Privacy Policy

• Personal data — information relating to an identified or identifiable data subject, recorded on electronic, paper or other tangible media.
• Data subject — a natural person to whom the personal data relates.
• Operator — Syntony LLP or a clinic that determines the purposes and means of processing personal data.
• Processor — a person that processes personal data on behalf of the operator.
• Processing of personal data — collection, recording, systematisation, accumulation, storage, modification, use, depersonalisation, blocking, deletion and destruction of personal data.
• Clinic — a Syntony client (a medical or other organisation) that uses the platform and acts as the operator of its clients' (patients') data.
• Clinic client — a patient or other person contacting the clinic whose data is processed in the platform on the clinic's behalf.
• Platform (Service) — the Syntony AI software: CRM, AI agents, the messaging module and related services.
• WhatsApp Business API — the Meta Platforms interface for exchanging messages via WhatsApp on behalf of the clinic.
• Cookies — small text files stored in the browser for the operation and analytics of the site.
• IP address — the network address of the device used to access the Service.

This Policy applies to the syntony.kz website and the Syntony AI platform. The Syntony AI platform is a CRM, AI agents and messaging solution for clinics.

With respect to the data of website users and CRM account holders, we act as the operator. With respect to the data of clinics' clients (patients) processed in the CRM and through connected communication channels, we act as a processor acting on behalf of the clinic — the operator of such data.

Use of the Service constitutes consent to this Policy. If you do not agree with the terms, do not use the Service.

• Website users' data (demo request form): name, phone number, organisation name, preferred communication channel, message text.
• CRM users' data (clinic staff): full name, phone number, email, position and role, access credentials.
• Clinic clients' data (processed on the clinic's behalf): name, phone number, correspondence and attachments in connected channels, history of requests and appointments, message statuses, and other information the clinic enters into the CRM.
• Leads from advertising lead forms the clinic connects (Facebook and Instagram Lead Ads, TikTok Lead Generation): name, phone number, answers to the form questions, and the campaign, ad and form identifiers.
• Technical data: WhatsApp Business Account identifiers, phone_number_id, message identifiers (WAMID), IP address, cookie data, event and diagnostic logs.

Special categories and medical information are processed solely to the extent that the clinic itself enters them into the CRM, and only on its instructions. Syntony does not determine the composition of such data.

We process personal data on the following grounds provided for by the legislation of the Republic of Kazakhstan:

• consent of the data subject;
• performance of a contract to which the subject is a party (provision of the Service to the clinic);
• instructions of the clinic-operator — for the data of clinic clients;
• legitimate interests of the operator (ensuring the operation, security and development of the Service) that do not infringe the subject's rights;
• compliance with legal requirements.

• identification and registration of users, provision of access to the platform;
• provision of CRM, AI agent and messaging features;
• receiving, delivering and displaying messages over connected communication channels;
• scheduling clinic clients, reminders and handling of requests;
• providing technical support;
• ensuring security, preventing fraud, diagnosing errors;
• improving and developing the Service, service quality analytics;
• sending service and (with consent) informational messages;
• fulfilling contractual obligations and legal requirements.

The platform uses AI agents to automatically process messages and generate responses on behalf of the clinic. To generate responses, messages may be processed by AI model providers solely within the operation of the Service.

An AI agent is an auxiliary tool. It does not provide medical, legal or other professional advice and does not replace a specialist. The clinic and its specialists are responsible for medical and organisational decisions.

If a clinic connects the WhatsApp Business API, Syntony receives and sends messages on behalf of that clinic via the Meta Cloud API. This data is used only to deliver correspondence, statuses, templates, media and related CRM features.

Data is processed in the same way when Telegram, Instagram, web chat and other channels are connected — to the extent necessary to exchange messages. Processing on the side of Meta and other providers is governed by their own privacy policies.

If a clinic connects Facebook and Instagram Lead Ads (Meta) or TikTok Lead Generation, Syntony receives the answers a person submits in that clinic's lead form — usually name and phone number, plus the questions the clinic set up — together with the campaign, ad and form identifiers. This data is used only to create a lead in that clinic's CRM, attribute it to the ad and, if the clinic turns this on, send the person a WhatsApp reply. The access the clinic grants is stored encrypted, can be revoked at any time in the clinic's Meta or TikTok settings, and stops being used when the clinic disconnects the integration in Syntony.

We do not sell personal data. Sharing is only possible with:

• IT infrastructure and hosting providers that ensure the operation of the Service;
• Meta Platforms — for the operation of the WhatsApp Business API, and other providers of connected channels;
• integration services connected by the clinic itself;
• AI model providers — to generate responses;
• state authorities — where there is a lawful requirement.

Relations with all processors are built on terms of confidentiality and data protection.

As a general rule, data is processed and stored on infrastructure located in the territory of the Republic of Kazakhstan.

When using certain providers (for example, the WhatsApp Business API or AI models), cross-border data transfers are possible. In such cases, transfers are carried out provided that the subject's rights are protected in accordance with the legislation of the Republic of Kazakhstan.

Personal data is stored for as long as necessary for the purposes of processing, performance of the contract, ensuring security and complying with legal requirements.

Clinic clients' data is stored for the period determined by the clinic-operator. Upon expiry of the periods or following a justified request, the data is deleted or depersonalised.

We apply technical and organisational protection measures: role-based access control, encryption in transit and at rest (where applicable), logging, backups and control of staff access.

Only authorised employees have access to the data, to the extent necessary for their duties.

The site and platform use cookies for authentication, saving settings and usage analytics. Users can restrict cookies in their browser settings — this may affect the operation of certain features.

The data subject has the right to:

• obtain information about the processing of their data and access to it;
• request correction of inaccurate or incomplete data;
• obtain a copy of your personal data in a structured, commonly used format;
• request blocking or deletion of data processed in violation of the law;
• withdraw previously given consent; withdrawal does not affect the lawfulness of processing carried out before the withdrawal;
• object to processing and request its restriction;
• appeal the operator's actions to the authorised body for the protection of personal data of the Republic of Kazakhstan.

CRM users can view and correct some of their data directly in their Personal Account. To exercise your rights, send a request to support@syntony.kz. Rights regarding clinic clients' data are exercised through the relevant clinic-operator.

To request deletion of data, write to support@syntony.kz or contact the clinic you corresponded with.

After verifying the request and confirming the applicant's identity, we delete the relevant data within 30 days, except where retention is required by law.

We may amend this Policy. The current version is published on the website with the date of update. We notify users of material changes by available means.