subscribing to our services;
• Patients of Clinic Clients — individuals who interact with AI agents deployed for our Clients (callers, ad lead respondents, dormant patient list members).

For Clinic Client data, we act as a Data Controller. For Patient data processed through our AI agents on behalf of Clinic Clients, we act as a Data Processor, while the Clinic Client remains the Data Controller.

2. Data We Collect

2.1 From Clinic Clients

• Business name, address, contact phone, email;
• Founder/owner name, designation, photograph (if provided);
• Billing information including payment method details (processed by our payment processor — we do not store complete card numbers);
• Communications you exchange with us (emails, support tickets, call recordings);
• Usage data on how you interact with our dashboard.

2.2 From Patients (on behalf of Clinic Clients)

• Phone number and call metadata (time, duration, source);
• Voice recordings of conversations with AI agents;
• Transcripts and AI-generated summaries of those conversations;
• Name, email, treatment interest, booking status, and other information shared during the call;
• Patient interaction history with the clinic (only data the clinic shares with us through CRM integration or upload).

2.3 Automatically Collected

• IP address, browser type, device information, operating system;
• Pages visited on agentlyai.in, time spent, referral source;
• Cookies and similar tracking technologies (see Section 11);
• Aggregated analytics on dashboard usage.

3. How We Use the Data

We use the data we collect for the following purposes:

• Service Delivery: Operating AI agents, processing calls, generating bookings, sending notifications, updating dashboards, providing customer support;
• AI Improvement (Clinic-Specific): Training our AI agents on each Clinic Client's specific treatments, scripts, and pricing to improve performance — this is done in isolated, client-specific contexts;
• Analytics & Reporting: Tracking key performance indicators, generating performance reports, calculating recovered revenue against targets;
• Communications: Sending service updates, billing notices, important policy changes, and relevant product information;
• Legal Compliance: Meeting regulatory obligations, responding to lawful requests, enforcing our Terms of Service;
• Service Improvement: Anonymized and aggregated data may be used to improve our underlying AI models and benchmarks.

4. Legal Basis for Processing

We process personal data on the following legal grounds:

• Contract: To perform our obligations under our service contract with Clinic Clients;
• Consent: Where you (or the Patient via the Clinic Client) have provided explicit consent for specific processing activities, such as call recording;
• Legitimate Interest: For service operation, security, fraud prevention, and limited service improvement, balanced against your rights;
• Legal Obligation: Where processing is necessary to comply with applicable law.

5. Patient Data — Special Protections

Patient data is sensitive. We apply additional protections:

• Clinic Client Responsibility: Clinic Clients are responsible for obtaining all necessary patient consents for call recording, data processing, and AI agent interactions, in compliance with applicable laws in their jurisdiction;
• No Marketing to Patients by Agently AI: We never use patient data for our own marketing or for cross-clinic outreach;
• Isolation Between Clients: Each Clinic Client's data is stored in logically isolated environments. Data from one Clinic Client is never used to train AI for another Clinic Client;
• Sensitive Health Data: Where conversations may touch on health information, we treat such data with elevated protections aligned to applicable health data laws;
• Data Residency Options: Clinic Clients on the Agently Dominate tier may request India-only or UAE-only data residency for additional compliance comfort.

6. Sharing of Data

We do not sell personal data. We share data only with the following categories of recipients:

6.1 Trusted Service Providers

We engage a limited number of vetted third-party service providers to enable service delivery — including voice infrastructure, cloud hosting, payment processing, calendar booking, communications platforms, and analytics. All service providers are bound by data processing agreements requiring confidentiality and security standards consistent with applicable law.

6.2 Clinic Clients (for Patient Data)

Patient data collected through AI agents is shared with the corresponding Clinic Client through dashboards, exports, and integrations, as that is the entire purpose of the service.

6.3 Legal & Regulatory

We may disclose personal data when required by law, court order, or government request, or to protect our legal rights, prevent fraud, or respond to emergency situations involving risk to life or safety.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of the business assets, with appropriate notice to affected individuals.

7. International Data Transfers

Agently AI is headquartered in India. Personal data may be transferred to, stored in, or processed in jurisdictions other than your own — particularly India, UAE, and the United States (for certain service providers).

Where personal data is transferred outside its country of origin, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses for EU/UK transfers;
• Contractual data protection requirements with all service providers;
• Compliance with cross-border transfer requirements under the DPDP Act, PDPL, and other applicable laws.

8. Data Retention

We retain personal data only as long as necessary to fulfill the purposes for which it was collected, plus any additional period required by applicable law.

Data Type	Retention Period
Call recordings & transcripts	12 months from call date (or as specified in your contract)
Patient lead records	Duration of Clinic Client contract + 90 days post-termination
Clinic Client account data	Duration of contract + 7 years (tax/legal compliance)
Billing & payment records	7 years from transaction (tax requirement)
Aggregated analytics	Indefinite (anonymized, no personal identifiers)
Web analytics & cookies	Up to 24 months

Upon termination of a Clinic Client contract, all Patient data is exported to the Clinic Client and then deleted from our systems within 90 days, except where retention is required by law.

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of Access: Request a copy of personal data we hold about you;
• Right of Correction: Request correction of inaccurate or incomplete data;
• Right of Erasure: Request deletion of your personal data, subject to legal retention requirements;
• Right to Restrict Processing: Request that we limit how we process your data in certain circumstances;
• Right to Data Portability: Receive your data in a structured, commonly used format;
• Right to Object: Object to processing based on legitimate interest or for direct marketing;
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent;
• Right to Lodge a Complaint: File a complaint with a data protection authority in your jurisdiction.

To exercise any of these rights, email hello@agentlyai.in with the subject line "Privacy Request." We will respond within 30 days.

For Patients of Clinic Clients: Direct your data rights requests to the relevant clinic (the Data Controller). We will support the clinic in fulfilling your request.

10. Security Measures

We implement reasonable technical and organizational measures to protect personal data, including:

• Encryption of data at rest and in transit (TLS 1.3, AES-256);
• Access controls with least-privilege principles;
• Multi-factor authentication for all internal accounts;
• Regular security audits and vulnerability assessments;
• Vendor security reviews before engaging service providers;
• Incident response procedures for data breaches.

In the event of a personal data breach affecting your data, we will notify you and applicable authorities within 72 hours of becoming aware of the breach, in line with DPDP, GDPR, and PDPL requirements.

11. Cookies & Tracking

We use cookies and similar technologies on agentlyai.in for:

• Essential cookies: Required for the website to function (always active);
• Analytics cookies: To understand how visitors use our website (Google Analytics or equivalent);
• Functional cookies: To remember your preferences;
• Marketing cookies (if applicable): To measure ad effectiveness, only with consent.

You can control cookies through your browser settings. Note that disabling certain cookies may affect website functionality.

12. Children's Privacy

Our services are intended for businesses and adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you become aware that a minor's data has been provided to us without verifiable parental consent, please contact us so we can take appropriate action.

13. Jurisdiction-Specific Notices

13.1 India (DPDP Act, 2023)

For data processed under the Digital Personal Data Protection Act, 2023, we comply with notice, consent, purpose limitation, data minimization, accuracy, storage limitation, security, and accountability principles. Indian residents have rights of access, correction, erasure, grievance redressal, and nomination as defined under the Act.

13.2 European Union & United Kingdom (GDPR / UK GDPR)

For data subjects in the EU/UK, you have the rights described in Section 9 above. Our representative for GDPR purposes can be contacted at hello@agentlyai.in. You also have the right to lodge a complaint with your local supervisory authority.

13.3 United Arab Emirates (PDPL)

For data subjects in the UAE, processing of personal data complies with Federal Decree-Law No. 45 of 2021 (PDPL). UAE residents have the rights enumerated in Section 9 and may contact the UAE Data Office for complaints.

13.4 United States (CCPA / State Privacy Laws)

For California residents, you have additional rights under the California Consumer Privacy Act, including the right to know, the right to delete, the right to opt out of sale (we do not sell personal data), and the right to non-discrimination for exercising your rights.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or prominent notice on the website at least 30 days before they take effect. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

15. Contact & Grievance Officer

For questions, concerns, or requests related to this Privacy Policy or your personal data:

Agently AI · Affluent Marketing
Email: hello@agentlyai.in
Subject line: "Privacy Request" or "Grievance"
Grievance Officer: Bipin Bopanna (Founder)
Response time: Within 30 days

This Privacy Policy works together with our Terms of Service. By using Agently AI, you acknowledge that you have read and understood this Privacy Policy.