App privacy notices

Who is responsible

The controller for this integration is MY QOURES ADVERTISING AND PUBLICITY, Qatar. The responsible manager is Zaid Abouqamar. Contact socialmedia@myqourse.com or +974 5117 4944 about privacy, access, correction, objections or deletion.

This is an RVC-specific notice. It does not replace the YRStudio privacy policy or notices governing the clinic’s full medical records, other website services, or SMS and sign-in codes.

Information used by the integration

• WhatsApp communication: phone numbers, messages and replies, template values, WhatsApp account and message identifiers, timestamps, delivery/read/failure updates, and consent or opt-out choices and supporting records.
• Business App Coexistence: when shared through the messaging platform’s onboarding and sync flow, Business App contacts and permitted message history, copies of app-sent messages, and account/sync events may be kept in restricted integration records. Synced contacts are not automatically added to clinic loyalty lists or treated as marketing consent.
• Clinic and booking information: relevant client names and contact details, source record identifiers, pet and appointment details, service history, invoices, payments and operational totals returned by the requested reports or staff tools.
• Staff and administration: authorized staff numbers, questions, relevant conversation context, assistant replies, query/audit records, administrator actions and saved settings.
• Reports: reporting periods, collected observations, calculated metrics, Arabic report text, public-source citations and message delivery records.

Clinic contacts and records from the clinic management system are kept as a separate source from website booking customers. The clinic loyalty manager uses contacts from that system; it does not use app profiles as clinic contacts.

Why we use it

We use this information to provide requested appointment communication, record communication preferences, check message delivery, prepare internal reports, answer authorized staff questions, and investigate errors or misuse. Marketing choices are recorded separately; a booking or silence is not treated as marketing consent.

Website administration requires an authorized administrator account. The WhatsApp staff assistant is restricted to enabled staff phone numbers on an allowlist and is read-only: its tools retrieve information rather than change bookings or clinic records. Its answers and reports can contain confidential client or business information, so staff should share them only with authorized people.

Service providers and AI

• The messaging platform processes message content, phone numbers, identifiers and status events to operate WhatsApp communication. See the messaging platform privacy policy for its own handling of information.
• Lovable Cloud supports application hosting and cloud services.
• Separately configured database, authentication and backend services support server processing and storage for integration records, settings, reports and logs.
• External AI routing and model services process report aggregates or bounded tool results, staff questions and relevant conversation context to generate analysis and answers. Depending on the question, this can include client or appointment information; it is not always anonymous data.
• The clinic management system supplies the clinic records used by authorized queries and reports. Website bookings are queried separately.

Public news and social media research is a separate request containing generic Qatar topics and the reporting window. Private clinic customer, staff, financial and conversation information is not included in that public research request. Internal analysis does not have public search tools.

Private assistant and report-analysis requests are configured to require zero data retention (ZDR) routing to a designated external AI endpoint, with provider fallback disabled. This routing setting is separate from the records retained by this integration and from providers’ applicable terms, operational records and account settings.

Providers may process or access information outside Qatar under their applicable terms and safeguards. The location of a database alone does not describe all processing or support access. We do not make an absolute promise that no data is retained anywhere or that every service has the same model-training policy.

AI answers may be incomplete or mistaken. Authorized staff should check source records before acting on them.

Retention and security

Access to the integration’s administrative functions is restricted, and provider credentials are kept on the server. Reports, message and consent records, source observations, staff questions/replies and audit records may remain stored for operational needs, delivery checks, security, disputes and lawful recordkeeping.

The assistant’s recent-conversation window is not a promise that all related data is deleted after that window. Resetting a conversation, opting out or removing staff access does not automatically erase saved reports, message logs or other records. We review deletion requests individually and explain information that must be retained and why.