Privacy Policy
1. Who we are
Basirah (“we”, “us”) is a business based in Kuwait. We provide Hala, an AI front desk for WhatsApp, to businesses.
In this policy:
- Client means a business that uses our services.
- Customer means a person who sends a WhatsApp message to a client.
- Dashboard user means a person a client allows to use the Hala dashboard.
Our contact details are in section 15.
2. Our role
For customer messages, the client decides why and how the data is used. The client is the controller of that data. We are its processor. We use the data only to provide our service to the client, and only on the client’s instructions, as set out in our contract with the client.
The client’s own privacy notice also applies to its customers. If you are a customer, please read it too.
For client account details, dashboard users and visitors to this website, Basirah decides how the data is used.
3. What data we process
About clients
- Business name, contact person, phone number and email address.
- WhatsApp Business account details, such as the account ID and phone number ID.
- The business information the client gives us: services, prices, opening hours, staff names and answers to common questions.
- Billing details and records of our invoices.
About dashboard users
- Name, email address and role (owner, staff or viewer).
- Password, stored only as a one-way hash. We cannot read it.
- Login records, such as the time and IP address, to keep accounts secure.
- Actions taken in the dashboard, such as which drafts a user approved.
About customers (on behalf of the client)
- WhatsApp phone number or WhatsApp user ID, and the profile name shown on WhatsApp.
- Message text, and the time each message was sent.
- If a customer sends a photo or file, we store only the reference that Meta provides. We do not download the file.
- Replies that Hala drafts, and whether staff approved or rejected them.
- Booking details: the service, staff member, date, time and status (for example booked, cancelled or no-show).
- Notes written when a conversation is passed to staff.
- The language of the conversation.
Usage and technical data
- Counts of messages and conversations, AI usage and cost, response times and errors.
- Server logs, used for security and to fix problems.
We do not ask customers for health information. But at a clinic, customers may send it in a message. See section 6.
4. How we use data
We use data to:
- receive WhatsApp messages for the client and send its replies;
- draft replies, offer appointment times and make bookings;
- check each incoming message for signs of an emergency;
- pass conversations to the client’s staff;
- show conversations, bookings and reports in the dashboard;
- keep the service secure and fix problems;
- measure usage and bill clients;
- meet our legal duties.
We do not:
- sell data;
- use data for advertising;
- use WhatsApp messages to train AI models, ours or anyone else’s;
- use one client’s data to serve another client.
5. How Hala uses AI
Hala uses an AI model from an outside AI provider. We will add the provider’s name to this policy before Hala handles real customer messages. To draft a reply, we send the provider the recent messages in the conversation and the client’s business information. We also send each incoming message to the provider to check it for signs of an emergency.
We only use AI providers whose terms say they do not train their models on the data we send. We never send passwords or access tokens to the AI model.
AI can make mistakes. Each client chooses how much Hala may do on its own. In Assist mode, staff approve every reply that Hala writes before it is sent. A few fixed safety messages go out at once in every mode, such as the emergency message and the message that says a conversation was passed to staff.
6. Health information at clinics
Hala is not a medical service. It does not give medical advice, a diagnosis or triage.
- It passes clinical questions to the clinic’s staff.
- If a message may be an emergency, Hala tells the person to call 112 and passes the conversation to staff.
- For emergency and clinical handoffs, Hala stores no note about the person or their message. It stores only fixed system notes, such as “Reply not delivered”.
- At clinics, Hala does not open photos or files. It asks patients not to send them and passes the message to staff.
- Hala does not build a long-term profile of anyone’s health. Message text is kept only for the period the clinic sets (section 8).
The clinic is responsible for getting patients’ consent where it is needed, for following Ministry of Health rules, and for its own record-keeping duties.
7. Who we share data with
We share data only with the providers below, and only to run the service. Each one may use the data only for that purpose.
| Provider | What it does |
|---|---|
| Meta (WhatsApp Business Platform) | Carries messages between customers and the client’s WhatsApp number. Meta’s own terms and WhatsApp’s privacy policy apply to WhatsApp itself. |
| An AI model provider (we will name it here before Hala handles real messages) | Runs the AI model that drafts replies and checks messages for emergencies. |
| A cloud hosting provider (we will name it and its server region here before Hala handles real messages) | Hosts our servers and database. |
| Cloudflare | Serves this website, and forwards email sent to info@basirahkw.com to our mailbox. |
| Our email provider | Hosts our mailbox. It holds the email you send us, including requests about your data. |
Some of these providers may process data outside Kuwait. We tell clients where each provider processes data before they sign up, and before we add or change a provider.
We may also share data:
- with the client’s own staff, through the dashboard;
- with authorities, when the law requires it.
8. How long we keep data
- Message text. Each client chooses how long message text is kept. After that period, Hala deletes it automatically every night. This includes the text of drafted replies and staff handoff notes. We keep the record that a message or booking existed, such as its time and status, but not the words.
- Bookings. Kept while the client uses our service, so the client can see its appointment history.
- Client and dashboard user accounts. Kept while the client uses our service.
- Activity log. Records who did what and when, such as approvals and settings changes. It does not contain message text. Kept while the client uses our service.
- When a client leaves. We give the client a copy of its data if it asks. We then delete the client’s data within 30 days, except what the law requires us to keep, such as invoices.
- Backups. Deleted data may stay in encrypted backups for up to 30 days. Then it is overwritten.
9. How we protect data
- Data travels over encrypted connections (HTTPS).
- The access token for each client’s WhatsApp account is stored encrypted. The encryption key is kept apart from the database.
- The database keeps each client’s data separate using row-level security. A request made for one client cannot return another client’s data.
- The dashboard needs a login. Roles limit what each user can do. Repeated failed logins are limited.
- An activity log records important actions.
- Only authorised Basirah staff can reach our live systems, and only when needed to run or support the service.
No system is perfectly secure. If a breach affects a client’s data, we will tell that client promptly.
10. Your choices and rights
If you are a customer who messaged a business that uses Hala, that business controls your data. Please contact it first to ask to see, correct or delete your data. You can also email us at info@basirahkw.com. We will pass your request to the business and help it respond.
If you are a client or a dashboard user, email us at info@basirahkw.com to see, correct or delete your data.
We may ask you to confirm who you are before we act on a request.
11. Deleting your data
If you messaged a business that uses Hala
- Ask the business you messaged to delete your data. It can ask us to delete the text of all your messages.
- Or email info@basirahkw.com with the subject “Delete my data”. Include the name of the business you messaged and the WhatsApp number you used. Please do not include message content or health details.
- We may ask you to confirm that the number is yours.
- We pass your request to the business. When it confirms, we delete the text of your messages and your contact details from Hala, and we reply to confirm. The business may need to keep some records, such as appointment records, when the law requires it.
Deletion covers data in Hala only. It does not reach the chat on your own phone, the business’s own WhatsApp app, or data that Meta holds under WhatsApp’s privacy policy.
Clients: email info@basirahkw.com to close your account. We send you a copy of your data if you ask, then delete it as described in section 8.
Dashboard users: ask your business’s owner to remove your access, or email us.
12. Children
Our service is for businesses. We do not knowingly collect children’s data for our own purposes. If a child messages a client, the client is responsible for that data.
13. This website
This website sets no cookies of its own and runs no analytics or tracking scripts. It is served by Cloudflare, which may set a security cookie and log technical data, such as IP addresses, to protect the site.
14. Changes to this policy
We may update this policy. We will post the new version here with a new effective date. If a change is important, we will tell clients by email before it takes effect.
15. Contact us
BasirahEmail: info@basirahkw.com
Phone: +965 6513 7575