Privacy Policy

ASAS · Last updated 27 September 2026.

1. Scope and responsibilities

ASAS helps appointment-based businesses run their front office. This policy covers website visitors, business users, and people whose information a business records in ASAS. Contact us at admin@asaswebs.com.

Each business decides what customer information to collect and why. It is responsible for informing customers, obtaining any required consent, and responding to their requests. We process that information to provide the service under the business's instructions. We are responsible for our own processing of ASAS user-account and website-visitor information to operate and secure the service and communicate with them. If you are a business's customer, please also read its privacy notice.

2. Information we process and why

• Businesses and their users: registration and contact details, accounts and roles, business settings and services, subscription and billing records, and sign-in, security and support records. We use these to set up accounts, operate workspaces, provide support, protect the service and manage the business relationship.
• Business customers: identity and contact details, appointments, messages and communication preferences, consent records, notes and feedback. If a clinic uses the relevant features, it may also record payment and insurance information, health or clinical information, and patient files. We use these records to provide the functions the business chooses and handle its customers' requests.
• Connected and optional features: if a business connects messaging, a calendar or a phone service, we process what is needed to exchange messages, appointments or calls. Voice features may involve call details, transcripts, voicemails and recordings when enabled. Some features need an external provider; availability depends on the business's settings and connections actually in service.
• Website visitors and service use: technical request and security records, cookies needed for a signed-in session, and usage information needed to operate the service and prevent misuse.

Businesses may record amounts, payment methods, references, invoices and receipts, and insurance membership numbers supplied by customers. ASAS payment pages are not used to enter card details. If you pay through another party, that party or the business handles your card or account details.

3. AI and recipients

When an AI assistant is available to and enabled for a business, customer messages, conversation context, business information and relevant tool results may be sent to an AI model provider to generate a reply. One available text-chat path uses OpenAI. Messages can contain health information a customer writes. Some tool results can include clinic-approved aftercare instructions, appointment details or a payment preference. We therefore do not assume an AI conversation is free of sensitive information. ASAS keeps conversations according to the business's settings; a provider's applicable terms and arrangements govern its retention of what it receives. An external voice provider may process call content or audio if a connected voice feature is enabled.

Depending on the feature used, recipients include hosting, network, email, messaging, voice, storage and support providers, and channels a business connects, such as Meta for WhatsApp, Messenger and Instagram or Google Calendar when a user connects it. They receive information needed for that feature. We do not sell personal information to advertisers.

4. International processing and security

Information may be processed outside your country or the business's country, including through Meta channels, OpenAI, email and hosting services. Businesses should assess any transfer requirements that apply to them before using an optional feature. We use access controls and security measures to protect information, although no service can guarantee zero risk.

5. Retention, deletion and your rights

A business keeps customer information while using ASAS according to its needs and obligations. Optional retention rules can be enabled by the business; this policy does not mean every record is automatically deleted on one schedule. Financial records, audit records, and evidence of consent or opt-out may remain while needed for a legitimate purpose or legal obligation. A dispute or legal requirement may delay deletion. Backups follow their recovery cycle and are not edited record by record when active data is erased; restoring an older backup requires steps to reapply erasure.

You may request access, correction, a copy or deletion of your information, and exercise other rights available under applicable law. If you are a business's customer, contact that business first because it decides what it holds. Its owner or manager can request a customer-record export in available formats, subject to exclusions and size limits; original patient files may require a separate download. The response scope can depend on the request and the law. If you cannot identify or reach the business, email admin@asaswebs.com and we will help route and verify the request. See Data Deletion for the process and limits.

6. Children, changes and contact

Clinics may record information about children. The business is responsible for informing and obtaining consent from a parent or guardian where required. We will update this page when our practices change and show the update date. Questions: admin@asaswebs.com.