Privacy Policy

Effective 27 September 2026. HEONIX AI, Coimbatore, Tamil Nadu, India.

HEONIX AI builds and operates AI assistants that answer messages on WhatsApp and Instagram for clinics and real-estate businesses. This policy explains what data passes through that service, who it reaches, and what you can ask us to do with it.

What we handle

From the client

• Business details used to configure the assistant: name, address, timings, services, fees, staff names, policies.
• Contact details of the owner or manager, for alerts and support.
• Billing details. Card and bank details are handled by the payment gateway and are never stored on our servers.

From the end customer, through the client's channel

• The phone number or Instagram handle the message arrives from.
• The content of the conversation, including anything the person chooses to type.
• Timestamps, and appointment or enquiry details created during the conversation.

Why we handle it

To deliver the service the client has contracted for: answering messages, booking appointments or site visits, alerting the owner to urgent cases, and keeping context across a returning customer's conversations. We also use aggregate, non-identifying counts to keep the service running and to bill correctly.

Who else it reaches

Running a WhatsApp assistant is not possible without third parties. We name them rather than leave them implied.

We do not sell data, and we do not share it with anyone outside the list above. We do not use one client's data to serve another client. If that list changes, this page changes with it.

Cookies, analytics and this website

This website sets no cookies and carries no advertising or tracking pixels. Nothing you do here is stored in your browser or profiled. Every file, the fonts included, comes from this website itself: reading it sends nothing to Google or any other third party. Three things are worth naming:

• Anonymous counts. The site counts what happens on it — a page viewed, a demo started, the WhatsApp button pressed — as daily totals, with the page and the button it happened on. No IP address, browser details or message text is recorded, so a count cannot be linked to you. To stop fake counts, each page carries a random code that expires within 12 hours; it is not a cookie and is never stored with the counts. If your browser sends Global Privacy Control or Do Not Track, you are not counted at all. To stop abuse of the live demo, requests are also counted per visitor for up to an hour; for that the database keeps only a salted hash of the IP address, never the address itself, and deletes it when the hour is up.
• The live demo. If you open it and type, the business details and messages you enter are sent, through this website, to our engine to generate replies. The website keeps no copy of what you type; it counts only whether the demo worked. Demo conversations are created against a placeholder number, not a real one, and are periodically purged.

• The "Request a live demo" form. It sends nothing to us and stores nothing. It only opens WhatsApp with the name, number and business type you typed already written into a message. Nothing is sent until you press send in WhatsApp, and from then on it is an ordinary WhatsApp message to us.

Enquiries reach us over WhatsApp or email, and those carry whatever your WhatsApp profile or email client sends. How we protect data, and the checks that keep the assistant within its limits, are set out on our security page.

Retention and deletion

Conversation data is kept while the client's service is active, because the assistant uses it to recognise returning customers. A client may request deletion of their data, or of a specific end customer's data, at any time by writing to the address below. We action it within 30 days, other than anything we must keep for tax or legal reasons. Within 90 days of an account closing, we delete client and end-customer data.

Security

Access to client data is limited to the founder. Data is encrypted in transit. Stored customer data is encrypted at rest. No system is perfect, and anyone who claims otherwise is selling something. If a breach affects your data we will tell you without delay. For a client's customer data, the client, as Data Fiduciary, then informs the people affected and the Data Protection Board, and we give it everything it needs to do that in time; for data we control ourselves, we inform them directly, as the DPDP Act requires.

Your rights

• Ask what data we hold about you and why.
• Ask us to correct anything inaccurate.
• Ask us to delete it.
• Nominate someone to exercise these rights if you cannot.
• Withdraw consent at any time: reply STOP to the business on WhatsApp, or write to us. Withdrawing does not undo what was lawfully done before.
• Complain to us first, and to the Data Protection Board of India if we fail you.

Children

The service is sold to businesses, not to individuals under 18. Where a parent messages a clinic about a child, that data is handled as the clinic's patient data under the clinic's own obligations.

Medical information

For clinic clients, a conversation may contain health information. The assistant is built never to diagnose or prescribe, and urgent cases are escalated to the clinic. Health information is handled only to schedule, inform and escalate. It is never used for advertising and never sold.

Changes

If this policy changes materially, active clients are told by email before it takes effect.

Contact and grievance officer

For anything in this policy, including a data request or a complaint, contact the grievance officer directly. Under the DPDP Act you are entitled to a response.