Privacy Policy

How Occlus handles personal data on behalf of the dental clinics that use it.

Status: ready for legal review, not yet reviewed

Every factual gap in this policy is now filled. What has not happened is a solicitor reading it. This is a plain-English description of what the software actually does, written by the people who built it, and it describes the system accurately — but accuracy is not the same as legal sufficiency, and a Hong Kong data-protection practitioner should read it before it is published.

Two things to put in front of them: whether the retention periods in §6 are defensible for a booking system that is explicitly not a clinical record, and whether §5’s single-jurisdiction position needs anything more said about cross-border transfer, given PDPO s.33 is still not in force.

One statement here is not yet true. §8 says the database disk is encrypted at rest. That is a DigitalOcean setting chosen when the droplet is created, and there is no production droplet yet. It is a blocking item in the build plan, and this notice comes off at the same moment that box is ticked — they are one step, not two. Everything else on this page describes the system as it behaves today.

1. Who is responsible for your data

Occlus is software operated by Precision Expert Holdings Limited and used by dental clinics to answer their WhatsApp messages.

The clinic you messaged is the data user under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486). It decides what data is collected and why. Precision Expert Holdings Limited is a data processor: we handle patient data only on the clinic’s written instructions, under a data processing agreement with that clinic, and we do not use it for our own purposes.

This is a booking system, not a medical record. Your clinical records — treatment history, charts, X-rays, clinical notes — are held by the clinic in their own practice management system, under their own obligations, which are longer and stricter than ours. Occlus holds only what is needed to arrange an appointment, and holds it for a much shorter time. Nothing in this policy shortens or replaces what the clinic must keep.

If you want your data changed or removed, the clinic is the right place to start. §7 explains how.

2. What we collect

Only what arrives through the WhatsApp conversation with the clinic, and what is needed to book an appointment:

Your name — as you give it, so the clinic knows who the appointment is for. One phone number is often shared by a family, so we ask each time who the appointment is for.
Your phone number — the WhatsApp number you message from. It identifies the conversation and links it to your appointments.
Your reason for visit — the procedure you are booking, from the clinic’s own list of services.
The content of your messages — what you write to the clinic, and what is sent back to you. See the note below about what we store.
Appointment details — date and time, clinic location, assigned dentist, and whether the appointment was kept, cancelled or missed.
Basic conversation timings — when you first messaged, when you were first answered, whether it was outside opening hours, and whether the conversation was handled by the assistant or passed to a staff member.

What we do not keep

The text of your messages is not stored in the clinic’s records. What we record is the outcome — the appointment, and the timings above.

While a message is being answered it sits briefly in a processing queue. That queue clears within an hour, or within 24 hours if something went wrong and the message had to be retried. After that the text is gone from our systems entirely. It is never written to the clinic’s database.

Voice notes are not supported. If you send one, the assistant cannot listen to it and will hand the conversation to a member of staff. No audio is transcribed, processed or stored.

We do not ask for and do not want your ID number, address, payment card details, or your medical or dental history. Please do not send them over WhatsApp.

3. Why we use it

To book, reschedule and cancel your appointments.
To answer questions about opening hours, address, parking, prices from the clinic’s own price list, and the clinic’s own list of common questions.
To send you an appointment reminder about 24 hours ahead.
To pass your conversation to clinic staff when the assistant should not answer — anything clinical, an emergency, insurance, a complaint, or a question about past treatment.
To show the clinic aggregate counts about its own messages and bookings — how many appointments were booked, how quickly enquiries were answered, how many needed a human. These are counts and averages, not a report about you.
To tell the clinic’s own staff that something urgent has come in, so that somebody rings you. That alert goes to a phone number or an address the clinic gave us, and it says only which kind of problem (for example “facial swelling”) and which branch. It does not contain your name, your phone number, or anything you wrote.

We do not use your data to send marketing, and we do not sell it or share it with anyone for direct marketing. The assistant only ever replies to a conversation you started with the clinic.

4. What the assistant will not tell you

This is a deliberate design rule, not just a policy statement. The automated assistant can confirm what it has just done in the conversation you are currently having — the appointment it has booked or cancelled with you. It will never read stored records back to whoever is holding the phone. If a message asks about a previous visit or a past appointment, the conversation is handed to clinic staff instead.

Cancelling or rescheduling only ever affects appointments booked from the same phone number.

5. Where your data goes, and where it stays

Everything is in Singapore. Both the server holding the clinic’s database and the AI service that reads your message run in Singapore, and that is a deliberate choice rather than a coincidence of hosting. It keeps patient data in one jurisdiction, and out of mainland-hosted infrastructure.

DigitalOcean — a single private server in their Singapore region (sgp1), holding the clinic’s database.
Alibaba Cloud International, Singapore region — runs the Qwen language model. This is the only AI provider we use, and it handles every AI task: reading your message, drafting the reply, working out what you are asking for, and summarising a conversation for staff.
Meta (WhatsApp Business Platform) — carries the messages between you and the clinic, under WhatsApp’s own terms and its own infrastructure, which is not ours to place.

We use one AI provider, in one region, on purpose. We do not send your messages to a second AI company for cheaper or faster handling of smaller tasks. Working out which language you wrote in is done by our own software on our own server, by looking at the characters, with no AI model and no message leaving our system. Adding any further AI provider would require us to re-check where that company stores data before we did it.

Urgent alerts to clinic staff do not add anyone new. They travel over the same WhatsApp connection above, or to a web address the clinic itself operates. No additional company handles them. If we ever added one — a text-message service, for example — we would name it here first.

We otherwise disclose data only to the clinic itself, or where we are required to by law.

6. How long we keep it

The Ordinance does not set a period. It requires us to have a clear policy and not to keep personal data for longer than the purpose needs. Our purpose is booking appointments, so our periods are short — the clinic’s clinical record obligations are separate, longer, and held in their own system.

Conversations — 90 days. After 90 days your phone number is removed from the conversation record. What remains is anonymous: when a message arrived, how quickly it was answered, and whether a person was involved. Nothing left identifies you.
Why we clear the number rather than delete the whole record: the clinic is shown counts about its own service — how quickly enquiries get answered, how many arrive out of hours. Those counts are not about you, and once your phone number is gone the record cannot be traced back to you. Deleting the record outright would take away the clinic’s own history along with your data, which the Ordinance does not ask for and the clinic would not expect.
Appointments — 24 months. Then deleted outright, name and all. Two years so that the clinic can compare a month against the same month a year earlier.
Technical delivery records — 30 days. We keep a record of which WhatsApp messages we have already handled, so a message re-sent by WhatsApp does not get answered twice. It holds no message content.

These are enforced automatically, every night, not applied by hand on request. Where a clinic instructs us to delete its data, or stops using Occlus, we delete or return that clinic’s data in line with our agreement with them.

7. Your rights, and how to use them

Under the PDPO you may ask for a copy of the personal data held about you (a data access request), and ask for it to be corrected if it is wrong.

Send the request to the clinic. The clinic is the data user and is the party that must answer — ordinarily within 40 days of receiving the request. Contact the clinic on the same WhatsApp number you have been messaging, or by phone.

The clinic can reach us to retrieve or correct anything held in Occlus, and we help them meet that deadline. If you would rather contact us directly, write to:

Precision Expert Holdings Limited
Flat B, 21/F, Yally Industrial Building
6 Yip Fat Street, Wong Chuk Hang, Hong Kong

We will pass your request to the clinic and support them in answering it. We cannot release records to you ourselves without the clinic’s instruction, because the records are theirs, not ours.

You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).

8. How your data is protected

Encrypted at rest. The disk holding the clinic’s database is encrypted by DigitalOcean at the host level, so the stored data is unreadable without the server. (See the note at the top of this page: this is switched on when the server is created, and must be confirmed before this policy is published.)
Separated per clinic. Every record belongs to exactly one clinic organisation, and every query is filtered by it. One clinic cannot see another’s patients.
Limited logging. Our diagnostic logs never contain treatment detail beyond the name of the procedure being booked, and never contain message text or phone numbers.
Human handover. When clinic staff reply from their own phone, the assistant stops immediately.

9. Changes

If this policy changes materially, we update this page and notify the clinics using Occlus.

Effective date: 30 August 2026 · Operated by Precision Expert Holdings Limited, Flat B, 21/F, Yally Industrial Building, 6 Yip Fat Street, Wong Chuk Hang, Hong Kong