Privacy policy

Last updated: 26 September 2026

1. Introduction

This privacy policy explains how HEXYL LTD, a company registered in Scotland (company number SC875134), registered office 18 Woodside Place, 2nd Floor, Glasgow, G3 7QL (“we”, “us”, “our”), collects, uses, stores and protects your personal data when you use the Hexyl website and platform and any associated services (the “Platform”).

We are committed to protecting your privacy and to handling your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection laws.

Please read this policy together with our terms of service and cookie policy. A short summary of what the website collects when you build a package, send an enquiry, try a demo or set up your business is on Your information at Hexyl.

2. Data controller

HEXYL LTD is the data controller responsible for your personal data. If you have any questions about this privacy policy or our data practices, you can contact us at:

HEXYL LTD, 18 Woodside Place, 2nd Floor, Glasgow, G3 7QL. Email: hello@hexyl.ai

Where our customers (tenants), such as clinics, use the Platform to manage their own customers’ and patients’ data, they act as data controllers for that data, and we act as a data processor on their behalf under our data processing agreement. If you are a patient or customer of a business that uses the Platform, please also read that business’s own privacy notice.

3. Information we collect

3.1 Information you provide directly

• Account information: when you sign up for an account or start a trial, we collect your name, email address and phone number; your business’s name, legal name, address, phone number and website and, if you give them, your company registration and VAT numbers; to register a phone number for your business, the name, mobile number and email address of a named representative; the contact details your team uses when a conversation is handed over to staff; the names and roles of team members you add; and your password. If you set up payouts, Stripe collects the details it needs on its own pages. We also keep a record of the agreements you accept, with the date, your IP address and your browser details.
• Billing information: billing contact details and transaction history. Card details are entered directly into Stripe’s payment form and are held by Stripe, not by us.
• Communication data: messages, emails and correspondence you send to us, including support requests and feedback.
• Content data: information you upload, create or manage through the Platform, including service descriptions, FAQs, articles and other business content.
• Enquiries and demo requests: when you send an enquiry through the Hexyl website, we collect your name, email address, phone number, business name, sector, product and package choices and any message you add, together with a request reference, the submission time and, if they appear in the page link, the campaign source, medium and name. If you request a demo through one of our older website pages, we collect your name, email address, phone number, clinic or business name, any notes you add, the page you requested it from and your IP address.
• Demos: when you start a demo from the Hexyl website, we collect your first name, mobile number and industry, how you would like to try it (in your browser, by voice call or on WhatsApp) and whether you want to try a booking with or without payment. While you try a demo, we also process what you say or type in it, such as call audio, transcripts and chat messages, and any example booking you make. Please use your own contact details and keep real health information out of a demo.

3.2 Information collected automatically

• Usage data: the features you use and the actions you take in the Platform, which are recorded in activity and audit logs. On the Hexyl website we count anonymous journey events, such as industry views, package-builder visits and package reviews. Each event record holds only the type of event, the industry and when it happened, and no identifier. Like every request to our servers, the request itself is recorded in our server logs with your IP address.
• Device information: your IP address and browser information (such as browser type and operating system), which your browser sends with each request.
• Log data: server logs, including access times, error logs and referring URLs.
• Cookies and similar technologies: we use cookies, browser storage and similar technologies as described in section 9.

3.3 Information from third parties

• CRM integrations: when you connect a practice-management or CRM system (such as Pabau, Dentally, Cliniko or MyClinics), we may receive patient and client records, appointment data and service information as directed by you.
• Communication providers: when you use integrated communication channels (Twilio, WhatsApp, SendGrid), we receive message delivery data and interaction logs.
• Review platforms: when you connect Google Business Profile or Trustpilot, we receive review data associated with your business, including reviewers’ public names and review text.
• Advertising platforms: when you connect Google Ads or Meta Ads accounts, we receive campaign performance data.

3.4 AI and conversational data

• Chat conversations: messages exchanged on web chat and WhatsApp between your customers and our AI receptionist or your staff, including any photos, documents or other files sent, and metadata such as timestamps, channels and sentiment scores.
• Voice interactions: call transcripts and call summaries when voice AI features are enabled. Calls are recorded only where call recording is enabled for the clinic. It is enabled for a clinic that has signed our call-recording agreement, unless the clinic’s settings say otherwise. Recordings are stored on our servers in Germany and deleted as described in section 6.
• WhatsApp voice notes: where a clinic uses voice-note transcription, voice notes that patients send on WhatsApp are transcribed by Speechmatics. Our copy of the audio is deleted after 30 days; the transcript is kept with the conversation.

4. How we use your information

We use your personal data for the following purposes:

Purpose	Legal basis (UK GDPR)
Providing and maintaining the Platform	Performance of contract (Art. 6(1)(b))
Processing payments and billing	Performance of contract (Art. 6(1)(b))
Sending service-related notifications	Performance of contract (Art. 6(1)(b))
Customer support and communication	Legitimate interest (Art. 6(1)(f))
Responding to website enquiries and demo requests, and running demos you start	Steps taken at your request before entering into a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f))
Improving and developing the Platform	Legitimate interest (Art. 6(1)(f))
Analytics and usage reporting	Legitimate interest (Art. 6(1)(f))
Marketing communications	Consent (Art. 6(1)(a))
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))
Fraud prevention and security	Legitimate interest (Art. 6(1)(f))

5. Data sharing and disclosure

We do not sell your personal data. We may share your data with the following categories of recipients:

• Service providers: third-party companies that help us operate the Platform, including our hosting provider (Hetzner), payment processor (Stripe), email delivery and file storage (Amazon Web Services), communication providers (Twilio, Meta), speech providers (Speechmatics, Cartesia) and the providers of fonts, scripts and images that our pages load. They are listed in section 5.1.
• Integrations you connect: when you configure integrations with practice-management and CRM systems (such as Pabau, Dentally or Cliniko), calendars (Google Calendar, Microsoft Outlook), accounting software (Xero, QuickBooks), payment and direct-debit providers (such as GoCardless), Google Sheets or other third-party services, data is shared as directed by your integration settings. For example, Google Calendar and Microsoft Outlook entries include the patient’s name, phone number and booking notes, and Xero and QuickBooks entries include the patient’s name and email address. The MyClinics connection runs through our own vendor account and is listed in section 5.1.
• Professional advisers: lawyers, accountants and auditors where necessary for the administration of our business.
• Legal requirements: when required by law, court order or governmental authority, or to protect our rights, safety or property.
• Business transfers: in connection with a merger, acquisition, reorganisation or sale of assets, your data may be transferred as part of that transaction.

5.1 Our service providers

These providers receive personal data when you use the Hexyl website and platform. Most of them process it on our behalf to run the website and platform. The providers of fonts, scripts and images receive your IP address and browser information because your browser fetches those files from them when a page opens. Integrations that a clinic chooses to connect are described above and are not listed here, except MyClinics, which clinics connect through our vendor account.

Provider	Purpose	Data	Location
Hetzner Online GmbH	Hosting of the Platform: application, databases, the AI language models behind all our AI features, call recordings, WhatsApp media, website enquiries and backups	All personal data held on the Platform	Germany
Amazon Web Services (Amazon SES and Amazon S3)	Sending email, such as booking confirmations, reminders, calendar invitations and account emails; file storage	Names, email addresses, appointment details and other email content; stored files	United Kingdom (London)
Twilio	Phone numbers, phone calls, SMS and WhatsApp messages sent through Twilio	Phone numbers; call audio as it passes through; SMS and message content, such as names and appointment details	May be outside the UK and EEA (see section 10)
Meta Platforms (WhatsApp Business Platform)	WhatsApp messaging between clinics and patients, connection of WhatsApp Business accounts, and WhatsApp alerts to our team about demo requests	Phone numbers, WhatsApp profile names, message content and media (such as photos, documents and voice notes), booking details; the name, email address, phone number, clinic and notes of people who request a demo; the IP address and browser information of visitors to the pages that load Meta’s software, any cookies Meta sets there, and information about the WhatsApp connection flow sent by Meta’s automatic event logging (see section 9)	May be outside the UK and EEA (see section 10)
Speechmatics	Speech-to-text for phone and browser voice calls; transcription of WhatsApp voice notes where the clinic uses it	Caller audio, which can include health information, names, dates of birth and contact details, and the resulting transcripts	May be outside the UK and EEA (see section 10)
Cartesia	Text-to-speech for voice calls	The text the AI receptionist speaks, which can include names, contact details, dates of birth and appointment details	May be outside the UK and EEA (see section 10)
Microsoft (online text-to-speech)	Last-resort voice generation in our older voice engine, used only if both Cartesia and our own voice components fail to start (see section 11)	The text the AI receptionist speaks, as for Cartesia	May be outside the UK and EEA (see section 10)
Stripe	Subscription billing for our customers; deposits and payments that patients make to clinics (Stripe Connect); the payment step of demos	Billing contact and card details (entered directly with Stripe); fraud-prevention information collected by Stripe’s script on our sign-up, set-up, channel-connection, set-up-complete and account-paused pages; patient email address, service name, amount and internal booking identifiers	May be outside the UK and EEA (see section 10)
Stackmail (20i)	Hosting of the hello@hexyl.ai mailbox, which receives website enquiries and demo requests	Name, email address, phone number, business, sector, product choices and message (enquiries); phone number, clinic name and notes (demo requests)	United Kingdom
Google (Google Fonts)	Web fonts loaded by the Hexyl website, sign-up pages and some account pages	Visitor IP address and browser information	May be outside the UK and EEA (see section 10)
Bunny Fonts	Web font loaded by the clinic admin panel	Clinic staff members’ IP address and browser information	May be outside the UK and EEA (see section 10)
Cloudflare (cdnjs) and jsDelivr	Scripts, styles and icons loaded by patient survey pages and by clinic website pages hosted on the Platform	Visitor IP address and browser information	May be outside the UK and EEA (see section 10)
Unsplash and Clearbit	Images on one older product page of the Hexyl website	Visitor IP address and browser information	May be outside the UK and EEA (see section 10)
MyClinics	Practice-management system for clinics that connect it: availability, patient records, bookings and conversation records	Patient name, phone number, email address, date of birth, bookings and conversation transcripts	May be outside the UK and EEA (see section 10)

6. Data retention

We keep personal data only for as long as we need it for the purposes described in this policy. The periods below are the ones we apply while an account is active. For data we process on a clinic’s behalf, the clinic can change several of them within the limits shown. While an account is suspended, or after it has closed, its data is kept and then deleted as described under “Account data” below.

• Account data: kept for as long as you have an account. When a subscription is cancelled or terminated under our terms of service, the account stays available read-only for 30 days after that takes effect so that you can export your data, and is then closed. If a subscription ends because payment was not made, there is no read-only period, but you can still ask us for an export at hello@hexyl.ai. We keep the data until six months after the subscription ended. It then becomes eligible for deletion, and our team deletes it. If a free trial ends without a paid subscription, the account is suspended; we keep its data for six months from the end of the trial, and our team then deletes it.
• Billing and transaction data: retained for 7 years to comply with UK tax and accounting obligations.
• Unfinished sign-ups: the details you enter while signing up, and any quote you have not accepted, are deleted after 60 days without activity.
• Chat conversations (web chat and WhatsApp): 90 days by default; a clinic can set a period between 30 days and 2 years.
• Call transcripts and call logs: 90 days by default; a clinic can set a period between 30 days and 2 years.
• Call recordings: 60 days by default, after which they are deleted automatically. The clinic can set a different period.
• WhatsApp voice notes: our copy of the audio is deleted after 30 days. The transcript is kept with the conversation.
• Other WhatsApp media (such as photos and documents): 90 days, unless the clinic saves the file to the patient’s record.
• Survey responses: 2 years by default; a clinic can set a period between 6 months and 5 years.
• Delivery records for emails, SMS and WhatsApp messages sent to patients: 180 days by default; a clinic can set a period between 30 days and 12 months.
• Recall and follow-up records: the history of finished follow-up campaigns is kept for 12 months by default (a clinic can set between 3 months and 2 years), and closed recall records for 2 years by default (a clinic can set between 1 and 3 years).
• Inactive patient records: anonymised after 3 years without activity by default; a clinic can set a period between 1 and 7 years. Booking records are kept, without the patient’s identity.
• Activity and audit logs: 12 months.
• Website enquiries and demo requests: deleted 24 months after we receive them, together with the copies emailed or sent by WhatsApp to our team.
• Demo sign-up details: for a voice-call or WhatsApp demo, the first name and mobile number you enter are deleted, with the record of your demo session, 30 days after the demo.
• Browser demos: the conversation, and any example booking and contact details created in it, are normally deleted 7 days after your last message. If you also tried the demo on WhatsApp with the same number, if our team took over the conversation, or if an example booking became linked to a payment, a patient-portal account or practice software, they are instead kept and deleted as for voice-call and WhatsApp demos (next point). On a demo number we assign to you, the conversation is deleted 25 hours after the last message; an example booking made on it stays in the demo clinic until we remove it.
• Voice-call and WhatsApp demos: messages and call transcripts are deleted 90 days after the demo. Example bookings, and the demo clinic’s contact record with your number (and your name, if you gave one), stay in the demo clinic until we remove them. The log of messages sent to you is kept for 180 days.
• Voice engine working data: our newer voice engine deletes its working copy of a conversation 24 hours after the conversation goes idle, and its internal audit records after 30 days.
• Backups: deleted data may remain in our database backups for up to 12 months, until those backups expire.
• Marketing communications: if you agree to receive them, we keep your contact details for this purpose until you withdraw consent or unsubscribe.

7. Data security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption: connections between your browser and the Platform are encrypted using TLS.
• Access controls: role-based permissions limit what each user can see and do.
• Infrastructure: hosted on dedicated servers operated by Hetzner Online GmbH in Germany.
• Database isolation: the records the Platform holds for each customer in its main database are kept in a separate PostgreSQL schema. Files and some account and billing data are stored separately and kept apart by customer identifier.
• Logging: application and security events are logged so that we can investigate incidents.
• Incident response: if a personal data breach affects data we process for clinics, we notify the affected clinics without undue delay. Where we are the controller, we notify the Information Commissioner’s Office within 72 hours of becoming aware of the breach, where required.

8. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data (the “right to be forgotten”).
• Right to restriction: request restriction of processing in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
• Rights related to automated decision-making: the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

To exercise any of these rights, please contact us at hello@hexyl.ai. We will respond within one month; where a request is complex or we receive several, we may extend this by up to two further months and will tell you if we do. If you are a patient or customer of a business that uses the Platform, you can also request a copy or deletion of your data through that business’s patient portal, where it offers one. Where your request concerns data we process on behalf of a clinic or other business, that business decides on the request as controller, and we help it respond.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Website: ico.org.uk.

9. Cookies and tracking technologies

We use the following types of cookies and similar technologies:

• Strictly necessary cookies: essential for the Platform to function, such as session cookies, authentication tokens and CSRF protection, the cookie that keeps you signed in when you tick “remember me”, short-lived cookies that keep a browser demo linked to your browser, and a preview cookie for people who hold a preview link. These cannot be switched off.
• Preferences and saved choices: remember how the Platform is displayed for you and what you choose to save, such as your workspace theme, the layout of the clinic admin panel, a package you choose to save on this device, and the figures you enter in the savings calculator on some older sector pages. A saved package and saved calculator figures contain no contact details.
• Payment and account-connection services: our sign-up, set-up, channel-connection, set-up-complete and account-paused pages load Stripe’s payment script when the page opens, and it sets Stripe cookies used to prevent fraud, including on pages where you make no payment. Our classic sign-up, channel-connection, set-up-complete and account-paused pages also load Meta’s software from Meta’s servers when the page opens, including pages where no WhatsApp connection is offered. It is there so that the connection pages can open Meta’s WhatsApp sign-up window. It sends your IP address and browser information to Meta, and Meta may set its own cookies. When you click to connect a WhatsApp Business account, Meta’s automatic event logging sends Meta information about the connection flow.
• Analytics and advertising cookies: we set no analytics or advertising cookies on the Hexyl website and use no tracking pixels. The only automatic event logging on our pages is Meta’s, described above. The anonymous journey counts described in section 3.2 use no cookies and no visitor identifiers of their own. Connecting a Google Ads or Meta Ads account to the Platform lets the Platform read your campaign performance data; it does not add advertising cookies to the Hexyl website.
• If we introduce analytics or advertising cookies: we will ask for your consent first, using a cookie banner, and you will be able to change your choice at any time through the “Cookie settings” link in the site footer, which appears once such cookies are in use. The banner stores your choice in a first-party cookie called “hexyl_consent” for 180 days; this cookie is set only once we ask for consent.
• Fonts, scripts and images from other providers: the Hexyl website, sign-up pages and some account pages load fonts from Google Fonts, and the clinic admin panel loads its font from Bunny Fonts. Patient survey pages and clinic website pages load scripts, styles and icons from Cloudflare (cdnjs) and jsDelivr, and one older product page of the Hexyl website loads images from Unsplash and Clearbit. Your browser therefore sends your IP address and browser information to these providers when such a page opens.

Websites that clinics run on the Platform may use their own cookies and analytics, which the clinic chooses; please see that clinic’s own cookie notice. When JavaScript is switched off in your browser, those websites also load a Google Tag Manager frame from Google, whatever the clinic chooses.

You can manage cookies through your browser settings. Disabling certain cookies may affect Platform functionality.

For full details on the specific cookies we use, their providers, purposes and durations, please see our cookie policy.

10. International data transfers

The Platform, including the AI language models behind all our AI features, is hosted in Germany, and our email and file storage service is in the United Kingdom (London). We do not send your data to external AI providers for language processing, such as generating replies, summaries or analysis (see section 11). Some of our other service providers may process data in other countries; section 5.1 lists them.

Where a service provider processes personal data outside the UK and the European Economic Area (EEA), the transfer must be covered by a safeguard recognised by UK data protection law, such as:

• adequacy regulations made by the UK Secretary of State
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses (SCCs)

We are confirming the safeguard set out in each provider’s terms. You can ask us at hello@hexyl.ai which safeguard applies to a particular provider.

11. AI and automated processing

Our Platform uses artificial intelligence and machine learning technologies. All the language models behind these features run on servers we operate, hosted by Hetzner in Germany, and we do not send your data to external AI providers for this language processing. The only outside AI services involved are the speech services for calls and voice notes described below, which convert speech to and from text.

• AI receptionist: replies to callers and to messages on web chat and WhatsApp are generated by language models that we run on our own servers.
• Voice AI: phone calls reach the Platform through Twilio. The caller’s audio from phone and browser calls is streamed to Speechmatics, which converts speech to text, and the text of the AI receptionist’s replies is sent to Cartesia, which generates the spoken voice. That text can include the caller’s name, contact details, date of birth and appointment details when they are read back for confirmation. If Speechmatics or Cartesia is unavailable, our older voice engine can use speech components on our own servers instead; if those voice components also fail to start, it can, as a last resort, send the text to be spoken to Microsoft’s online text-to-speech service. Our newer voice engine has no fallback and uses only Speechmatics and Cartesia.
• Summaries and analysis: after each completed or transferred call with a transcript, the Platform generates a call summary and a quality score. It also analyses new reviews and completed survey responses, suggests FAQs from patient messages that the AI receptionist could not answer confidently, and produces marketing recommendations, briefings and answers to staff questions. It can also read a clinic’s public website to help set up its account and to fill in service details. All of this runs on our own language models.
• Sentiment analysis: automated analysis of customer feedback and reviews to determine sentiment scores.
• No-show risk: where enabled, rule-based scoring of a booking’s no-show risk from factors such as booking history and lead time.
• AI training: we do not currently use your data to train AI models.

The AI receptionist books, changes and cancels appointments within the rules the clinic sets. These automated processes do not make decisions that produce legal or similarly significant effects on individuals. If you are unhappy with the outcome of an automated conversation, you can contact the clinic directly.

12. Children’s privacy

The Hexyl website and our own customer accounts are not directed at individuals under the age of 16, and we do not knowingly collect personal data from children for our own purposes. Clinics that use the Platform may hold data about patients who are children, such as their names and dates of birth; the clinic is the controller for that data, and we process it on the clinic’s behalf. If you believe a child has given us personal data through the Hexyl website, please contact us at hello@hexyl.ai and we will delete it.

13. Third-party links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any personal data.

14. Changes to this privacy policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the “Last updated” date. For significant changes, we may also send an email notification to registered users.

15. Contact us

If you have any questions, concerns or requests regarding this privacy policy or our data practices, please contact us:

HEXYL LTD, 18 Woodside Place, 2nd Floor, Glasgow, G3 7QL. Email: hello@hexyl.ai