Privacy policy

Who we are

Sara is a product of BotBit, Inc. (under its “RAY” brand; hereinafter, “Sara”, “we”). Sara is the AI receptionist that clinics use to handle SMS and Instagram, book appointments and collect deposits. The controller of your data is BotBit, Inc. For any privacy matter you can write to us at info@rayapp.io.

Our role toward your patients

When a clinic hires Sara, the clinic is the controller of its patients’ data, and Sara acts as a processor that handles it following its instructions: replying to messages, booking and managing reminders. The clinic decides which treatments it offers, which prices it communicates and how each person is attended to.

What data we process

About clinics and their teams

• Contact details you leave when requesting a demo: name, role, clinic name and the channel through which we contact you.
• Authorization to access your Google Calendar, to read your availability and write the appointments.
• Your account settings: calendars, locations, professionals and service preferences.

About the patients who chat with Sara

• The content of the conversation over SMS, Instagram or the website chat, so we can reply and book.
• Appointment data: date, time, treatment enquired about and status (confirmed, rescheduled, canceled).
• Deposit payment data, when applicable, processed by our payment provider.

Patient record (optional)

If the clinic turns on the patient record, its team can log notes and photos for each patient. This information is health data: the clinic is the controller and decides what to log. It is visible only to the team members the clinic grants access to, by role and by user; every read, creation and deletion is logged, and Sara staff do not access it unless the clinic explicitly enables that to provide support. Photos are kept in private storage and shown through temporary links. Sara, the AI assistant that chats with patients, and our marketing and finance tools do not read or use the record. If the clinic deletes a patient, their record and photos are deleted too. Outside that record, Sara does not store your patients’ medical history.

What we use the data for

• Providing the service: answering, booking, reminding, confirming, collecting the deposit and winning back patients.
• Improving the quality of the responses and the security of the product.
• Communicating with you about your account, support and relevant updates.
• Meeting legal obligations and preventing abusive or fraudulent use.

Who we share it with

We work with providers who help us operate, under agreements that require them to protect the information and use it only to provide their service:

• Google, for the integration with Google Calendar and, on the sites we host, to create and manage your site’s Google Analytics and Search Console properties.
• Meta / WhatsApp and our messaging provider, to send and receive the messages.
• Meta Ads, when the clinic connects its own ad account, to create and read the performance of the campaigns that promote its content.
• Payment provider, to process the deposits and payments.
• Analytics tools, to understand the use of the website and of our campaigns.

We do not sell your data or that of your patients.

Text messaging (SMS)

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the categories in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. The messaging providers we use to send texts only use it to deliver them.

You can reply STOP to stop receiving messages and HELP for help. The SMS alerts program for clinic teams is described on the SMS alerts page.

Google APIs data (Limited Use)

BotBit, Inc.’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

When you connect your Google account (for example, Google Calendar), we access only the data needed to provide the functions you request: reading your availability and writing the appointments. We do not use that data for advertising purposes, we do not sell it and we do not transfer it to third parties unless it is necessary to operate the Service, comply with the law or with your consent. Nor do we use Google APIs data to develop, improve or train generalized artificial intelligence models. You can revoke our access at any time from the security settings of your Google account.

Meta Ads data

If the clinic chooses to, it can connect its own Meta ad account and Facebook Page so our marketing assistant “Mia” can propose promoting organic Instagram content that is already performing well. With that connection, we access only the data needed for that function: listing the clinic’s ad accounts and Pages, creating the campaign structure (paused, until the clinic activates it) in its own ad account, and reading the spend, reach and conversations generated by that campaign to show the clinic its cost per booked appointment. We do not create or activate campaigns without an explicit action by the clinic in our panel, we do not use this data for any purpose other than showing the clinic its own campaign performance, and we do not share it with other clinics or third parties beyond what is necessary to operate the Service. The clinic can disconnect its Meta Ads account at any time from its panel.

Your website’s Google Analytics and Search Console

If we host your clinic’s website, Sara can create and set up your site’s Google Analytics and Google Search Console properties for you, so you can measure visits and show up sooner in Google searches without configuring anything by hand. We submit your sitemap to Google and verify ownership with a tag we already serve on your site.

These properties are created under a Google account managed by BotBit, Inc.; we add you as an owner in Search Console and with read access in Analytics, so you can see them from your own Google account. Traffic data is collected by Google Analytics and governed by Google’s policies. This applies only to sites we host; if your site lives elsewhere, you keep connecting your own account.

If you already have your own Google Analytics or Search Console account, we don’t touch it. You can ask us at any time to transfer the property to your account or to delete it by writing to info@rayapp.io.

Free business scan in ChatGPT and Claude

The free business scan is a read-only tool that works inside ChatGPT (and, soon, Claude). You ask about a local business and it returns a report. It is available in the United States only. No account is needed.

What it uses

Only public information about a business: its Google Business Profile and Maps data, public reviews, its public website and nearby competitors.

What BotBit, Inc. stores

• A record of each business that was scanned: its Google place ID, its business category, the scores our tool calculated for it, the first and last date it was scanned, how many times it was scanned and which app (ChatGPT, Claude or this website) requested it. We keep this record for as long as we operate the tool, to understand how the tool is used and to improve it. It does not include what you typed and does not identify you.
• Google Maps content about that business (its name, address, city, state, website, rating, review count, and the names, ratings and map locations of nearby competitors), kept for up to 30 days and refreshed whenever the business is scanned again. After that period we keep only the place ID and our own calculations.
• A saved copy of the scan report, made only of our own calculations (scores, gaps and estimates), so that a report link keeps working. It does not include Google Maps content.
• The candidate places returned by a business search, cached for up to 24 hours so repeated searches are faster. The text you searched is not stored: the cache entry is identified only by a keyed hash of it.
• The scan result, cached for up to 7 days.
• An anonymous usage identifier supplied by the host app (ChatGPT or Claude), which we store hashed.
• A keyed hash of your network IP address, never the address itself, used only to limit abuse and kept for up to 2 hours. This also applies when you use the weekly monitor form.
• Technical logs (time, tool used and result status).

Google Maps Platform content is not retained for more than 30 days. Logs are kept for up to 30 days, and caches as described above.

Weekly monitor (optional)

If you ask for the weekly monitor on holasara.ai/en/chatgpt, holasara.ai/en/claude or your report page, we store your email address, the business name you typed and the place ID of the scan, and we send you one email a week about changes in that business's rating, review count and score. We ask you to confirm by email first, every message has a one-click unsubscribe link, and we delete the record within 30 days of unsubscribing. To prevent abuse, we also keep a hash of the email address (not the address itself) for 24 hours to cap how many confirmation messages one address can receive. We also store your email as a contact in our CRM (HubSpot) so our team can answer you. We do not call or text you. The sign-up form uses Cloudflare Turnstile to block automated abuse; Cloudflare processes technical signals from your browser for this check and may use cookies or similar technology that are strictly necessary for it.

We do not use the record of scanned businesses to contact those businesses.

Online scan report

Each scan has a report page at a link that only works if you know the full address. Anyone who has the link can view the basic report, so share it only with people you trust. We do not list report pages in search engines, and we do not load advertising or analytics tools on them. To see the full report we ask for your name, email, role and, optionally, your phone number. See below for how we use them.

The report page shows a Google map of the business and its competitors. When the map loads, Google receives your IP address and browser details under Google’s own privacy policy. The page also saves in your browser, on your device only, a note that you already unlocked the report. It uses a language cookie from our website and, when you refresh a report or sign up, Cloudflare Turnstile, which processes technical signals from your browser to block automated abuse and may use cookies or similar technology that are strictly necessary for that check.

We count views of the report, clicks and the app that created the scan (ChatGPT, Claude or other) to measure how the report is used. We do not store your IP address or browser details for this.

If you unlock the full report

We store the name, email address, role and optional phone number you give us, the time and the wording of the consent you accepted, and the report you unlocked. We use them to show you the full report, to email you about your report and about Sara, and to follow up if you ask for a demo. Every marketing email has a one-click unsubscribe link, and we only send marketing emails after you confirm your email address. We use your phone number only to reach you about a demo you request. We do not call or text you with automated or artificial voices. We keep these details in our CRM (HubSpot) until you ask us to delete them or for 24 months after your last activity, whichever comes first. To delete your details or a report, write to support@rayapp.io.

What we do not collect

We do not ask for or store health information, payment cards, government IDs or credentials. The tool is not meant for patient data, so please do not enter it.

Who else handles your data

ChatGPT and Claude process your conversation under OpenAI’s and Anthropic’s own policies. We do not sell this data. The tool is not directed to children under 13.

Who is responsible

The controller is BotBit, Inc., a Delaware corporation. Mailing address: c/o Corporate Creations Network Inc., 11380 Prosperity Farms Road, #221E, Palm Beach Gardens, FL 33140. Questions or requests about this tool: support@rayapp.io.

Publishing to the Facebook Page

If the clinic chooses to, it can connect its Facebook Page so that Mia publishes on it the content the clinic itself creates or approves (photos, carousels and videos with its text). For that we ask permission to see the Pages the connecting person manages, read the Page’s basic information and create posts on it. We publish only when the clinic asks for it in our panel or schedules it, and only on the Page it chose. We do not read the Page’s messages or the personal data of its followers, we do not use this data for any other purpose, and we do not share it with third parties beyond what is necessary to operate the Service. The access credential is stored encrypted. The clinic can disconnect its Page at any time from its panel, and from then on we stop publishing.

Cookies and analytics

Our website uses first-party and third-party cookies to measure traffic and the effectiveness of campaigns (for example, web analytics and advertising pixels). You can manage cookies from your browser settings.

How long we keep it

We keep the data for as long as the clinic uses the service and for the time necessary to meet legal obligations. When it is no longer needed, we delete or anonymize it.

Your rights

You can request to access, rectify, cancel or object to the processing of your data, as well as to restrict or port it, under applicable law. If you are a patient of a clinic that uses Sara, the fastest route is usually to contact the clinic; you can also write to us at info@rayapp.io and we will channel it.

Security

We apply reasonable technical and organizational measures to protect the information against unauthorized access, loss or alteration. No system is infallible, but we treat security as a central part of the product.

Changes to this policy

We may update this policy to reflect changes in the product or in the law. We will publish the current version on this page, with its last-updated date.

Contact

Privacy questions: info@rayapp.io. This policy is governed by the laws of the United States applicable to personal data protection.