Privacy notice

What personal data Mediora handles, why, and who it's shared with. Written to be read, not skimmed past.

Last updated: Draft, November 2026

Draft — pending legal review

This is a plain-language draft. It has not yet been reviewed by a lawyer and may change before Mediora is generally available. If you need a signed agreement for your clinic, contact us.

Who we are and our role

Mediora provides software that clinics use to run their front desk: a WhatsApp inbox, appointments, patient records, clinical notes and an optional AI assistant.

For patient data, the clinic decides what is collected and why. The clinic is responsible for that data (in many laws, the “controller”), and Mediora processes it on the clinic’s behalf and on its instructions (the “processor”). For clinic account data and for this website, Mediora decides how data is used.

What we collect

  • Account details for clinic owners and staff: name, email address, phone number, role, and a password stored only as a one-way hash.
  • Clinic details: name, address, contact numbers, timezone, opening hours, services and prices.
  • Activity records: an audit log of changes made in the product, including who made them, when, their IP address and browser. Clinical content is not copied into the audit log.
  • WhatsApp connection details for your clinic’s WhatsApp Business account. Access tokens are encrypted at rest.
  • Messages you send us through the contact or demo forms on this website.

Patient data

Clinics may store the following about their patients in Mediora:

  • Phone number (required), name, email, date of birth, gender, address and city, and front-desk notes.
  • Appointments, including the service, doctor, time and status.
  • WhatsApp conversations between the patient and the clinic.
  • Clinical notes and prescriptions written by the clinic’s doctors. These are visible only to doctors and the clinic owner, never to receptionists, and never to the AI assistant.

A patient record is created automatically when someone first messages the clinic on WhatsApp. Patients who want to access or correct their information should contact their clinic, which can do this in Mediora. We will help clinics respond to these requests.

WhatsApp messages and media

Mediora connects to the WhatsApp Business Platform operated by Meta, using the clinic’s own WhatsApp Business account. Messages pass through Meta’s systems under Meta’s terms. Mediora stores the text of messages so the clinic’s team can see the conversation.

Photos, voice notes, videos and documents are not stored by Mediora. They are fetched from Meta when a staff member opens them. Meta deletes media after 30 days.

The AI assistant

If a clinic switches the assistant on, incoming patient messages, recent conversation history and the clinic’s services, prices, doctors, opening hours and knowledge entries are sent to an AI model provider to generate a reply. Providers we may use include Anthropic, Google, OpenRouter, Groq and other providers with a compatible interface.

The assistant is technically unable to read clinical notes or prescriptions. We record each assistant turn, including the outcome, the tools it used and the processing time, so the clinic can review what it did.

This website

This website does not use advertising or analytics cookies. It stores two preferences in your browser’s local storage: the region you chose (which sets the currency) and whether sound effects are on. A setup checklist may also remember which steps you ticked. None of this is sent to us.

If you use the contact or demo form, we receive what you type and your browser’s user-agent string, and use it only to reply to you.

Who we share data with

  • Meta, to send and receive WhatsApp messages for the clinic.
  • AI model providers, only when a clinic has the assistant switched on, as described above.
  • Hosting and infrastructure providers that run the service. We will publish the list of these providers, and where data is stored, before general availability.
  • Authorities, only where the law requires it.

We do not sell personal data, and we do not use patient data to advertise.

How we protect data

Each clinic’s data is separated by row-level security in the database, enforced on every table. Passwords are hashed with Argon2id, WhatsApp access tokens are encrypted with AES-256-GCM, and staff access can be suspended immediately. Our security page describes these measures, and the ones we haven’t completed yet, in more detail. We have not yet completed a formal compliance certification.

How long we keep data

Inside the product, staff, services and patients are archived rather than deleted, so that appointment history, clinical records and reports stay accurate for the clinic. The audit log cannot be edited or deleted. When a clinic leaves Mediora, we will agree with them how their data is returned and when it is deleted from our systems.

Messages sent through this website’s forms are kept for as long as we need them to reply and follow up.

Your rights

Depending on where you live, you may have rights to access, correct, delete or restrict the use of your personal data, and to complain to a data protection authority. Patients should contact their clinic first. Clinic staff and website visitors can contact us directly.

Contact

Questions about this notice: hello@mediora.app. Security concerns: security@mediora.app.