Shobix Privacy Policy

Information sent by your web browser

Shobix obtains information that your web browser sends to it automatically. This information normally includes the IP address of your internet service provider, the name of your operating system and the name and version of your browser. What we receive depends on your browser settings. Please review your browser if you want to know what information it sends or how to change those settings.

The information provided by your browser does not identify you personally. We use it to produce statistics that help us improve our sites and make them more compatible with the technology our visitors use.

Information obtained through a "cookie" on your computer

Shobix may obtain information about you by placing a tag on your computer's hard drive. That tag is known as a "cookie". All Shobix Websites use "session cookies". A session cookie tags your computer with a unique identifier generated by the computer when you access our sites. A session cookie does not identify you personally and expires when you close your browser.

We use these session cookies to obtain statistical information about how visitors use our sites: which pages they visit, which links they use and how long each visit lasts. We analyse this information (known as "clickstream data") statistically, to better understand our visitors' interests and needs and so improve the content and functionality of our sites.

Some Shobix Websites also use "persistent cookies". These cookies do not expire when you close your browser; they stay on your computer until you delete them. By assigning a unique identifier to your computer we can build a record of your previous choices and preferences, and supply them automatically when they are needed again, saving you time and effort. Where a Shobix Website uses persistent cookies, we will say so in the privacy statement on that site.

If you do not wish to receive cookies, you can set your browser to refuse them or to warn you when one is placed on your computer. While you are under no obligation to accept cookies when visiting a Shobix Website, you will not be able to use the full functionality of the site if your browser refuses them.

Information you provide voluntarily

Shobix collects the information you knowingly and voluntarily provide when using a Shobix Website; for example, the information you provide when you sign up for email alerts, answer a survey, make an enquiry or send us feedback by email. In many cases this information will be personal in nature.

Shobix uses this information for the purposes for which you provided it. For example, if you give us your email address when signing up for email alerts, we use that address to send you the alerts you asked for.

We also use information obtained through Shobix Websites for various business purposes, such as customer service, fraud prevention, market research, improving our products and services, and providing you and your company with information and offers we believe are of interest to you. We may also remove all personally identifiable information and use the remainder for historical, statistical or scientific purposes.

Many Shobix Websites let you choose how your personal information may be used. In most cases we ask you to tell us your choices on the page where you provide your personal information.

The organisation that licenses Shobix decides; we carry it out

When a clinic, a practice or a company uses Shobix to serve its patients or customers, it is that organisation which decides what information is collected and for what purpose. Shobix processes that information on its behalf and following its instructions.

If you are a patient or customer of one of those organisations and you want to know what data of yours they hold, or ask for it to be deleted, please contact the organisation that serves you. We will help them respond to you.

What the platform stores

So that the service can work, the platform keeps:

• Contact details of the person being served: their name, phone number and email address where they provide one.
• The conversation history on each channel they use: WhatsApp messages, emails, social media messages and the call log.
• Appointments: date and time, practitioner, service or reason, and location where applicable.

This information is used to serve that person, to give continuity to their conversation, to manage their appointments and to let the organisation review and supervise the service provided. It is not used for anything else.

Where it is stored and what it passes through

Platform information is hosted on servers located in Ecuador or in other Latin American countries, and is retained as described in section 13.

Messages necessarily pass through the provider of the relevant channel: the WhatsApp Business API from Meta for WhatsApp, the email provider for emails, the relevant social media platform, and the telephony provider for calls. Those providers process the messages in order to deliver them and are bound by confidentiality.

What Google user data Shobix receives when you sign in

When you sign in with Google, Shobix receives only two things:

• Your Google account identifier, a unique code that Google assigns to each account.
• Your email address.

We do not receive your name, your profile picture, your contact list, the contents of your Gmail or your Drive files. And we never know your Google password: you enter it with Google, not with Shobix.

How we use it and what we store

Those two items serve one purpose only: to confirm that you are an authorised user of the platform and open your session.

Signing in with Google does not create an account. Your Shobix user must already exist, created by your organisation's administrator, and the email address on the Google account must match that user. If it does not match, you are not signed in and nothing is created.

From this sign-in we store the Google account identifier and the email address, linked to your user, so that we can recognise you next time.

We do not use this data for advertising, we do not sell it, we do not transfer it to third parties outside the provision of the service, and we do not use it to train artificial intelligence models.

This is separate from Google Calendar

Signing in with Google and connecting Google Calendar are two different things, with different permissions, each authorised separately.

You can sign in with your Google account without connecting any calendar. And the calendar account you connect may be a different one from the account you sign in with. The calendar integration is described in section 08, and how to withdraw it in section 09.

To stop using your Google account as a way of signing in, withdraw the permission at myaccount.google.com/permissions or write to us at ceo@shobix.ai. Your Shobix user still exists; you will simply sign in with a password.

What permissions we request

When you connect the account, Google shows you exactly what you are authorising. Shobix requests two things:

• Access to the events of the calendar you connect, to read the ones already there and to create new appointments.
• Read access to the list of your calendars, solely to show you which ones you have so that you can choose the one to work with.

We do not request access to Gmail, Drive, Contacts or any other Google service.

What we read from your calendar and why

The list of your calendars, so that you can choose which one to connect.

The events in the connected calendar. What we need to know from them is when you are busy: from those busy hours we work out the slots you have free, so that Shobix knows which times it can offer to someone requesting an appointment.

What we write to your calendar

When an appointment is booked, Shobix creates an event in the connected calendar. That event contains:

• The date and time of the appointment.
• The patient and the practitioner seeing them.
• The service or reason for the appointment.
• The location and address, where these exist.

Shobix does not write clinical notes or diagnoses to Google Calendar. The event contains only what is needed to identify the appointment.

When the patient is added as a guest

We add the patient as a guest on the event only if they expressly agree to it, for that specific appointment, and provide an email address for the purpose.

Holding their general contact email is not enough: having someone's address is not their consent to invite them to a calendar event. If they do not agree, the appointment is created anyway, without inviting them.

What Shobix stores from the integration

Shobix keeps:

• The identity and email address of the authorised Google account, so that we know which account is connected and can show it to you.
• The calendar and event identifiers, which are the codes Google uses to name them and which let us find each appointment again.
• The data needed to keep your Shobix diary and the connected calendar in sync.
• The authorisation token, encrypted, which is what lets us stay connected without asking your permission again. We never know or store your Google password: authorisation happens directly with Google.

What it is used for and who it is shared with

Calendar information is used solely to provide the appointment booking functionality described in this section.

It is seen by staff in your organisation who have access to Shobix, just as they would see the diary. And it reaches the person with the appointment when they have been invited with their consent, in the form of a Google Calendar invitation, like any other guest on an event.

If your organisation has the WhatsApp or telephone channels enabled, the appointment details needed to notify the person — the date, the time and, where relevant, the place or the practitioner — travel over that channel. For WhatsApp, the message necessarily passes through the WhatsApp Business API from Meta; for calls, through the telephony provider delivering the service. If those channels are not enabled, no information goes out that way.

We do not transfer Google user data to any third party for purposes other than providing or improving this functionality, unless you expressly authorise it or we are required to by law or court order.

Artificial intelligence: what we do not do with this data

Shobix does not use Google Workspace APIs, or data obtained through them, to develop, improve or train non-personalized artificial intelligence or machine learning models, whether our own or those of third parties.

Shobix agents use your calendar information only at the moment of serving someone requesting an appointment, and only for your organisation. That information does not feed any generalised model and is not reused for other customers.

Nor do we use or transfer data obtained from Google APIs for any of the following purposes:

• Advertising of any kind: targeted, personalized, retargeted or interest-based.
• Selling to data brokers or providing to information resellers.
• Determining credit-worthiness or for lending purposes.
• Creating databases or providing data to bulk mailing list brokers.

Shobix use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect this data

Communications with the Google APIs always take place over encrypted connections (HTTPS/TLS): that is the only way Google accepts them.

The authorisation token is stored encrypted on our systems.

We never know or store your Google password: authorisation happens directly with Google through OAuth, and what we receive is a token you can revoke whenever you want (section 09).