Privacy Policy

This Privacy Policy explains how CircaAI (“CircaAI”, “we”, “us”) collects, uses, and shares information when clinics and their patients use our post-operative recovery communication assistant (the “Service”).

If you are a clinic using CircaAI, you may be a “data controller” (or equivalent) for patient data you provide to the Service. Patients may also interact with the Service through clinic-approved channels.

• Clinic account information: clinic name, contact details, administrative users.
• Patient communication data: messages sent to/from the Service, timestamps, and related context provided by the clinic (e.g., procedure type, post-op day).
• Safety and escalation events: flags, escalations, and relevant excerpts needed for clinical review.
• Technical data: device/browser data when accessing dashboards, approximate location from IP, logs, and diagnostics.

Please avoid sending highly sensitive information unless the clinic has configured the Service to collect it and you have the proper legal basis to do so.

• Provide and operate the Service (respond to questions, run follow-ups, escalate risk signals).
• Maintain security, prevent abuse, and audit access.
• Improve reliability and product performance (e.g., debugging, monitoring, and quality evaluation).
• Communicate with clinics about product updates and support requests.

Depending on applicable law, we process information based on one or more of the following: performance of a contract, legitimate interests (e.g., security and product improvement), compliance with legal obligations, and/or consent where required. Clinics are responsible for determining the appropriate legal basis for patient data they provide.

• With the clinic: patients’ messages, summaries, flags, and escalations are shared with the clinic team as configured.
• Service providers: vendors that help host, store, and operate the Service (e.g., cloud infrastructure), under contractual obligations.
• Legal and safety: if required by law, or to protect rights, safety, and security.

We retain information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Clinics may request deletion or export of clinic data subject to legal and contractual requirements.

We implement technical and organizational measures designed to protect information (e.g., access controls, encryption in transit, and monitoring). No method of transmission or storage is 100% secure.

The Service may involve processing in countries other than where you live or where the clinic operates. Where required, we use appropriate safeguards for cross-border transfers.

Depending on your jurisdiction, you may have rights such as access, correction, deletion, objection, or portability. Patients should typically contact their clinic first, since the clinic controls the care relationship and most patient records.

Questions or requests? Email: naama.avisror@circaai.org

Operator: Naama Dayan Avisror · Zemer Hana 3, Apt 11, Tel Aviv-Yafo, 6291077, IL