This is an English translation of the Hungarian Adatkezelési tájékoztató. If the two versions differ, the Hungarian version prevails.
1. The controller
Tokár Ádám egyéni vállalkozó (5700 Gyula, Szőlős utca 4/1., Hungary, tax number: 92003747-1-24, email: hello@clinicai.hu), hereinafter: the Provider. For data protection questions, the Provider can be reached at this email address.
2. Getting in touch and requesting a demo
Data processed: name, the name of the clinic, email address and/or phone number, the content of the message. Purpose: answering the request, arranging a demo, making an offer. Legal basis: the consent of the data subject (GDPR Article 6(1)(a)), and steps taken before entering into a contract (GDPR Article 6(1)(b)). Retention: 1 year from the last contact, or until consent is withdrawn.
Text messages: if you book a demo call with a mobile number, you get 1 text message confirming the time. No marketing texts are sent. Message and data rates may apply. Mobile numbers and text message consent are never sold or shared with third parties or affiliates for marketing; they are only passed to the text message processor (see section 7) to deliver that message. To stop texts, email hello@clinicai.hu.
3. The website chat and the voice call
The chat and the voice call that can be started from the browser are a digital assistant that gives information about the ClinicAI services. It gives general health information, which is not medical advice, and is not for emergencies: for urgent symptoms, call 999, or 111 for urgent advice. Please do not write health data in the chat. The chat and the voice call are run by artificial intelligence, not by a person; when an answer matters, the Provider confirms it in writing.
Data processed: the text of the conversation, the transcript of the voice call, and anything you choose to give (name, clinic name, contact details). Purpose: answering questions, recording an enquiry and passing it on to the Provider, checking the quality of the service. Legal basis: consent (GDPR Article 6(1)(a)). Retention: the conversation for 30 days, data recorded as an enquiry as set out in section 2.
To process the texts and the voice, the Provider uses processors (see section 7). For the voice call, the browser asks for microphone permission, and the microphone only switches on when you start the call.
4. Orders, payment and invoicing
Data processed: the Customer's name or company name, billing address, tax number, email address and phone number, the plan ordered, and the payment and invoice details. Card details are handled only by Stripe; the Provider never sees them. Purpose: concluding and performing the contract, collecting the subscription fee, issuing the invoice and keeping in touch. Legal basis: performance of the contract (GDPR Article 6(1)(b)); for issuing and keeping invoices, a legal obligation (GDPR Article 6(1)(c), under the Hungarian VAT Act CXXVII of 2007 and Accounting Act C of 2000). Retention: contract data for 5 years after the contract ends (the general limitation period of the Hungarian Civil Code); invoices and their supporting data for 8 years after the invoice is issued (section 169(2) of the Accounting Act).
If the Customer is a business, the contact person's name, email address and phone number are processed on the basis of the parties' legitimate interests (GDPR Article 6(1)(f)) until the contract ends, and for the 5 years above after that.
5. Cookies and local storage
The website only uses storage that is strictly necessary for it to work: the chat stores a session identifier and the conversation history in the browser's session storage, which is deleted when the tab is closed, and the website remembers that the cookie notice was dismissed. The website uses no analytics, marketing or tracking cookies. The fonts are loaded from the website's own hosting, so no data is sent to an outside provider for them.
6. The data of the clinics' patients
For the data of the patients of clinics that use the ClinicAI service, the controller is the clinic, the Provider is a processor, and acts under the written data processing agreement concluded with the clinic (GDPR Article 28). Health data is a special category of data under Article 9 of the GDPR. The Provider applies encrypted data transfer and storage, role-based access and logging of access. Patients can exercise their rights primarily with the clinic.
7. Processors
- Hosting and server functions: Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; data stored in the Nuremberg data centre, EU)
- Former hosting, copies of data from before 27 October 2026 until they are deleted: Netlify, Inc. (512 2nd Street, Suite 200, San Francisco, CA 94107, USA)
- Text processing in the chat: OpenAI Ireland Ltd. (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland)
- Text processing in the chat when the primary provider is unavailable: Anthropic Ireland, Limited (6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland)
- Voice call control on a self-operated voice server: Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; data stored in the Nuremberg data centre, EU)
- Speech generation: Eleven Labs Inc. (United States of America)
- Speech to text: Soniox, Inc. (United States of America)
- Sending email notifications: Resend (Plus Five Five, Inc., United States of America)
- Online payment: Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland)
- Invoicing: KBOSS.hu Kft. (Számlázz.hu, 1031 Budapest, Záhony utca 7., Hungary)
- Record of orders and invoices: Supabase, Inc. (United States of America; data stored in the Frankfurt data centre, EU)
- Sending text messages: Telnyx LLC (United States of America)
- Domain and email: Rackhost Zrt. (6722 Szeged, Tisza Lajos körút 41., Hungary)
For processors outside the European Economic Area, data is transferred on the basis of the standard contractual clauses adopted by the European Commission (GDPR Article 46) or, where the processor is certified, under the EU-US Data Privacy Framework. The processors may use the data only on the Provider's instructions, to provide the service.
8. Your rights
You can request access to your personal data, its rectification, erasure or the restriction of its processing, you can object to the processing, and you can request data portability. You can withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal. You can send your request to hello@clinicai.hu, and the Provider answers within 1 month at the latest.
You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, 1055 Budapest, Falk Miksa utca 9-11., naih.hu), or go to court.
9. Additional information for the United Kingdom
Where you are in the United Kingdom, the processing described here is also subject to the UK GDPR and the Data Protection Act 2018, and the rights in section 8 apply to you in the same way. Data is transferred to processors outside the United Kingdom under the UK International Data Transfer Addendum to the standard contractual clauses, or under the UK Extension to the EU-US Data Privacy Framework where the processor is certified.
Cookies and electronic marketing (PECR). The website only uses storage that is strictly necessary for it to work (section 5), so no consent is needed for it. The Provider does not send marketing emails to UK recipients without the consent required by the Privacy and Electronic Communications Regulations.
You can also lodge a complaint with the Information Commissioner's Office (ico.org.uk).
10. Data security
The Provider transfers data over an encrypted connection, limits access to those who need it for their task, and logs access to the data. In the event of a personal data breach, the Provider acts in accordance with Articles 33 and 34 of the GDPR.
Last updated: 31 October 2026.