This policy explains how Prakta handles personal information: what we collect, why, who we share it with, how long we keep it and your rights. Prakta is provided by ANNAPURNA MARKETING SERVICES - FZCO, a company registered in the United Arab Emirates with IFZA, licence number 63195, registered address DSO-IFZO, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates ("we", "us").
1. Who this policy is for
This policy covers:
- people who visit prakta.ai
- people who use Prakta at a practice: doctors, managers and practice staff with a Prakta account
- people who contact us
If you are a patient of a practice that uses Prakta, your practice is responsible for your information and decides how it is used. Please read your practice's own privacy notice. Section 4 explains our role.
2. Who is responsible for your information
- For website visitors, account holders and people who contact us, we are the controller.
- For patient information that a practice puts into Prakta, the practice is the controller and we are its processor. We only use that information to provide Prakta to the practice, on its instructions, under our data processing agreement.
Contact us about privacy at support@prakta.ai.
3. Information we collect about account holders and website visitors
- Account details: name, work email, role, practice, and your password (stored only in scrambled form).
- Security information: sign-in times, two-step sign-in settings, the devices you choose to trust, and an audit log of important actions in your account.
- Information you choose to connect, such as your Google or Microsoft calendar or email (see section 6).
- Messages you send us and support requests.
- Billing details for your practice's subscription. Card payments are handled by Stripe; we never see or store full card numbers.
- Basic technical information when you visit prakta.ai or use Prakta, such as browser type and pages visited, used to keep the service working and secure.
We use this information to provide and secure Prakta, support you, manage your subscription, and improve the service. Our lawful bases are performing our contract with your practice, our legitimate interest in running a secure service, and complying with the law.
4. Patient information (our role as processor)
Practices use Prakta to manage appointments, records, letters, results, documents, payments and messages with their patients. For this information:
- the practice decides what is collected and why, and is responsible for telling patients
- we process it only to provide Prakta to that practice
- each practice's information is kept separate; one practice cannot see another's
- we don't sell it, use it for advertising, or use it to train AI models
- staff at a practice only see what their role allows, and access is recorded
- when a practice erases a patient's record, it is hidden straight away and then deleted, apart from any medical record the law requires the practice to keep until its retention date
Patients who want to see, correct or delete their information should contact their practice. If we receive a request directly, we pass it to the practice.
5. How we keep information safe
- Information is stored in the UK (London) and encrypted when it travels over the internet and when it is stored.
- Patient documents are kept in private storage that can only be opened through Prakta after checking the person has permission, using links that last one minute. Each opening is recorded.
- Every user has their own login, protected by a strong password and two-step sign-in, and is signed out after a period of inactivity.
- Links we send to patients are secured with their date of birth, stop working after a set time, and lock after repeated wrong attempts.
- We regularly review our security and fix issues promptly.
6. Google user data
If you connect a Google account to Prakta, we only use the information Google provides to deliver the features you turn on:
- Sign in with Google: your name and email address, to create and sign in to your account.
- Google Calendar: to show your existing events in your Prakta diary so you aren't double-booked, and, if you choose, to add your Prakta appointments to your calendar.
- Gmail: to show enquiry emails in your practice's Prakta inbox and let you reply from Prakta.
- Google Analytics and Search Console: to show your website's visitor and search figures in Prakta.
We store this information securely only as long as it's needed to provide the feature, and delete it when you disconnect the account or close your Prakta account. We don't sell it, use it for advertising, or let people read it except where you ask us to (for example for support), it's needed for security, or the law requires it.
Prakta's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Google at any time in Prakta (Settings, Connections) or from your Google account's security settings.
7. Who we share information with
We use trusted service providers to run Prakta. They may only use information to provide their service to us:
- Supabase: database and file storage, in London, UK
- Vercel: hosting the Prakta website and app
- Resend: sending emails
- Twilio: sending text messages
- Stripe: card payments
- Daily: video consultations
- Omi Health: turning consultation recordings into text for the scribe, in the EU
- Anthropic (Claude) and OpenAI: preparing drafts such as letters, summaries and answers in Ask Prakta when a user asks
- Google (Gemini): creating images for the practice's website and marketing content
- Google and Microsoft: only for the accounts you choose to connect
We use AI providers under business terms that don't let them use the information to train their models. Drafts are always checked by a person before use.
We may also share information if the law requires it, or with professional advisers under confidentiality.
8. International transfers
Information in Prakta is stored in the UK. Our team is based in the United Arab Emirates and may access it from there, only as needed to run and support Prakta. Some of our providers also process information outside the UK, for example in the European Union or the United States. Whenever information leaves the UK, we use the safeguards UK law requires, such as the UK International Data Transfer Agreement or Addendum, or UK adequacy regulations.
9. How long we keep information
- Account information: while your practice's account is open, then deleted within 90 days of closing, unless the law requires us to keep it longer.
- Patient information: as instructed by the practice under our data processing agreement. When the agreement ends, the practice can export its data before we delete it.
- Security and audit logs: 12 months.
- Support messages: 2 years.
10. Your rights
You have the right to see your information, correct it, ask us to delete it, object to or restrict how we use it, and receive a copy in a portable form. To use these rights, email support@prakta.ai. We will reply within one month.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113).
11. Cookies
See our cookie policy at https://prakta.ai/cookie-policy/.
12. Changes to this policy
If we make important changes, we will update this page and tell account holders by email.
13. Contact
ANNAPURNA MARKETING SERVICES - FZCO, DSO-IFZO, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates. Email: support@prakta.ai.