Qub-X CRM Privacy Policy

Depending on how a clinic uses the Service, we process the following categories of information:

• Account information: clinic staff names, email addresses, and role assignments used to sign in to the Service.
• Channel credentials: OAuth tokens and API keys for the messaging platforms a clinic connects (e.g. Facebook, Instagram, WhatsApp, LINE, Zalo, KakaoTalk, WeChat, TikTok, Telegram), stored encrypted at rest.
• Message content: inbound and outbound messages, including text, images, files, and attachments exchanged on the connected channels.
• End-user identifiers from each platform: for example Facebook page-scoped user IDs (PSID), Instagram-scoped IDs, WhatsApp phone numbers, and similar platform identifiers, together with the display name and profile picture the platform exposes.
• Patient records: when a clinic links a conversation to a patient in its CRM, the associated patient profile fields the clinic chooses to store.
• Operational metadata: timestamps, delivery and read status, webhook events, and error logs used to run the Service reliably.

• Deliver and receive messages on behalf of the connecting clinic.
• Display conversations, contacts, and history in the clinic’s inbox.
• Provide operational observability such as delivery health and error tracking.
• Maintain audit trails required for healthcare and consumer-protection compliance.
• Optionally translate inbound messages for clinic staff using an AI language model, processing only the message text required for that translation.

When a clinic connects a Facebook Page or Instagram Business account, we access Meta messaging data only with that clinic’s explicit authorization through Facebook Login (OAuth). We request the minimum permissions needed to read and reply to messages the clinic receives.

Specifically, we request pages_show_list, pages_messaging, pages_manage_metadata, instagram_basic, and instagram_manage_messages — used solely to list the clinic’s connected Pages, receive incoming messages, and send the clinic’s replies from the inbox.

Meta data we process includes page-scoped / Instagram-scoped user IDs, message content, the sender’s display name and profile picture, and message timestamps and delivery status. We use this data solely to display incoming messages in the clinic inbox and to send the clinic’s replies.

We do not use Meta Platform data for advertising, we do not sell it, and we do not share it with third parties except the infrastructure sub-processors described below that are required to operate the Service.

We do not sell personal data. We share data only as needed to operate the Service:

• Messaging platforms (Meta, LINE, Zalo, Kakao business service providers, Tencent/WeChat, TikTok, Telegram) — strictly to deliver and receive the messages a clinic instructs us to send.
• Vercel Inc. — Cloud application hosting. All Platform Data is processed by our backend running on Vercel serverless infrastructure.
• DigitalOcean LLC — Managed PostgreSQL database hosting. Messages, page/account identifiers and access tokens are stored here (encrypted at rest, TLS in transit).
• Functional Software, Inc. (Sentry) — Error monitoring. PII and message content are redacted before events are sent; no Platform Data is intentionally stored.
• Google LLC (Google Analytics, Google Ads, Google Tag Manager) and Meta Platforms (Meta Pixel) — measurement and advertising on the Qub-X.com website only, as described in section 10. No clinic data or Platform Data is shared with them.

Message and conversation data are retained for as long as the connecting clinic maintains its account or as required by the clinic’s regulatory obligations (in Korea, medical-record retention rules under the applicable Medical Service Act and related regulations may apply).

Operational webhook audit records are retained for 30 days by default. When a clinic disconnects a channel or closes its account, associated channel credentials are deleted and message data is removed or anonymized within a commercially reasonable period.

You may request access to, correction of, or deletion of your personal data. Because the clinic operating a channel is the data controller, most requests should be directed to that clinic. We will assist controllers in fulfilling such requests.

For data linked to your Facebook or Instagram account, you may also revoke the Service’s access from your Facebook settings and use Meta’s data deletion flow. Deletion requests routed by Meta are handled at our data deletion endpoint: https://crm.coauths.com/api/auth/meta-data-deletion

We protect data with encryption in transit (TLS) and encryption at rest for sensitive fields such as channel credentials. Access to production systems is restricted to authorized personnel, and we apply per-user permission controls, rate limiting, and request-validation safeguards within the Service.

Coauths is based in the Republic of Korea. Where data is processed by our sub-processors in other regions, we rely on those providers’ contractual and technical safeguards to protect the data consistent with applicable law.

The Service is intended for use by clinics and their staff, not by children. We do not knowingly collect personal data directly from children.

On the Qub-X.com website we use Google Tag Manager to run the following tools: Google Analytics (to measure visits and how the website is used), and Google Ads and the Meta Pixel for Facebook/Instagram (to measure how our advertising performs and to show Qub-X ads to people who have visited the website). These tools may set cookies or similar identifiers in your browser.

The data recorded is: the pages you view, the buttons and links you click (for example the Zalo, Messenger and demo buttons, or feature pages), opening the introduction video, a successful demo request, your device and browser type, language, approximate location derived from your IP address, and what brought you to the website (referring site, advertising campaign). The name, email, phone number and message you enter in the demo form are not sent to these tools from your browser; only a few non-identifying details of the form (language, number of branches, role) are recorded for statistics.

The website keeps in your browser your most recent traffic source (for example a campaign name, referring site or Google/Meta ad click ID), how many times you have visited and the date of your first visit, and sends them with your demo request. With the demo request the Qub-X team also receives the page you sent the form from, your device and browser type, your approximate location derived from your IP address and your browser's Google Analytics identifier, so it knows where the request came from and can follow up appropriately.

When you send a demo request, Qub-X sends a sign-up event to Meta (Facebook/Instagram) through the Meta Conversions API to measure advertising performance: your email and phone number one-way hashed (SHA-256) so Meta can match them to an account, your IP address, browser information and the Meta Pixel cookie identifiers. This is not sent for visitors from the European Economic Area, the United Kingdom and Switzerland.

Website measurement is separate from Qub-X CRM. Customer, patient, conversation and channel data that clinics put into Qub-X CRM, including Meta Platform data, is never used for website measurement or advertising.

Google Analytics keeps user-level and event-level data for up to 14 months. For visitors from the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies are not set and the Meta Pixel does not run.

You can block or delete cookies in your browser settings, turn off personalised Google ads at adssettings.google.com, install the Google Analytics opt-out add-on at tools.google.com/dlpage/gaoptout, and adjust your ad preferences in your Facebook/Instagram account settings. The website works normally if you refuse these cookies.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by additional notice.

For questions about this Privacy Policy or our data practices, contact us using the details below.