Privacy policy
Last updated: 10 November 2026
1. Who we are
Columba Labs Limited ("we", "us") is a company registered in England and Wales (company number 17563030), registered office 12 Curzon Place, Pinner, England, HA5 2TQ. We provide WhatsApp appointment booking software to clinics.
Privacy contact: Devanshu Kapoor, director, [email protected]. Contact this address for any privacy question or request.
2. Patients of our clinic customers
When you message a clinic that uses our service, the clinic decides how your information is used, and we act on its behalf (a "data intermediary" under Singapore's Personal Data Protection Act, and a "processor" under UK data protection law). Please read the clinic's own privacy notice, and contact the clinic about your records.
We process patient data only on behalf of clinics, host it in Singapore, and do not keep a copy of patient records: conversations are held in memory for about an hour, and we keep only short-lived processing items and pseudonymous flags needed to honour opt-outs and avoid duplicate reminders. Messages pass through WhatsApp (Meta), which may process them outside Singapore.
| What | Why | How long |
|---|---|---|
| Your WhatsApp number, name and messages in an ongoing conversation | To book, change or cancel your appointment in the clinic's system | Held in memory for about an hour |
| Booking changes waiting to be saved to the clinic's system | So a change is not lost if the clinic's system is briefly unavailable | Until saved, at most 24 hours |
| A coded flag (not your number in plain form) when you reply STOP | So you do not receive further messages | Until you opt in again or the clinic stops using our service |
| A record that a reminder was sent (clinic and appointment reference only) | So you do not get the same reminder twice | Deleted after the appointment date |
| Technical logs with phone numbers masked | To keep the service secure and working | 30 days |
This section describes our service as designed for clinic pilots; it will be updated if anything changes before launch.
Typed messages may be checked by an AI model hosted in Singapore (Google Cloud) to understand what you are asking, after phone numbers, identity numbers and names are removed. The AI does not give medical advice and does not see the clinic's records. No decisions with legal or similarly significant effects are made about you by automated means: the AI only works out what you are asking. Please do not send medical details by WhatsApp; in an emergency call 995.
3. Clinic staff, business contacts and website visitors
For our own business we use the names, work email addresses and phone numbers of clinic staff and other business contacts to provide the service, support it, invoice and keep accounts. Our legal bases under UK data protection law are performing our contract and our legitimate interests in running the business. We keep this information for as long as we work together and then for the period required for accounting and tax records (normally six years).
This website uses no cookies, analytics or tracking. Our website host, Cloudflare, keeps standard server logs (such as IP addresses) for a short time, which may be processed outside the UK. We rely on our legitimate interest in keeping the website secure.
4. Who we share data with
- Meta (WhatsApp), to send and receive messages. We connect to WhatsApp directly, with no reseller in between.
- Cloudflare, to host this website.
- Zoho (UK data centre), for our business email.
- Google Cloud (Singapore region), for hosting, encrypted storage and the AI model.
- The clinic's practice management system provider, to read and write appointments.
- Professional advisers and authorities when the law requires it.
We do not sell personal data or use patient data for marketing.
5. International transfers
Patient data is stored in Singapore. Our team is based in the United Kingdom and may administer the service from there. The service is designed so that our team does not view patient data, and we do not download it. Where personal data is transferred, we use safeguards required by Singapore and UK law, such as contracts with our providers.
6. Security
Data is encrypted in transit and at rest, access to production systems is restricted, and our logs mask phone and identity numbers. If a breach affects a clinic's data, we tell the clinic promptly so it can meet its legal duties.
7. Your rights
Patients: please contact the clinic first; we will help the clinic answer you. Others: you can ask us for access to or correction of your personal data and, under UK law, for its deletion, restriction or portability, or object to our use of it. Write to [email protected]. You can also complain to Singapore's Personal Data Protection Commission (pdpc.gov.sg) or the UK Information Commissioner's Office (ico.org.uk).
8. Changes
We will post any change to this policy on this page with a new date.