Privacy Policy

Clinmero is operated by PT Mbalas Teknologi Indonesia, a company established in Indonesia and based in Tanjungpinang, Kepulauan Riau, Indonesia. In this policy, “Clinmero”, “we” and “us” mean PT Mbalas Teknologi Indonesia.

“Clinic” means the dental or aesthetic practice that holds a Clinmero account. “Patient” means a person who messages a clinic through WhatsApp, or whose details a clinic records in Clinmero.

Clinmero handles two different kinds of information, and our legal responsibility differs between them. Getting this distinction right matters more than any other part of this policy.

Information about the clinic and its staff

Account details, clinic configuration, subscription and billing records, and technical logs. We decide how this information is used, so we are responsible for it as a controller.

Information about patients

WhatsApp conversations, contact records, appointments, follow-ups and anything the clinic enters or imports. The clinic decides what to collect, why, and how long to keep it. The clinic is the controller; we process this information on the clinic's instructions as its service provider.

We do not decide what patient information a clinic collects, and we do not use patient conversations for our own purposes. If you are a patient with a question about your information, the clinic you messaged is the right first point of contact — see section 19.

• Account information: name and email address of each person who signs in, and their role within the clinic.
• Clinic information: clinic name, type (dental or aesthetic), city, country, timezone, website, address and opening hours.
• Configuration: how the clinic has set up its AI receptionist, including tone, greeting, handover rules and whether the AI receptionist is switched on.
• Notification preferences: an optional email address and WhatsApp number the clinic gives us for account notices. These are separate from the number patients message.
• Subscription information: plan, currency, billing period, usage against the AI message allowance, and the status of the subscription.

Clinics record and import information through Clinmero. This may include:

• Contact records: name, WhatsApp number, phone number and the language a patient writes in.
• Appointments: requested and confirmed times, the service and practitioner involved, and status.
• Follow-ups and reminders: scheduled messages and their outcome.
• Notes a clinic chooses to enter, and files it uploads to its knowledge base.

Clinics decide what goes into these fields. Clinmero does not require clinical notes, diagnoses, treatment records or identity documents, and we ask clinics not to put them into Clinmero unless they have a lawful basis and have satisfied their own obligations for handling that information.

When a patient messages a clinic's connected WhatsApp number, Clinmero receives and stores the message content, the WhatsApp identifier of the sender, timestamps, delivery status, and any reply generated by the AI receptionist or sent by clinic staff. Whatever a patient writes is stored — so if a patient volunteers health information in a message, that message is stored with it.

Messages travel over the WhatsApp Business Platform operated by Meta. Meta handles those messages under its own terms and privacy notices. We do not control WhatsApp or Meta's infrastructure.

Health information is treated as specific personal data under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and as special category data under the GDPR where it applies. Clinics using Clinmero for conversations that may touch a patient's health are responsible for having a valid basis for that, and for giving patients whatever notice or consent their own law requires.

• Sign-in and session information needed to keep a user logged in securely.
• Server logs recording requests, errors and the outcome of background jobs. These include identifiers such as a clinic id and, where relevant, a message or subscription id. We keep message content out of error logs by design.
• An approximate country, derived from the network your browser connects from, used to choose a starting language and billing currency. We do not store your IP address for this purpose or build a location profile from it.

We do not use analytics, advertising or behavioural tracking tools in Clinmero. There is no Google Analytics, no advertising pixel and no session-replay tool in the product.

We do not collect or store card numbers. Payment details are entered directly with our payment providers, and we receive only what we need to run the subscription: the plan, currency, amount, subscription status, billing dates, and the provider's own reference identifiers.

Dodo Payments (USD and international)

Dodo Payments acts as Merchant of Record and is the legal seller of the subscription to the customer. It handles payment processing, applicable sales tax and VAT, fraud screening and chargebacks under its own terms.

Mayar (IDR and Indonesia)

Mayar processes subscription payments for customers billed in Indonesian rupiah, under its own terms and privacy notice.

• To provide the service: receiving and answering patient messages, scheduling follow-ups and reminders, recording appointments, and showing everything to clinic staff in the dashboard.
• To run subscriptions: measuring outbound AI messages against the plan allowance, processing payments, and managing trials, renewals and cancellations.
• To keep the service working and secure: monitoring failures, investigating incidents, and preventing abuse.
• To support clinics: responding to questions and, where necessary, looking into a specific problem on a clinic's account.
• To meet legal, tax and accounting obligations.

We do not sell information, we do not use patient conversations for advertising, and we do not use a clinic's patient data to train AI models.

When a patient message arrives and the clinic's AI receptionist is switched on, the message and relevant material from the clinic's own knowledge base are sent to an AI model to produce a suggested reply. That reply is then sent to the patient through WhatsApp and stored in the clinic's conversation history.

This processing runs in an automation layer operated by us, which in turn calls an external AI model provider. Clinmero itself holds no AI provider credentials; the orchestration layer is where models are called, which means the specific model provider can change as the service is improved.

AI-generated replies can be wrong, incomplete or inappropriate for a particular patient. Clinmero does not provide medical advice, diagnosis or treatment, and the AI receptionist is not a clinician. Clinics are responsible for how their AI receptionist is configured and for stepping in where a human should answer. The AI receptionist can be switched off at any time in Settings.

Clinics build a knowledge base so the AI receptionist can answer from accurate information: services and prices, opening hours, practitioners, and answers to common questions. Clinics can add this material by hand, import it from their own website, or upload documents (PDF, Word or plain text, up to 15 MB each).

Uploaded documents are stored in a private location that only members of the uploading clinic can read. They are processed to extract text so the AI receptionist can use it.

Please do not upload patient records, clinical notes or identity documents. The knowledge base exists to describe the clinic and its services, not to store information about individuals, and it is not built to hold clinical records.

Clinmero works on top of the official WhatsApp Business Platform. Clinmero is an independent service built by PT Mbalas Teknologi Indonesia; we are not affiliated with, endorsed by, or acting on behalf of Meta, and we do not own or operate WhatsApp.

A clinic's use of WhatsApp is also governed by Meta's own terms and policies, including its rules on business messaging. Clinics are responsible for meeting those rules, including any requirement to obtain a patient's agreement before messaging them.

We cannot guarantee the availability of WhatsApp, Meta, our payment providers or AI providers. If one of them is unavailable or changes how it works, parts of Clinmero may stop working until it is resolved.

We share information only in these situations:

• With the clinic that owns the account. Staff see the information belonging to their own clinic and no other.
• With the service providers listed in section 13, so they can perform the functions described there.
• Where the law requires it, such as a valid legal request, or to establish, exercise or defend legal claims.
• In connection with a merger, acquisition or sale of assets, in which case we would give notice before information became subject to a different privacy policy.

Each clinic's information is separated in our database, and that separation is enforced by the database itself rather than only by application code.

These are the providers involved in running Clinmero today. Each processes information only as needed for the function shown.

Supabase

Database, authentication, file storage and transactional sign-in emails. Clinmero's database is hosted in Singapore.

Vercel

Application hosting and server logs.

Meta Platforms (WhatsApp Business Platform)

Delivery of messages to and from patients on WhatsApp.

AI automation layer and AI model provider

Generating suggested replies, detecting follow-ups, and importing knowledge from a clinic's website or uploaded files. This layer is operated by us; it calls an external AI model provider.

Dodo Payments

Subscription payments for customers billed in USD, as Merchant of Record.

Mayar

Subscription payments for customers billed in Indonesian rupiah.

If we add or replace a provider that handles patient information, we will update this list. Clinics that need advance notice of changes should ask us about a data processing agreement (see section 18).

Clinmero is operated from Indonesia, and its database is hosted in Singapore. Our hosting, messaging, AI and payment providers operate internationally, so information may be processed outside the country where a clinic or patient is located.

Where a transfer is subject to Indonesian, European or UK data protection law, we rely on the transfer mechanisms available under that law. Clinics with specific transfer requirements should raise them with us before putting patient information into Clinmero.

We keep information for as long as it is needed for the purposes described in this policy, and then for as long as we are required to keep it for legal, tax or accounting reasons. In practice:

• Conversations, contacts, appointments and follow-ups are kept while the clinic's account is active, because the clinic needs its own patient history. There is no automatic deletion schedule for this information today.
• Knowledge base content stays until the clinic changes or removes it.
• Uploaded documents are retained after import; they are not deleted automatically.
• Subscription and payment records are kept for the periods required by Indonesian tax and accounting law, which outlast the account itself.
• Server logs are kept for a limited period for troubleshooting and security.

We would rather tell you this plainly than publish a number we do not yet enforce: Clinmero does not currently run an automated purge of conversation history or uploaded documents. If a clinic needs a specific retention period, or needs information deleted, contact us and we will action it.

• Information is separated per clinic and enforced at the database level, so one clinic's session cannot read another's records.
• Access to the dashboard requires a verified account, and permissions differ by role: changing what the AI knows and how the clinic is configured is restricted to owners and administrators.
• Connections to Clinmero are encrypted in transit. Information is encrypted at rest by our hosting and database providers.
• WhatsApp access credentials are held by the messaging integration rather than stored as readable values in the clinic-facing part of our database.
• Card details never reach our systems.

No service can promise perfect security, and we do not claim to hold ISO 27001, SOC 2, HIPAA or similar certifications. We describe here what we actually do.

Depending on where you live, you may have the right to ask for access to your personal data, correction of it, deletion of it, restriction of how it is used, a copy in portable form, or to object to certain processing. You may also withdraw consent where processing relies on consent.

Clinic staff can exercise these rights over their own account information by contacting us. Patients should contact the clinic they messaged — see section 19.

If you believe we have not handled your information properly, you may complain to your data protection authority. In Indonesia, personal data protection is governed by Law No. 27 of 2022.

If you are a clinic using Clinmero, you are responsible for:

• Having a lawful basis for the patient information you put into Clinmero or cause Clinmero to process, and giving patients whatever notice or consent your own law requires.
• Meeting WhatsApp's and Meta's rules for messaging patients, including any consent needed before you message someone.
• Deciding what information belongs in Clinmero, and keeping clinical records in the systems built for them.
• Reviewing how your AI receptionist is configured, and what it tells patients about your services, prices, availability and policies.
• Managing who on your team has access, and removing people who leave.
• Responding to requests from your own patients about their information.

If your own obligations require a written data processing agreement with us — for example under the GDPR or UK GDPR — contact us and we will put one in place. A public privacy policy is not a substitute for that agreement, and we are not treating it as one. We do not currently offer a HIPAA Business Associate Agreement, so Clinmero should not be used for information subject to HIPAA.

If you messaged a clinic on WhatsApp and want to know what it holds about you, have it corrected, or have it deleted, please contact that clinic directly. The clinic decides what to keep and is the right party to answer you.

You can also contact us and we will pass your request to the clinic and help them act on it. We will not delete or change a clinic's patient records on our own initiative, because doing so could remove information the clinic is required to keep.

Clinmero's dashboard is for clinic staff, and accounts are not intended for anyone under 18.

Patient information is different, and we will not pretend otherwise: dental clinics treat children, so a clinic's conversations and contact records may relate to a minor, and a parent or guardian may be the one messaging. Indonesia's Personal Data Protection Law treats a child's data as specific personal data requiring stricter handling, and other laws set their own rules.

Clinics are responsible for handling children's information lawfully, including obtaining consent from a parent or guardian where that is required.

Clinmero uses only the cookies it needs to work:

Authentication cookies

Set when you sign in, so you stay signed in securely and your session can be refreshed. Clearing them signs you out.

Language preference

Remembers whether you are viewing Clinmero in English or Indonesian. It holds a language code and nothing else.

We do not use advertising cookies, analytics cookies, or tracking pixels, and we do not share cookie data with advertising networks. Because these cookies are strictly necessary or store only a display preference, Clinmero does not show a consent banner.

We may update this policy as the product changes. When we make a material change, we will update the date at the top of this page and, for changes that affect how patient information is handled, notify clinic account owners.

For questions about this policy, or to exercise your rights, contact us:

• PT Mbalas Teknologi Indonesia
• Tanjungpinang, Kepulauan Riau, Indonesia
• support@clinmero.com
• +62 813-6118-7767

Clinics can also raise any of this with us from inside the dashboard.