Privacy Policy

1. Who is responsible for your data

• Shifo is the controller of the data you submit through our website (demo requests and clinic sign-up) and of clinic staff accounts.
• The clinic is the controller of the data it processes in the Services, including WhatsApp and Instagram conversations. Shifo processes this data on the clinic’s behalf and only to provide the Services. If you are a patient, please contact your clinic with any questions about your data.

2. Data we collect

Website and sign-up

• Contact details you enter in the demo request or sign-up form: name, clinic name, phone number, email and comment, as well as your consent to this Policy.
• How you found us: UTM tags and ad click identifiers from the link you followed.
• Technical data: IP address, device and browser type, pages viewed and actions on the site.

Clinic accounts

• Names, phone numbers, emails and roles of clinic staff, as well as sign-in and activity logs.

Data clinics process in Shifo

• Patient profiles, appointments, medical records, payments and other information the clinic enters. This may include health data.

WhatsApp and Instagram data

When a clinic connects its WhatsApp Business account or Instagram professional account through Meta’s official login, we receive:

• About the connected account: account and phone number IDs, display name, username, profile picture and the access tokens needed to work with the account.
• About people who message the clinic: the messages and attachments they send (text, photos, voice messages, documents), their name or username, profile picture where available, WhatsApp phone number or Instagram-scoped ID, as well as message times and delivery and read statuses.

We access this data only through the permissions the clinic grants when connecting: whatsapp_business_messaging, whatsapp_business_management, instagram_business_basic and instagram_business_manage_messages.

3. How we use data

• To provide the Services: show the clinic’s WhatsApp and Instagram conversations in the Shifo inbox and let clinic staff reply to messages and book appointments.
• To process demo requests and sign-ups and to contact you about them.
• To provide support, keep the Services secure and prevent abuse.
• To comply with legal obligations.
• To improve the Services using aggregated or de-identified data.

4. How we handle WhatsApp and Instagram data

• We use it only to provide the Services to the clinic that connected the account.
• We do not sell, rent or license it and do not share it with data brokers.
• We do not use it for advertising, to build profiles of people, or to make decisions about anyone’s eligibility for employment, housing, credit, insurance or healthcare.
• Only authorized clinic staff and the Shifo personnel who need it to operate and support the Services can access it.
• We process it in line with the Meta Platform Terms, Meta Developer Policies, WhatsApp Business policies and Instagram policies.

5. Legal basis

We process personal data in accordance with the personal data protection laws of the Republic of Tajikistan, on the basis of your consent, our contract with the clinic, our legal obligations and our legitimate interest in keeping the Services secure and working well. You may withdraw your consent at any time by writing to us. Clinics are responsible for having a lawful basis, including patient consent where required, for messaging their patients.

6. Who we share data with

• The clinic the data belongs to.
• Service providers that help us run the Services (hosting and data storage, messaging integrations, SMS and notification delivery, analytics) under confidentiality obligations and only to the extent necessary.
• Meta Platforms (WhatsApp and Instagram): messages sent by a clinic are delivered through Meta’s services and processed under Meta’s own terms and privacy policies.
• Public authorities, when the law requires it.

We do not sell personal data.

7. Cookies and analytics

Our website uses cookies and similar technologies, such as browser local storage, to work properly and to measure visits. We keep information about how you arrived at the site (UTM tags) in your browser for up to 30 days and attach it to your clinic sign-up. We may use analytics and advertising tools such as Google Analytics, Yandex Metrica and Meta Pixel. You can block or delete cookies in your browser settings, but some features may then not work correctly.

8. Storage and security

We protect data with encryption in transit (TLS), encrypted storage of the access tokens of connected accounts, role-based access control, activity logging and regular backups. Data may be processed on servers outside your country; the same safeguards apply wherever it is processed.

9. How long we keep data

• Website requests: as long as needed to handle the request and maintain our relationship, or until you withdraw your consent.
• Clinic data, including WhatsApp and Instagram conversations: while the clinic’s account is active, unless the clinic deletes it earlier. After the account is closed, we delete or anonymize the data within 30 days, unless the law requires us to keep it longer.
• Access tokens of a connected account: deleted as soon as the clinic disconnects the account or closes its Shifo account.

10. How to delete your data

If you messaged a clinic on WhatsApp or Instagram

Ask the clinic to delete your conversation, or email us at info@shifo.life with the subject “Data deletion request” and include your WhatsApp number or Instagram username and the name of the clinic. We will verify the request, delete the data or pass the request on to the clinic, and confirm by email within 30 days.

If you are a clinic

• Delete conversations and patient records directly in Shifo.
• Disconnect a WhatsApp or Instagram account in the channel settings: we stop receiving its messages and delete its access tokens.
• To delete your clinic account and all of its data, email us at info@shifo.life.

You can also remove Shifo’s access at any time in your Instagram settings or your Meta Business settings.

11. Your rights

You have the right to access, correct and delete your personal data, to restrict or object to its processing, and to withdraw your consent. To exercise these rights, contact us using the details below. If your data is processed by a clinic, we will forward your request to that clinic.

12. Children

The Services are intended for clinics and their staff and are not directed at children. Information about patients who are minors is entered and managed by clinics as data controllers.

13. Changes to this Policy

We may update this Policy from time to time. The current version is always published on this page with the date of the last update. We will notify clinics of material changes by email or in the Services.