Privacy Policy

1. Who We Are and Scope

This Privacy Policy explains how Deepkern ("Deepkern", "we", "us" or "our"), located at 108, Block C, Canal Garden, Lahore, Pakistan, collects, uses, shares and protects personal data. It applies to our website deepkern.com, our software applications (including our WhatsApp-based clinic management software) and the related services we provide to businesses (together, the "Services").

Deepkern builds AI and messaging integrations for businesses. This includes applications built on the WhatsApp Business Platform (Cloud API) provided by Meta Platforms, Inc. and its affiliates ("Meta"), such as a multi-user clinic management SaaS that sends appointment reminders and lets clinics message patients on WhatsApp.

Our two roles

• As a data controller: we decide how and why personal data is processed for our own website visitors, people who contact us, and the account and contact details of the businesses that use our Services ("Clients").
• As a data processor / service provider: when a Client (for example, a clinic) uses our Services to message its own customers or patients on WhatsApp, or to manage appointments, we process that data on the Client's behalf and only on its instructions. In that case the Client is the controller and its own privacy policy governs how that data is used. If you are a patient or customer of one of our Clients, please contact that business first; we will help them respond to your request.

2. Information We Collect

a. Information you give us directly

• Contact and enquiry data: your name, email address, phone number, company name and the content of your message when you use our contact form, email us, call us, or message us on WhatsApp.
• Meeting and booking data: your name, email address, time zone and chosen time slot when you book a call with us, including through the AI assistant on our website. We may send a one-time verification code to your email to confirm bookings.
• Client business account information: business name, business address, contact person details, the names, email addresses, phone numbers and roles of users the Client adds to its account, login credentials (passwords are stored only in hashed form), account settings, and billing and invoicing details.

b. Information we receive from Meta and the WhatsApp Business Platform

When a Client connects its WhatsApp Business Account to our Services using Meta's Embedded Signup (Facebook Login for Business), and while the Client uses our Services, we receive the following through Meta's APIs:

• Account and asset identifiers: Meta Business portfolio ID, WhatsApp Business Account (WABA) ID, phone number ID, the business's WhatsApp phone number, display name and verified-name status, phone number quality rating and messaging limits, and message template names, content and approval status.
• Access tokens and permissions: the access token and permission scopes the Client grants us (for example whatsapp_business_management and whatsapp_business_messaging), and the basic Facebook profile information (name and app-scoped user ID) of the person who completes the signup.
• WhatsApp phone numbers: the WhatsApp phone numbers of the Client's customers or patients who message the Client or receive messages from it, and the WhatsApp profile name those users have set.
• Message content: the content of messages sent and received through the Client's WhatsApp number using our Services, including text, media (images, documents, audio, video), locations, contacts, button and list replies, and template variables.
• Message metadata: message IDs, timestamps, sender and recipient numbers, delivery, read and failure statuses, error codes, conversation and pricing category, and webhook event data.

c. Appointment and clinic data (processed for Clients)

• Patient or customer name, phone number, appointment date and time, assigned doctor or department, appointment status (booked, confirmed, rescheduled, cancelled), reminder schedule and delivery status, and any notes the Client adds.
• Where a clinic uses the full clinic management features of our software, it may also store patient records such as visit history, vitals, consultation notes and prescriptions. This information can be sensitive (health) data. We process it only on the clinic's instructions, and it is not sent over WhatsApp unless the clinic chooses to send it.

d. Information collected automatically

• Technical and log data: IP address, browser type, device and operating system, pages visited, referring URL, and the date and time of requests. We keep these in server and security logs.
• Cookies and similar technologies: our website and applications use only cookies and local storage that are needed to make them work, such as keeping you signed in and remembering your preferences. We do not use advertising or cross-site tracking cookies.

3. How We Use Information

We use personal data only for the following purposes:

• To provide the Services: creating and managing Client accounts; connecting a Client's WhatsApp Business Account through Embedded Signup; registering phone numbers and subscribing to webhooks; sending and receiving WhatsApp messages on the Client's behalf; sending appointment confirmations and reminders; and showing conversation history to the Client's authorised users.
• AI features: where a Client enables AI features (for example, an assistant that drafts replies or answers common questions), message content is processed to generate responses for that Client. We do not use Client message content to train general-purpose AI models.
• Support and communication: responding to enquiries, providing customer support, and sending service, security and billing notices.
• Security and integrity: authenticating users, preventing fraud, spam and abuse, monitoring for misuse, and enforcing our Terms of Service and Meta's policies.
• Improving the Services: troubleshooting, measuring performance and reliability, and developing features, using aggregated or de-identified data where possible.
• Legal obligations: keeping financial records, responding to lawful requests from authorities, and establishing, exercising or defending legal claims.

We do not sell personal data, rent it, or use WhatsApp or Meta Platform Data for advertising, profiling for marketing, or any purpose other than providing the Services to the Client who authorised us.

4. Legal Basis for Processing

Where data protection laws require a legal basis (such as the EU/UK General Data Protection Regulation), we rely on the following:

• Performance of a contract: to provide the Services to Clients and their authorised users, and to take steps at your request before entering into a contract.
• Legitimate interests: to secure and improve our Services, prevent abuse, respond to enquiries and communicate with business contacts, where those interests are not overridden by your rights.
• Consent: where we ask for it, for example for optional communications. You may withdraw consent at any time.
• Legal obligation: to meet tax, accounting and other legal requirements.

When we process data as a processor for a Client, the Client is responsible for having a valid legal basis. This includes obtaining the opt-in consent that WhatsApp requires before a business messages a person, and any consent required for processing health data.

5. WhatsApp and Meta

Our WhatsApp features use the WhatsApp Business Cloud API, which Meta hosts. When a message is sent or received through our Services, it is transmitted and processed by Meta as part of the WhatsApp Business Platform. Meta's handling of that data is governed by Meta's own terms and policies, including the WhatsApp Business Terms of Service, the WhatsApp Business Messaging Policy and the Meta Privacy Policy.

We access Meta Platform Data only with the permissions a Client explicitly grants during Embedded Signup, and only to provide the Services to that Client. We comply with the Meta Platform Terms and Developer Policies. A Client can revoke our access at any time from its Meta Business settings or by contacting us. After access is revoked, we stop receiving new data, and we delete the related data as described in our Data Deletion Instructions.

6. Sharing and Sub-processors

We share personal data only as described below, and only to the extent needed for each purpose:

We may also disclose personal data:

• to the Client on whose behalf we process it, and to that Client's authorised users;
• to professional advisers (such as lawyers and accountants) who are bound by confidentiality;
• when required by law, regulation, court order or a valid request from a government authority, or to protect the rights, safety or property of Deepkern, our Clients or others;
• to a successor entity in a merger, acquisition or sale of assets, subject to this Privacy Policy.

Our sub-processors are contractually required to protect personal data and to use it only to provide services to us. We will update this list when we add or replace a sub-processor.

7. International Data Transfers

Deepkern is based in Pakistan. Our service providers, including Meta and our cloud hosting provider, may store and process data in other countries, including the United States and countries in the European Union. Data protection laws in those countries may differ from the laws where you live.

When we transfer personal data internationally, we take steps to protect it as this policy describes. These steps include working with providers that offer appropriate safeguards, such as Standard Contractual Clauses or equivalent contractual commitments where required.

8. Storage and Security

We use technical and organisational measures that are appropriate to the nature of the data we handle. These include:

• encryption of data in transit using HTTPS/TLS;
• encryption of stored data, including WhatsApp access tokens, at rest;
• role-based access controls, so each Client's data is separated and visible only to that Client's authorised users;
• restricted internal access on a need-to-know basis, with strong authentication for administrative systems;
• verification of webhook signatures from Meta, and secure handling of credentials;
• regular backups, monitoring, and prompt application of security updates.

No method of transmission or storage is completely secure. If we become aware of a security incident that affects your personal data, we will notify affected Clients and individuals, and the relevant authorities, as the law requires.

9. Data Retention

We keep personal data only for as long as we need it for the purposes in this policy, unless the law requires us to keep it longer:

10. Your Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct inaccurate or incomplete data;
• request deletion of your data (see our Data Deletion Instructions);
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where we rely on consent;
• lodge a complaint with your local data protection authority.

To exercise these rights, email hello@deepkern.com. We may need to verify your identity before we act on a request. We will respond within 30 days.

If you are a customer or patient of one of our Clients: that business controls your data. Please send your request to the business directly. If you contact us instead, we will pass your request to the relevant Client and help them respond. To stop receiving WhatsApp messages from a business, you can block its number in WhatsApp or ask the business to opt you out.

11. Children's Privacy

Our Services are intended for businesses and are not directed at children. We do not knowingly collect personal data directly from children under 13, or under the minimum age set by local law. If you believe a child has given us personal data directly, contact us at hello@deepkern.com and we will delete it.

Clinics using our Services may process data about patients who are minors, such as appointment details. In those cases the clinic is responsible for getting any required consent from a parent or guardian, and for making sure that messages go to the appropriate contact.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If the changes are material, we will notify Clients by email or in the app before they take effect.

13. Contact Us

For questions about this Privacy Policy or our data practices, or to make a privacy request, contact us by email at hello@deepkern.com, by phone at +92 336 0191110, or by post at Deepkern, 108, Block C, Canal Garden, Lahore, Pakistan. Please put "Privacy Request" in the subject line so we can route your message quickly.