Privacy Policy
Last updated: August 10, 2026
1. Introduction
Magebytes Technologies ("we", "us", or "our") operates the Medolane AI Patient Intake Assistant platform ("Medolane", "Service"). This Privacy Policy describes how we collect, use, and share information when you use our Service as a clinic or when your patients interact with the Medolane widget.
2. Information We Collect
2.1 Clinic Account Data
- Name, email address, and password (hashed)
- Clinic/practice details
- Billing information (processed by Stripe — we do not store card numbers)
- Agent configuration settings
2.2 Patient Session Data
- Chat messages exchanged with the Medolane widget, including a patient's own description of their concern or symptoms
- Appointment requests (preferred date/time and reason provided by the patient)
- Medication refill requests (medication and quantity, as entered by the patient)
- Session identifiers (anonymous UUID, stored in browser cookies)
- Patient name and contact details, if voluntarily provided
2.3 Usage & Technical Data
- API request logs (IP address, timestamps, response times)
- Error and performance traces via Sentry
- Widget impression and engagement counts
3. How We Use Information
- To operate and improve the Medolane platform and widget
- To generate AI responses using OpenAI (see Section 5)
- To send transactional emails (escalation alerts, password reset, account updates)
- To enforce usage quotas and billing plans
- To detect abuse and maintain platform security
- To produce anonymised, aggregated analytics for product improvements
4. Data Retention
Chat sessions are retained for 90 days by default and then automatically deleted. Clinic account data is retained for the lifetime of the account and for 30 days after account closure. You may request earlier deletion by contacting privacy@magebytes.com.
5. Third-Party Services
| Provider | Purpose | Data Shared |
|---|---|---|
| OpenAI | AI response generation | Chat messages, triage context |
| Sentry | Error monitoring | Stack traces, request metadata |
| Stripe | Payment processing (clinic billing) | Billing details |
| Google Calendar | Appointment booking (if connected by the clinic) | Patient name, requested date/time, reason |
| Razorpay | Refill payment link (if enabled by the clinic) | Patient contact details, order amount |
| Brevo | Transactional email | Clinic/patient email address |
| HubSpot | CRM sync (if connected by the clinic) | Contact details, conversation notes |
| Twilio / Meta WhatsApp | WhatsApp channel (if enabled by the clinic) | Chat messages, phone number |
6. Health Information Disclaimer
Medolane is an intake and scheduling aid, not a medical device, and it does not provide medical advice, diagnosis, or treatment. Any information a patient shares in the chat widget about their symptoms or condition is used only to route the conversation to the right department and to prepare the appointment or refill request your clinic staff will review — it is not used for any other purpose and is not sold or shared with advertisers.
Medolane does not currently integrate with any electronic health record (EHR) system. Booking and refill requests are handed off to your clinic's own staff and systems for confirmation.
7. Cookies
The Medolane widget sets a first-party session cookie (relay_session_<id>) scoped to the clinic's domain to maintain conversation continuity across page loads. No cross-site tracking cookies are used.
8. Your Rights
Depending on your jurisdiction you may have the right to access, correct, delete, or port your data, and to object to or restrict processing. To exercise any of these rights, contact privacy@magebytes.com.
For patients whose data is processed on behalf of a clinic, please contact the clinic directly. We will assist clinics in responding to such requests.
9. Security
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Platform credentials (API keys, access tokens) are encrypted at the field level before storage. Access to production systems is restricted to authorised personnel with MFA.
10. Changes to This Policy
We may update this policy from time to time. We will notify active clinics by email at least 14 days before material changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.
11. Contact
Magebytes Technologies
Privacy Officer: privacy@magebytes.com
Support: support@magebytes.com