Data protection by region
Our roles
- Website and quote enquiries: we are the controller (or equivalent) of that data.
- Bots we run for clients: the client is the controller (the "business" under US state laws, the "organisation" under Singapore and Canadian law, the "agency" under NZ law), and we are the processor (service provider). We process data only on the client's documented instructions and under a data processing agreement on request.
Health information
Many of our clients are health and wellbeing businesses. Appointment details can reveal health information, which most laws treat as sensitive. We design bots to collect the minimum (name, contact details, preferred time and a short reason) and ask visitors not to share medical details in chat. Clients must decide whether they can lawfully use the service for their patients, especially where rules restrict storing health data outside the country (see UAE and USA below).
| Region | Main rules | How we handle it |
|---|---|---|
| United Kingdom | UK GDPR, Data Protection Act 2018, PECR (electronic marketing) | Processor terms on request; international transfer safeguards; business outreach respects PECR and honours opt-outs. |
| EU / EEA (including Ireland, Netherlands, Denmark, Sweden, Norway) | GDPR, ePrivacy rules, EU AI Act transparency for chatbots | Article 28 processor terms on request; standard contractual clauses for transfers; bots disclose that they are AI; no cookies on this site. |
| United Arab Emirates | Federal Decree-Law No. 45 of 2021 (PDPL); health-sector rules, including the federal health data law (Federal Law No. 2 of 2019), which can restrict storing patient health data outside the UAE; free-zone regimes (DIFC, ADGM) | Minimal data collection. Healthcare clients should confirm whether their use is permitted before sending health details through the bot. We can limit the bot to booking details only. |
| Kuwait | Constitutional privacy protections, the CITRA data privacy regulation for service providers (2021), and general electronic transactions and cybercrime laws | Collect minimum data; clients give their own notice; we apply the same safeguards as elsewhere. |
| Australia | Privacy Act 1988 and the Australian Privacy Principles; Spam Act 2003 | Health information is sensitive information: client consent and notice are required. Outreach follows the Spam Act (consent and unsubscribe). |
| New Zealand | Privacy Act 2020; Health Information Privacy Code 2020; Unsolicited Electronic Messages Act 2007 | Client notice and purpose limits apply; transfers outside NZ need comparable safeguards; outreach honours opt-outs. |
| United States | State privacy laws (for example CCPA/CPRA in California), FTC Act, CAN-SPAM, TCPA for texts and calls, and HIPAA for covered healthcare providers | We do not sell or share personal information. We do not currently sign HIPAA business associate agreements. US clients covered by HIPAA must not send protected health information through our services. Outreach includes opt-out. |
| Canada | PIPEDA and provincial laws; CASL (anti-spam) | Consent and notice are the client's duty; outreach follows CASL. |
| Singapore | Personal Data Protection Act 2012 (PDPA) | Processor protections on request; transfers meet PDPA requirements. |
| India | Information Technology Act 2000 and rules; Digital Personal Data Protection Act 2023 and its rules as they come into force | Grievance contact in our privacy policy; consent notices in plain language. |
International transfers
We are in India and our providers operate worldwide (see subprocessors). Where a law requires a transfer mechanism, we use it, for example standard contractual clauses, the UK addendum, or adequacy decisions.
Retention and deletion
Client bot data is kept for as long as the client's service runs, and deleted or returned on request after the contract ends, unless the law requires otherwise. Enquiries on this website are kept for up to 24 months from the last contact.
Breach notification
We tell the client without undue delay after we become aware of a breach affecting their data, so they can meet their own deadlines (for example 72 hours to a regulator under GDPR).
Requests
Email info@aibotlab.in. For data held in a client's bot, we pass your request to that client.