Legal

Privacy Policy

Last updated: September 2026 · Effective for all users of salco.app

Salco ("Salco," "we," "us") is a product operated by Innovia Internet LLC. This Privacy Policy explains what information we collect through our website and our conversational CRM platform, how we use it, and the choices you have. It applies to visitors of this website and to the clinics and service businesses ("Customers") that use Salco, and to the contacts and patients those Customers communicate with through Salco ("End Users").

If you are an End User messaging a clinic that uses Salco, your Customer (the clinic) is responsible for how they collect your consent and use your information. Salco acts as their service provider — we process data on their behalf, under the terms of a Data Processing Agreement with that Customer.

1. What we collect

From website visitors

• Contact details you submit voluntarily (e.g., email address, when you request early access).
• Basic, privacy-friendly analytics about how the site is used (pages viewed, approximate location by country, device type). We do not use invasive tracking cookies for advertising.

From Customers (clinics and service businesses)

• Account and billing information: business name, contact details, team member logins, and subscription details.
• Connected-channel credentials: authorization tokens for the Customer's own WhatsApp Business, Instagram, Meta Ads, Google Ads, and Google Search Console accounts, which the Customer connects themselves.

From End Users (contacts messaging a Salco Customer)

• Contact information: name and phone number or social handle, as provided in the conversation.
• Message content sent through WhatsApp or Instagram to the Customer, and attachments (images, documents, voice notes) sent as part of that conversation.
• Appointment and booking details: dates, times, and status (confirmed, completed, no-show, cancelled).
• Advertising click identifiers, where a conversation began from a Meta or Google ad, used to measure which ad or campaign led to a booking.

We minimize what we retain by design. Where possible, clinical or other sensitive details volunteered in a message are not required for the platform to function, and Customers are encouraged to keep outbound messages limited to logistics (date, time, confirmation) rather than sensitive detail — see "Health information" below.

2. How we use information

• To operate the inbox, lead pipeline, scheduling, reminders, and reporting features Customers use.
• To measure which advertising campaigns and messages lead to booked appointments (attribution and reporting), on behalf of the Customer.
• To provide a limited, scoped AI assistant that answers routine questions and helps qualify leads — always disclosed as AI, with a required handoff to a person for anything outside routine questions, and never used to give medical advice.
• To maintain the security, integrity, and reliability of the platform, including fraud prevention and abuse detection.
• To communicate with Customers about their account, and with website visitors who request early access.
• To comply with legal obligations.

We do not sell personal information, and we do not use End User message content to train general-purpose AI models.

3. Health information

Salco is designed so that clinical or health-related detail is not required to travel through automated outbound messages (appointment confirmations and reminders are limited to logistics: date, time, location, and a short reply). For Customers operating in the United States, Salco is built with a HIPAA-aware architecture and enters into Business Associate Agreements with Customers who handle Protected Health Information, where applicable. WhatsApp and Instagram, as messaging channels operated by Meta, are not HIPAA-compliant platforms, and Customers are responsible for not sending clinical detail over those channels.

4. Who we share information with

• Meta Platforms, Inc. — to send and receive messages via the WhatsApp Business Platform and Instagram, as the messaging infrastructure Customers choose to connect.
• Google — to read advertising and search performance data the Customer authorizes, for attribution reporting.
• Infrastructure providers — cloud hosting and backup providers in the United States and the European Union, under data processing agreements, used to run and secure the platform.
• Payment processors — to process subscription billing.
• Legal and regulatory authorities — where required by law.

We do not share End User data with third parties for their own marketing purposes.

5. International data transfers

Salco operates infrastructure in two regions: the United States and the European Union. A Customer's data is generally kept within the region assigned to their account. Where data must cross borders (for example, to comply with a Customer's request or because their business operates in a specific country), we rely on appropriate safeguards, such as standard contractual clauses, consistent with Oman's PDPL, the UAE PDPL, Turkey's KVKK, and other applicable transfer rules.

6. Data retention

We retain Customer account data for as long as the Customer's subscription is active, and End User conversation and appointment data for as long as the Customer's account requires it to operate the service, subject to the Customer's own retention settings and applicable law. When a Customer closes their account, their data is deleted or anonymized within a reasonable period, except where we are required to retain it by law.

7. Security

• Encryption of data in transit (TLS) and at rest.
• Per-tenant data isolation, so one Customer's data is never visible to another.
• Role-based access controls and audit logging.
• Regular, encrypted, tested backups.

No system is perfectly secure, but we design and operate Salco to industry-standard security practices, and we will notify affected Customers and regulators of any data breach as required by applicable law (for example, within 72 hours under Oman's PDPL and Turkey's KVKK).

8. Your rights

Depending on where you are located, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. If you are an End User, please contact the clinic or business you communicated with directly, as they control that data; we will support them in fulfilling your request. If you are a Customer or a website visitor, you can reach us using the contact details below. We aim to respond to verified requests within the timeframes required by applicable law (for example, 45 days under Oman's PDPL).

9. Children's information

Salco is not directed at children, and we do not knowingly collect personal information from children. Where a Customer's business may involve a minor's contact information (for example, a pediatric clinic), the Customer is responsible for obtaining any required parental or guardian consent before that information is processed through Salco.

10. Automated decisions

Salco's AI assistant may suggest a lead status or a routine reply, but it does not make final decisions about a person's care or eligibility for service, and every automated suggestion can be reviewed or overridden by the Customer's staff.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Customers and update the "Last updated" date above.

12. Contact us

Questions about this Privacy Policy, or requests regarding your personal information, can be sent to privacy@salco.app. Salco is a product of Innovia Internet LLC.