This Privacy Policy explains how personal data is processed through Kai, CAYDA’s AI-assisted patient communication service, including the patient-facing assistant and clinic administration console.
1. Who is responsible for personal data
For patient and prospective-patient conversations with a participating clinic or healthcare facility, that clinic or facility acts as Personal Information Controller (PIC). CAYDA processes the conversation data on its behalf as Personal Information Processor (PIP).
CAYDA acts as PIC for clinic-user accounts, the administrative and security records it keeps to run the service, and enquiries submitted through CAYDA’s own website.
Kai is operated by CAYDA Consulting & Solutions Inc., 6th Floor, 1CISP Building, 11 Mapagbigay corner Maunlad, Pinyahan, Quezon City, NCR 1100, Philippines. The Data Protection Officer is Anna Liza Yuson, reachable at dpo.cayda@protonmail.com.
2. Personal data processed
- Message text and health information voluntarily included by a person in a conversation.
- Conversation attributes generated by Kai, including topic, sentiment, language, timing and whether a conversation should be brought to human attention.
- Conversation and operating metadata, such as when a conversation took place.
- Consent records and version information showing the notice accepted at the point of collection.
- Where Facebook Messenger is enabled, Messenger identifiers for the person’s conversation with the clinic’s Page.
- Clinic staff account information, including email address, role, invitation record and authentication information.
- Administrative security and audit information, including IP address for administrative actions. Patient IP addresses are not stored.
3. Purposes and legal bases
Patient conversation information is processed to receive and answer enquiries, provide information published by the clinic, deliver responses, record consent and generate service analytics for the clinic. Consent is used for patient conversation processing, including sensitive health information voluntarily submitted through the channel. No message is stored or sent to an AI model before consent is given. The clinic may also rely on legitimate interests for appropriate analytics and service-demand understanding, subject to data-subject rights and applicable law.
CAYDA processes clinic-user and administrative information as needed to create and secure accounts, manage permissions, publish clinic content, administer and support Kai, maintain auditability, prevent abuse and protect service security. CAYDA relies as applicable on contract or pre-contract steps, legal obligations and legitimate interests for this PIC-side processing.
4. AI processing, profiling and human escalation
Kai automatically generates responses from clinic-published information. It may also derive topic, sentiment, language and timing from a conversation and may classify a conversation as requiring human attention. This constitutes profiling. On a clinic’s website, a conversation is not linked to the individual. On Facebook Messenger, it remains linked to the individual for as long as the record is kept.
Where a conversation is classified as requiring human attention, the clinic is notified so that its staff can follow up.
Clinic staff can read their clinic’s conversations in the administration console, as can CAYDA personnel where needed to operate and support the service. Access is limited by role and every reading is recorded.
Kai does not independently make treatment, eligibility or other decisions producing legal or similarly significant effects on the individual. It is not a medical professional, does not diagnose, interpret medical results or provide medical advice, and is designed to route clinical questions to human personnel rather than answer them as clinical advice.
5. Service providers and international processing
CAYDA uses service providers for hosting and database services, AI processing, email to clinic staff and, where a clinic enables it, Facebook Messenger. Conversations are stored in Singapore and processed by an AI provider in the United States. Other providers may process data in Singapore, the United States or other countries under their service terms. The current list of providers is available from the Data Protection Officer.
CAYDA uses contractual and technical safeguards appropriate to these processing arrangements and remains accountable for subprocessors it appoints as required by law. CAYDA does not sell personal data or use it for advertising. Neither CAYDA nor its AI provider uses conversation data to train AI models.
6. Retention and deletion
- Patient message text is redacted 90 days after receipt.
- The conversation record, including analytics fields, is deleted at the end of the clinic’s retention period, which is 180 days by default.
- Consent records are retained for the clinic’s applicable retention period plus one year as evidence that notice and consent were obtained.
- Administrative audit records are retained for five years from the relevant action; the originating administrative IP address is removed after 90 days.
- Clinic-user accounts are deleted within 90 days after the person’s access to every clinic has ended. Audit records of their administrative actions, including their email address, are kept for the five-year audit period.
- Contact details submitted through CAYDA’s own website are used only for the purpose stated at collection and, where used for a mailing list, are kept until the person asks to be removed.
- When a clinic’s service ends and the export period in its agreement has passed, CAYDA deletes the clinic’s conversation and consent records from the live service and removes personal contact details held in the clinic’s configuration, subject to a documented lawful exception. The rest of the configuration, including its published versions and the names of the clinic personnel in them, is kept for five years as a record of the information Kai was given.
- Deleted database information may remain in automated backups for up to seven additional days before the relevant backup expires.
7. Point-of-collection notice and consent
Before a person’s first message is stored or sent to an AI model, Kai presents a short privacy notice and asks the person to accept it. The notice summarises how messages are stored, used and kept, explains how to ask the clinic about them, and points to this Policy. Kai records which version of the notice was accepted. If the person declines, nothing is stored and the clinic’s contact details are shown instead. Declining the chat channel does not affect access to care.
8. Data-subject rights
Data subjects have the rights provided by the Data Privacy Act. Requests concerning a clinic conversation should normally be directed to the clinic that controls the conversation data; CAYDA will assist the clinic in responding. Requests concerning CAYDA’s own processing may be sent to dpo.cayda@protonmail.com.
On Facebook Messenger, the clinic can locate a person’s messages from the person’s conversation with the clinic’s Page. A conversation on a clinic’s website is not linked to an identifiable person, so an individual website conversation cannot ordinarily be found or deleted by identity. Requests are answered within the period required by law. A person may also lodge a complaint with the National Privacy Commission.
9. Security
CAYDA uses organizational, physical, and technical measures appropriate to the sensitivity of the data. These include encryption in transit and at rest, separation of each clinic’s data, role-based access with two-factor authentication, logging of access to conversations, and automated enforcement of retention periods.
10. Children and young people
Kai is not directed at children. Where a patient is a minor, the clinic’s own rules on consent and on the involvement of a parent or guardian apply. Kai does not ask for or verify a person’s age. A parent or guardian may ask the clinic to delete information a child has sent, subject to Section 8 and lawful retention requirements.
11. Personal data breaches
If a personal data breach occurs, CAYDA will notify affected clinics without undue delay and will provide information reasonably needed for their assessment and response. CAYDA will notify the National Privacy Commission and affected individuals where CAYDA itself is required to do so by law, and will support each clinic in making any notification for which that clinic is responsible.
12. Changes and contact
CAYDA may update this Policy as Kai or applicable law changes and will publish each revision with its effective date. Where the point-of-collection notice changes materially, Kai will obtain a new acceptance or consent where required before further processing under the revised notice.
Privacy enquiries: dpo.cayda@protonmail.com. General product enquiries: info@cayda.com.