Privacy Policy
Hala is designed to handle clinic and patient information responsibly and transparently. This policy explains what we collect, why, and the choices you have. Draft for legal review before relying on it in production.
Effective date: September 2, 2026. Operator: Smarthinkerz LLC ("Hala," "we," "us").
This policy applies to clinic users who create and manage Hala accounts, and to patients who interact with a clinic's Hala Desk. Clinics act as the controller of their patient relationships; Hala processes patient conversation and booking information on the clinic's behalf to deliver the service.
From clinics: account details (name, email, phone), clinic profile and knowledge (services, prices, doctors, hours, insurance information, FAQs), calendar connection data, billing details, and support communications.
From patients using a clinic's desk: the content of the conversation, the name and mobile number provided to confirm a booking, appointment details, and technical information needed to deliver the service (such as device and usage data).
We ask patients to share only what is needed to book. Patients should not submit detailed medical histories through the desk; clinical matters belong in the clinic, with clinicians.
To operate the service: answering questions from clinic knowledge, checking availability, booking appointments, and showing conversations in My Desk. To run accounts and billing. To keep the service secure, prevent abuse, and troubleshoot. To improve reliability and product quality. To meet legal obligations.
Conversation and booking information is used to deliver the conversation and the booking to the clinic the patient contacted. Clinic knowledge is used only to answer that clinic's patients. We do not sell personal information, and we do not use patient conversations for advertising.
Information is stored on secured infrastructure with access controls, encryption in transit, and encryption at rest for sensitive credentials. Access inside Hala is limited to what is needed to operate and support the service, and administrative access is logged.
The clinic a patient contacted can see that patient's conversations and bookings in My Desk. Hala personnel access information only for operation, support, and safety. We use a small number of service providers (such as hosting, payments, and email delivery) under agreements that restrict their use of information to providing services to us. Payment card details are handled by our payment provider; Hala does not store full card numbers.
We keep information for as long as needed to provide the service and meet legal and accounting obligations. Clinics can request deletion of their clinic data; conversation retention periods depend on plan and settings. When information is no longer needed, it is deleted or anonymized.
The websites use necessary cookies to keep you signed in and limited analytics to understand usage and improve the product. Where required, we ask for consent before non essential cookies are set. See also the Cookies page.
Information may be processed in locations outside your country. Where that happens, we apply appropriate safeguards consistent with applicable law, including the data protection laws applicable in the Gulf region.
Depending on your jurisdiction, you may have rights to access, correct, delete, or export your information, and to object to or restrict certain processing. Clinic users can exercise most of these directly in My Desk. Patients should contact the clinic they interacted with first, since the clinic controls the patient relationship; we support clinics in fulfilling these requests, and patients may also contact us directly.
Clinics are responsible for the accuracy of their knowledge, for informing their patients about the use of a digital receptionist where required, for handling patient requests about their information, and for using Hala in line with applicable healthcare and data protection rules in their country.
Hala Desks are operated by clinics for their patients. Where a booking concerns a minor, it should be made by a parent or guardian.
We will post updates on this page with a new effective date, and notify clinics of material changes.
Privacy requests: privacy@smarthinkerz.com