This is an English translation of the Hungarian Adatkezelési tájékoztató. If the two versions differ, the Hungarian version prevails.
1. The controller
Tokár Ádám egyéni vállalkozó (5700 Gyula, Szőlős utca 4/1., Hungary, tax number: 92003747-1-24, email: hello@clinicai.hu), hereinafter: the Provider. For data protection questions, the Provider can be reached at this email address.
2. Getting in touch and requesting a demo
Data processed: name, the name of the practice, email address and/or phone number, the content of the message. Purpose: answering the request, arranging a demo, making an offer. Legal basis: the consent of the data subject (GDPR Article 6(1)(a)), and steps taken before entering into a contract (GDPR Article 6(1)(b)). Retention: 1 year from the last contact, or until consent is withdrawn.
Text messages: if you book a demo call with a mobile number, you get 1 text message confirming the time. No marketing texts are sent. Message and data rates may apply. Mobile numbers and text message consent are never sold or shared with third parties or affiliates for marketing; they are only passed to the text message processor (see section 7) to deliver that message. To stop texts, email hello@clinicai.hu.
3. The website chat and the voice call
The chat and the voice call that can be started from the browser are a digital assistant that gives information about the ClinicAI services. It gives general health information, which is not medical advice, and is not for emergencies: for urgent symptoms, call 911. Please do not write health data in the chat. The chat and the voice call are run by artificial intelligence, not by a person; when an answer matters, the Provider confirms it in writing.
Data processed: the text of the conversation, the transcript of the voice call, and anything you choose to give (name, practice name, contact details). Purpose: answering questions, recording an enquiry and passing it on to the Provider, checking the quality of the service. Legal basis: consent (GDPR Article 6(1)(a)). Retention: the conversation for 30 days, data recorded as an enquiry as set out in section 2.
To process the texts and the voice, the Provider uses processors (see section 7). For the voice call, the browser asks for microphone permission, and the microphone only switches on when you start the call.
4. Orders, payment and invoicing
Data processed: the Customer's name or company name, billing address, tax number, email address and phone number, the plan ordered, and the payment and invoice details. Card details are handled only by Stripe; the Provider never sees them. Purpose: concluding and performing the contract, collecting the subscription fee, issuing the invoice and keeping in touch. Legal basis: performance of the contract (GDPR Article 6(1)(b)); for issuing and keeping invoices, a legal obligation (GDPR Article 6(1)(c), under the Hungarian VAT Act CXXVII of 2007 and Accounting Act C of 2000). Retention: contract data for 5 years after the contract ends (the general limitation period of the Hungarian Civil Code); invoices and their supporting data for 8 years after the invoice is issued (section 169(2) of the Accounting Act).
If the Customer is a business, the contact person's name, email address and phone number are processed on the basis of the parties' legitimate interests (GDPR Article 6(1)(f)) until the contract ends, and for the 5 years above after that.
5. Cookies and local storage
The website only uses storage that is strictly necessary for it to work: the chat stores a session identifier and the conversation history in the browser's session storage, which is deleted when the tab is closed, and the website remembers that the cookie notice was dismissed. The website uses no analytics, marketing or tracking cookies. The fonts are loaded from the website's own hosting, so no data is sent to an outside provider for them.
6. The data of the practices' patients
For the data of the patients of practices that use the ClinicAI service, the controller is the practice, the Provider is a processor, and acts under the written data processing agreement concluded with the practice (GDPR Article 28). Health data is a special category of data under Article 9 of the GDPR. The Provider applies encrypted data transfer and storage, role-based access and logging of access. Patients can exercise their rights primarily with the practice.
7. Processors
- Hosting and server functions: Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; data stored in the Nuremberg data center, EU)
- Former hosting, copies of data from before October 27, 2026 until they are deleted: Netlify, Inc. (512 2nd Street, Suite 200, San Francisco, CA 94107, USA)
- Text processing in the chat: OpenAI Ireland Ltd. (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland)
- Text processing in the chat when the primary provider is unavailable: Anthropic Ireland, Limited (6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland)
- Voice call control on a self-operated voice server: Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; data stored in the Nuremberg data centre, EU)
- Speech generation: Eleven Labs Inc. (United States of America)
- Speech to text: Soniox, Inc. (United States of America)
- Sending email notifications: Resend (Plus Five Five, Inc., United States of America)
- Online payment: Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland)
- Invoicing: KBOSS.hu Kft. (Számlázz.hu, 1031 Budapest, Záhony utca 7., Hungary)
- Record of orders and invoices: Supabase, Inc. (United States of America; data stored in the Frankfurt data center, EU)
- Sending text messages: Telnyx LLC (United States of America)
- Domain and email: Rackhost Zrt. (6722 Szeged, Tisza Lajos körút 41., Hungary)
For processors outside the European Economic Area, data is transferred on the basis of the standard contractual clauses adopted by the European Commission (GDPR Article 46) or, where the processor is certified, under the EU-US Data Privacy Framework. The processors may use the data only on the Provider's instructions, to provide the service.
8. Your rights
You can request access to your personal data, its rectification, erasure or the restriction of its processing, you can object to the processing, and you can request data portability. You can withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal. You can send your request to hello@clinicai.hu, and the Provider answers within 1 month at the latest.
You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, 1055 Budapest, Falk Miksa utca 9-11., naih.hu), or go to court.
9. Notice for United States residents
In the last 12 months the Provider has collected the following categories of personal information through the website: identifiers (name, email address, phone number), commercial information (the package or service you asked about) and the content of your messages and voice calls. They are used only for the purposes set out in sections 2 and 3, and are disclosed only to the processors listed in section 7 for those purposes.
The Provider does not sell personal information and does not share it for cross-context behavioral advertising. Depending on the state you live in, you may have the right to know what personal information is held about you, to have it corrected or deleted, and to opt out of its sale or sharing. You can exercise these rights by email to hello@clinicai.hu; the Provider verifies the request from that email address and does not treat you differently for exercising them.
HIPAA: ClinicAI is not offered as a HIPAA-covered service, and the Provider does not sign Business Associate Agreements unless agreed in writing. Please do not enter protected health information in the website chat or the demo call.
10. Data security
The Provider transfers data over an encrypted connection, limits access to those who need it for their task, and logs access to the data. In the event of a personal data breach, the Provider acts in accordance with Articles 33 and 34 of the GDPR.
Last updated: October 31, 2026.