Privacy notice

MHub Solutions (MHub) operates this website. For any privacy question or request, contact team@mhubsolutions.tech. We answer by email.

• Audit requests: the name, business, contact details, website, booking system, goals and preferred language you type into the form.
• Concierge demo: the messages you type into the public demo, so the assistant can answer them.
• Server logs: IP address, user agent, requested page and timestamp, kept briefly for security and abuse prevention.
• Analytics: aggregate page views and referrers, only after you accept analytics.

We do not ask for, and do not want, patient records or health information through this website. Please keep enquiries to business information.

• To answer your enquiry and prepare a proposal: performance of a contract, or steps taken at your request before one.
• To run and secure the website, including rate limiting: our legitimate interest in a working, non-abused service.
• To send you occasional notes on clinic automation, only if you ticked the box on the audit form: your consent, which you can withdraw with the unsubscribe link in any email or by writing to us. We record the wording you agreed to and when.
• To measure aggregate traffic: your consent, which you can withdraw at any time.
• To meet legal, tax and accounting obligations: compliance with a legal obligation.

The demo answers as a fictional clinic. When it is connected to a generative model, the words you type are sent to that provider to produce a reply, and the reply comes back to your browser. Do not type personal or patient information into it. We do not use demo conversations to train models, and the provider processes them under its API terms rather than for training.

For clinics we build, patient conversations, appointments and analytics live inside accounts the clinic owns: its messaging account, its booking system, its workspace. The clinic is the controller. We act as a processor under a data-processing agreement, hold an administrator role for support, and that role is removed on request or at the end of the engagement. There is no shared patient database across clinics.

How we design each deployment explains the architecture and what we design around in each market, including HIPAA, PIPEDA, GDPR, LGPD and the UAE PDPL.

We use no advertising or cross-site tracking cookies. Analytics is off until you accept it, and Global Privacy Control or Do Not Track signals are treated as a decline. You can change your choice at any time from the cookie link in the footer.

Website and demo:

Typical inside a clinic deployment, confirmed per client in the agreement:

Some providers are outside your country, including the United States. Where the law requires it, those transfers rely on appropriate safeguards such as standard contractual clauses, and for clinic deployments the residency requirements are settled before anything is built.

• Audit requests and related correspondence: up to 24 months after our last contact, unless we agree otherwise or you ask us to erase them sooner.
• Demo conversations: not stored by us beyond what the model provider retains under its API terms for abuse monitoring.
• Server logs: a short rolling window, typically no more than 30 days.
• Analytics: aggregate counts only, with no profile of you.

Depending on where you live, you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent. Residents of the EU and UK have these rights under the GDPR; UAE residents under the PDPL; Brazilian residents under the LGPD; Canadians under PIPEDA; and US state laws such as the CCPA give similar rights, including the right not to be discriminated against for exercising them. Write to team@mhubsolutions.tech and we will answer.

If your data sits inside a clinic’s deployment, the clinic decides such requests and we support them in carrying them out. You also have the right to complain to your data-protection authority.

Access is limited to named people who need it, connections run over the vendor’s official APIs on credentials held in the relevant account, and each clinic runs an isolated deployment. No system is perfectly secure, so we also plan for how a problem would be contained and reported.

This website is aimed at businesses, not children. Where a clinic treats minors, that information is handled inside the clinic’s own systems under its policies and consent processes.

If this notice changes materially, we will update the date above and, where the change affects an active engagement, tell you directly.