Privacy Policy

1. Introduction

Welcome to Wapa Health ("we," "our," or "us"), a platform operated by Siranova Health FZC, a company registered in the United Arab Emirates. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our WhatsApp Business API services.

By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not access or use our services.

2. Our Role: Controller and Processor

Wapa Health is a business-to-business platform used by healthcare providers ("clinics"). For account and business information of clinic users, Siranova Health FZC acts as the data controller. For patient data processed through a clinic's WhatsApp Business Account (message content, patient phone numbers, message metadata), the clinic is the data controller and Siranova Health FZC acts as a data processor, processing this data only on the clinic's instructions.

3. Information We Collect

3.1 Information You Provide

• WhatsApp Business API credentials (WABA ID, phone number ID, access tokens)
• Contact information (name, email address)
• Business information (company name, business details)
• Message content and recipient information

3.2 Information We Collect Automatically

• Log data (IP address, browser type, operating system)
• Usage data (features used, frequency of use)
• Device information (device type, unique device identifiers)
• WhatsApp message metadata (timestamps, delivery status)

3.3 Information from Third Parties

We may receive information about you from third parties such as Meta (Facebook) when you connect your WhatsApp Business Account via Meta Embedded Signup.

4. How We Use Your Information

We use the information we collect to:

• Provide and maintain our services
• Process and send WhatsApp messages on behalf of clinics
• Monitor message delivery and status
• Improve and optimize our services
• Detect and prevent fraud and abuse
• Comply with legal obligations
• Communicate with you about our services

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• With your consent: We may share your information when you explicitly authorize us to do so.
• Service providers: We may share information with third-party service providers who help us operate our services (see Section 10).
• Legal requirements: We may disclose information when required by law or to protect our rights.
• Business transfers: In connection with a merger, acquisition, or sale of assets.

6. Data Retention

We retain your information for as long as necessary to provide our services and fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

Message content is typically retained for 30 days, while account information is retained for the duration of your account. You can request deletion of your data at any time via our data deletion page.

7. Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest
• Secure authentication mechanisms
• Regular security assessments
• Limited access to personal information
• Regular backups and disaster recovery procedures

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request transfer of your information
• Objection: Object to processing of your information
• Restriction: Request restriction of processing

To exercise these rights, please contact us at info@siranovahealth.com or use our data deletion request form.

9. WhatsApp Business API Data

When you use our WhatsApp Business API services, we process message data on behalf of the clinic. This includes:

• Message content (temporarily, for delivery purposes)
• Recipient phone numbers
• Message metadata (timestamps, delivery status)
• WhatsApp Business Account information

We process this data only as instructed by the clinic and in accordance with the WhatsApp Business Terms and Meta Platform Terms.

10. Third-Party Services

Our services integrate with third-party platforms, including:

• Meta (Facebook): WhatsApp Business Platform (Cloud API) provider
• Microsoft Azure: Hosting and infrastructure (data region: UAE North)
• Analytics services: For service improvement

These third parties have their own privacy policies, and we encourage you to review them.

11. International Data Transfers

Our primary data hosting is in the United Arab Emirates (Microsoft Azure, UAE North). Where information is transferred to or processed in other countries, we ensure appropriate safeguards are in place, including standard contractual clauses or adequacy decisions where required.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

13. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

14. Legal Basis for Processing (GDPR)

For users in the European Union, we process personal information under the following legal bases:

• Contract: Processing necessary to provide our services
• Legitimate interests: Processing for business purposes
• Consent: Where you have given explicit consent
• Legal obligation: Processing required by law

We also comply with applicable UAE data protection law, including Federal Decree-Law No. 45 of 2021 (PDPL).