Peek — Privacy Policy
1. Introduction
This Privacy Policy explains how Mosaic AI Technology Labs Ltd, a company incorporated in the Dubai International Financial Centre with registered number 14517 and registered office at IH-00-01-03-OF-05, Level 3, Innovation One, Dubai International Financial Centre, Dubai, United Arab Emirates (“Mosaic”, “we”, “us” or “our”), processes personal data in connection with Peek, an artificial-intelligence growth analyst for businesses such as clinics, including its assistant, Vera (the “Service”).
Peek connects to tools that a client business already uses, such as its website enquiry forms, its practice-management or sales records, its advertising and analytics accounts, and its messaging channels, in order to trace each enquiry through to a visit and revenue and to report on it.
Peek processes two kinds of personal data, and our role differs for each:
- Personal data about a client’s own customers, leads and patients. The client business decides why and how this data is processed and is its controller. Mosaic processes it only to provide the Service to that client, as its processor.
- Personal data about the client’s staff who use Peek, such as their sign-in details and usage. Mosaic is the controller of this data.
We process personal data in accordance with the Data Protection Law, DIFC Law No. 5 of 2020 (the “DP Law”). Where users or data subjects are located in the European Economic Area, the United Kingdom, Switzerland or the United States, the additional regional rights in Section 16 also apply. We also comply with the requirements of the platforms the Service integrates with, including the Google API Services User Data Policy (Section 8) and Meta’s Platform Terms and the WhatsApp Business Solution Terms (Section 9).
2. Who we are and how to contact us
Mosaic AI Technology Labs Ltd (DIFC registered number 14517)
Privacy contact: info@mosaicsolutions.ai
3. Personal data we process
3.1 Staff who use Peek (Mosaic is controller)
- Account and identity data: name, work email address, profile photo and the identifiers used to sign you in. Sign-in is through Google; access is limited to email addresses or domains your organisation has authorised.
- Usage data: your conversations with the assistant, feedback you give on reports, product usage events, and session information such as IP address and browser type.
3.2 A client’s customers, leads and patients (the client is controller; Mosaic is processor)
Depending on which sources the client connects:
- Website enquiries and registrations: name, phone numbers, email address, date of birth, gender, nationality, area of residence, preferred contact method, consent to be contacted on WhatsApp, how the person heard of the client, and the reason for their visit as they wrote it. Medical-history fields in the client’s registration form are not collected.
- Sales and visit records from the client’s practice-management system: patient identifier, name, invoice details, the services and products billed (for example the type of treatment), the treating doctor and department, amounts, insurance and self-pay amounts. From the patient register: identifier, name, date of birth, gender, nationality, area, mobile number, email and registration date. Identity-document numbers, religion, insurance details, emergency contacts and marital status are not collected.
- Messaging data: WhatsApp and Instagram conversations between the client and its customers, including phone number or Instagram handle, display name, the time and direction of each message, labels the client’s staff apply, identifiers of the click-to-WhatsApp ad that started a conversation, and message content. Message content is stored encrypted. Peek receives this data from the client’s messaging provider or, where the client connects its account, directly from Meta’s WhatsApp Business Platform. Peek reads these conversations; it does not send messages.
- Advertising and analytics data: aggregated campaign spend and performance from the client’s Meta advertising and Google Analytics accounts, and the ad identifiers that link an individual enquiry to the ad that produced it. Google Analytics data is aggregated and not linked to individuals.
3.3 Health-related information
Because Peek serves healthcare businesses, some of the data a client connects can reveal information about a person’s health. This comes mainly from the client’s own records and enquiry forms, such as the reason for a visit, the services or treatments billed and the type of consultation. Messages may also contain it, but only where a customer chooses to write it. We process this information only on the client’s instructions and only for the Service’s measurement and reporting. Peek does not make or support clinical decisions.
4. How we use personal data and our legal bases
We use personal data to provide the Service: matching enquiries, conversations and visits that belong to the same person (including with artificial-intelligence assistance), calculating revenue and advertising performance by channel, producing dashboards, alerts and weekly digests, scoring the responsiveness and quality of conversations where the client enables it, and answering staff questions through the assistant. We also use it to operate, secure and support the Service and to comply with the law.
| Purpose | Legal basis |
|---|---|
| Providing the Service to the client and its staff | Performance of a contract; legitimate interests |
| Processing the client’s customer and patient data | On the client’s documented instructions as its processor; the client is responsible for its own lawful basis, including any condition required for health data |
| Security, support and improvement of the Service | Legitimate interests |
| Legal and regulatory obligations | Compliance with a legal obligation |
5. Our role as processor
For the data in Section 3.2, we act only on the client’s documented instructions, under a data processing agreement covering confidentiality, security, sub-processors (Section 7), assistance with data-subject requests, and the return or deletion of data at the end of the service. People whose data a client holds should direct requests about that data to the client first; if they contact us, we will pass the request to the client.
7. Sub-processors
| Recipient | Purpose | Primary location |
|---|---|---|
| Microsoft (Azure) | Primary database and backups | United Arab Emirates |
| Vercel Inc. | Application hosting and processing; storage of staff profile photos | Germany (Frankfurt) |
| Render Services, Inc. | Hosting of the client’s contact and visit records | Germany (Frankfurt) |
| Anthropic PBC (Claude) | Language processing for the assistant, identity matching, conversation scoring and report text | United States |
| Resend, Inc. | Delivery of alert and digest emails to staff | United States |
| Google LLC | Staff sign-in; reading the client’s Google Sheets and Google Analytics data | United States |
| Meta Platforms, Inc. | Reading the client’s advertising data and, where connected, WhatsApp and Instagram messaging data | United States |
Peek also reads data from tools the client already uses and contracts for itself, such as its messaging provider and its practice-management system. Those providers act for the client, not for Mosaic. We also share personal data with professional advisers, regulators and authorities where required or permitted by law, and with a successor entity in a merger, acquisition or sale of assets. We do not sell personal data, and we do not share it for advertising.
8. Google API Services — Limited Use
Peek’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only for staff sign-in and to read the client’s Google Sheets and Google Analytics data for the reports the client sees in Peek. We do not use it for advertising, we do not sell it, we do not use it to train generalised artificial-intelligence or machine-learning models, and we do not allow humans to read it unless the client has agreed, it is necessary for security or to comply with law, or the data has been aggregated and anonymised.
9. Meta (WhatsApp, Instagram and advertising) data
Where a client connects its WhatsApp Business account, Instagram account or advertising account, we access that data through Meta’s official APIs in accordance with Meta’s Platform Terms, the WhatsApp Business Solution Terms and Meta’s policies. We use it only for the client’s lead and marketing reporting: to log each new enquiry, link it to the ad that produced it and to the visit and revenue that followed, measure advertising spend and return, and report how quickly and how well the client’s team responds. We do not use Meta data for any medical purpose, we do not send messages on the client’s behalf, we do not use the data for advertising, we do not sell it, and we do not use it to train generalised artificial-intelligence or machine-learning models.
10. Artificial-intelligence processing and our no-training commitment
The Service uses Anthropic (Claude) for language processing. Relevant content, which can include customer names, visit details and message content, is sent to Anthropic only to produce the answer, match or score the Service needs at that moment. We do not use client data to develop or train generalised artificial-intelligence models, we do not train our own models on it, and we contractually prohibit our artificial-intelligence provider from using it to train its models.
11. International data transfers
The Service’s primary database and backups are in the United Arab Emirates. Some processing takes place in Germany and the United States through the sub-processors in Section 7. Where we transfer personal data outside the Dubai International Financial Centre, we do so in accordance with Articles 26 and 27 of the DP Law, relying on an adequate level of protection in the receiving jurisdiction or on appropriate safeguards, together with contractual and organisational measures. For transfers from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses with the applicable UK and Swiss addenda.
12. Data retention
| Category | Retention |
|---|---|
| Client customer and patient data | For as long as the client uses the Service, then deleted on the client’s instruction, or within 90 days after the service ends |
| Staff account data | While the user is authorised; deleted on request |
| Assistant conversations and feedback | Until deleted at the user’s or client’s request |
| Usage and audit logs | 90 days; product usage events 180 days |
| Backups | Up to 35 days |
13. How to delete your data
- Client businesses can ask us to delete all data held for them, or any part of it, by emailing info@mosaicsolutions.ai from an authorised account with the subject “Data deletion request”.
- Staff users can ask their organisation’s administrator, or email us as above, to remove their account and the data associated with it.
- Customers and patients of a client should contact that client, which controls their data. If you write to us instead, we will pass your request to the client and act on its instructions.
- Data received from Meta, Google or other connected platforms is included in any deletion. A client can also disconnect a connected account at any time, which stops further access.
We complete deletion requests within 30 days and confirm by email. Copies in backups expire within 35 days.
14. Security
We protect personal data with access limited to each client’s authorised staff and roles, encryption in transit, encryption at rest of message content and uploaded files (AES-256-GCM), and audit logging of access to conversation content. We maintain procedures for personal-data breaches and will notify the client, regulators and affected people where the law requires. No system is completely secure.
15. Children
The Service is for authorised business users and is not directed to children. A client’s records may include data about minors who are its customers or patients; we process that data only on the client’s instructions.
16. Your rights
16.1 All users (DIFC DP Law)
Subject to the DP Law, you have the right to withdraw consent at any time (Article 32); to access, rectify and request erasure of your personal data (Article 33); to object to processing (Article 34); to request restriction of processing (Article 35); to receive your personal data in a structured, machine-readable format (Article 37); and to object to decisions based solely on automated processing, including profiling (Article 38). Contact us at info@mosaicsolutions.ai. You may also complain to the DIFC Commissioner of Data Protection (Article 60). Where we process your data for a client, we will pass your request to that client.
16.2 EEA, UK and Switzerland
If you are in the EEA, the UK or Switzerland, you have the rights of access, rectification, erasure, restriction, portability, objection, and not to be subject to solely automated decisions with legal or similarly significant effects. Where we rely on consent you may withdraw it at any time. We aim to respond within one month. You may complain to your local supervisory authority.
16.3 United States
We do not sell personal information and do not share it for cross-context behavioural advertising. Subject to applicable law, you have the rights to know, access, delete and correct your personal information, to non-discrimination for exercising them, and to appeal a decision. Contact us at info@mosaicsolutions.ai.
17. Changes to this Policy
We may update this Policy. If we change how we use Google, Meta or WhatsApp data, we will notify affected clients and obtain any consent required before using that data in the new way.
18. Governing law
This Policy is governed by the laws of the Dubai International Financial Centre. The regional provisions in Section 16 grant additional statutory rights and do not change the governing law.