# Privacy Policy — HEONIX AI

> How HEONIX AI handles client and customer data, who it reaches, and how to have
> it deleted. Effective 27 September 2026. HEONIX AI, Coimbatore, Tamil Nadu, India.

**Canonical URL:** https://heonixai.in/privacy

HEONIX AI builds and operates AI assistants that answer messages on WhatsApp and
Instagram for clinics and real-estate businesses.

**Two different people are covered here.** The **client** is the business that
hires us. The **end customer** is the patient or buyer who messages that business.
For end-customer data the client is the Data Fiduciary and HEONIX AI acts as a Data
Processor on the client's instructions.

## What we handle

**From the client:** business details used to configure the assistant (name,
address, timings, services, fees, staff names, policies); contact details of the
owner or manager; billing details (card and bank details are handled by the payment
gateway and never stored on our servers).

**From the end customer, through the client's channel:** the phone number or
Instagram handle the message arrives from; the content of the conversation;
timestamps, and appointment or enquiry details created during the conversation.

## Why we handle it

To deliver the service the client has contracted for: answering messages, booking
appointments or site visits, alerting the owner to urgent cases, and keeping
context across a returning customer's conversations. We also use aggregate,
non-identifying counts to keep the service running and to bill correctly.

## Who else it reaches

<!-- vendors:begin (generated from _local/src/vendors.mjs) -->
| Party | Role |
| --- | --- |
| Meta Platforms | WhatsApp Business Cloud API and Instagram Messaging API. Every message to and from the customer passes through Meta, under Meta's own terms. |
| Google (Gemini API) | Writes the assistant's replies. The message content needed for each reply is sent to Google to produce it. |
| OpenAI | A backup AI provider. Used only if Google's service fails, and only while it is switched on in our engine; then the same message content is sent to OpenAI to produce the reply. |
| Anthropic (Claude API) | A second backup AI provider, under the same conditions as OpenAI. |
| Render | Runs the HEONIX engine and its database. Phone numbers and chats are stored there encrypted with AES-256-GCM. |
| Cloudflare | Hosts this website and the live demo's gateway. It handles every request to the site, as any web host does, and stores the anonymous counts described below. |
| Payment provider | Collects the setup and monthly fees. It receives billing details; we do not store card or bank details. |
<!-- vendors:end -->

We do not sell data, and we do not share it with anyone outside that list. We do
not use one client's data to serve another client.

## Cookies, analytics and this website

This website sets **no cookies** and carries **no advertising or tracking
pixels**. Every file, the fonts included, comes from this website itself: reading
it sends nothing to Google or any other third party. Three things are worth naming:

- **Anonymous counts.** The site counts what happens on it — a page viewed, a demo
  started, the WhatsApp button pressed — as daily totals, with the page and the
  button it happened on. No IP address, browser details or message text is recorded, so a count cannot be
  linked to you. To stop fake counts, each page carries a random code that expires
  within 12 hours; it is not a cookie and is never stored with the counts. If your
  browser sends Global Privacy Control or Do Not Track, you are not counted at all. To stop abuse of the live demo, requests are also counted per visitor for up to an hour; for that the database keeps only a salted hash of the IP address, never the address itself, and deletes it when the hour is up.
- **The live demo.** If you open it and type, the business details and messages
  you enter are sent, through this website, to our engine to generate replies. The
  website keeps no copy of what you type; it counts only whether the demo worked.
  Demo conversations use a placeholder number and are periodically purged.

- **The "Request a live demo" form.** It sends nothing to us and stores nothing. It opens
  WhatsApp with your details already written; nothing is sent until you press send there.

Enquiries reach us over WhatsApp or email. Security controls: https://heonixai.in/security

## Retention and deletion

Conversation data is kept while the client's service is active. A client may
request deletion of their data, or of a specific end customer's data, at any time.
We action it within 30 days, other than anything we must keep for tax or legal
reasons. Within 90 days of an account closing, we delete client and end-customer
data.

## Security

Access to client data is limited to the founder. Data is encrypted in transit.
Stored customer data is encrypted at rest. If a breach affects your data we will tell you without delay. For a client's customer data, the client, as Data Fiduciary, then informs the people affected and the Data Protection Board, and we give it everything it needs to do that in time; for data we control ourselves, we inform them directly, as the DPDP Act requires.

## Your rights

- Ask what data we hold about you and why
- Ask us to correct anything inaccurate
- Ask us to delete it
- Nominate someone to exercise these rights if you cannot
- Withdraw consent at any time: reply STOP to the business on WhatsApp, or write to us
- Complain to us first, and to the Data Protection Board of India if we fail you

## Children

The service is sold to businesses, not to individuals under 18. Where a parent
messages a clinic about a child, that data is handled as the clinic's patient data
under the clinic's own obligations.

## Medical information

For clinic clients, a conversation may contain health information. The assistant is
built never to diagnose or prescribe, and urgent cases are escalated to the clinic.
Health information is handled only to schedule, inform and escalate. It is never
used for advertising and never sold.

## Changes

If this policy changes materially, active clients are told by email before it takes
effect.

## Contact and grievance officer

| Field | Value |
| --- | --- |
| Grievance officer | Mohammed Haroon J, Founder |
| Entity | HEONIX AI, a sole proprietorship of Mohammed Haroon J, registered MSME (UDYAM-TN-03-0324205) |
| Email | haroon@heonixai.in |
| Phone | +91 63801 95623 |
| Location | Coimbatore, Tamil Nadu, India |