This policy covers the Shfa.ai website and the appraisal call you can book from it. It does not cover a licensing engagement: if we go on to work together, that is governed by the separate written agreement you sign, not by this page.
Do not send us protected health information.
Nothing on this website is a secure channel for patient data. Do not put patient information, medical records, identifiers, or confidential datasets in a booking note, an email, or any other message to us. If you need to discuss specific records, say so on the call and we will set up a proper channel under a signed agreement first.
Who we are
Shfa.ai licenses de-identified clinical and operational data on behalf of healthcare organizations. We are the controller of the information described below.
What we collect
There is no contact form on this website. Almost everything we hold about you comes from you booking a call.
- Booking details
- Your name, email address, time zone, and anything you type into the booking notes. Collected when you book an appraisal call.
- Technical data
- Your IP address, browser and device type, the pages you viewed, and the page that referred you. Recorded automatically in server logs, as on any website.
- Advertising identifiers
- Cookies set by the Meta pixel (
_fbp, and_fbcif you arrived from a Facebook or Instagram ad), plus thefbclidvalue in the link you clicked.
We do not ask for patient-level data at any point in the public appraisal process, and we do not want it.
How we use it
- To hold the call you booked and to follow up on it.
- To judge whether your organization and ours are a plausible fit before either of us spends more time.
- To measure our advertising — which ads lead to booked calls — and to keep the site working and secure.
We do not sell your personal information, and we do not use it to make automated decisions that have legal or similarly significant effects.
Advertising and measurement
We advertise on Meta's platforms, and this is the part of our data handling most people want spelled out, so here it is in full.
The Meta pixel runs on every page of this site. It records that a page was viewed, that a booking button was clicked, and that the booking calendar came into view.
Separately, when you complete a booking, our server sends Meta a conversion event through the Meta Conversions API. That event contains your email address and name, hashed with SHA-256 before they leave our server, together with the advertising identifiers described above. Hashing means Meta receives a fingerprint rather than the plain values, and uses it to tell whether the person who booked is someone who saw one of our ads.
We deliberately do not send Meta your booking notes, the event description, or any other free text. Those fields can carry details that have no business reaching an advertising platform.
You can limit this. Meta's own ad preferences control how your activity is used for advertising, and most browsers and tracking-prevention tools will block the pixel outright. Blocking it does not affect your ability to book a call.
Cookies
This site sets no cookies of its own. The only cookies are the advertising identifiers above, set by the Meta pixel. Blocking or clearing them costs you nothing here — the site has no login, no cart, and no preferences to remember.
Who we share it with
We share information only with the services that make this site and our calls work, and only as far as each needs.
- Service providers
- The companies that host this website, run our booking calendar, and keep our customer records. They receive your booking details and technical data in order to provide those services to us, and are not permitted to use them for their own purposes.
- Advertising partners
- The advertising platforms described under “Advertising and measurement” above, which receive the conversion events set out there, including your hashed email address and name.
Your booking notes stay in the calendar. They are not passed on to our advertising or customer-record systems.
We may also disclose information where the law requires it, or to establish or defend a legal claim. If our business is ever sold or merged, information may transfer with it; this policy would continue to apply until you were told otherwise.
How long we keep it
Booking and correspondence records are kept while we are in contact and for a reasonable period afterwards, so we know what was already discussed. Server logs are short-lived. Advertising identifiers expire on their own, and you can clear them at any time. You can ask us to delete your details sooner.
Security
The site is served over HTTPS. Booking data sent from Cal.com to us is signed and verified before it is accepted, and identifiers sent to Meta are hashed first. No website is perfectly secure, which is precisely why we ask you not to send patient information through it.
Your rights
Depending on where you live, you may have the right to ask for a copy of what we hold about you, to have it corrected or deleted, to object to or restrict how we use it, and to opt out of targeted advertising. We will not treat you differently for exercising any of them.
To make a request, raise it on your appraisal call and we will action it from there. Please do not include patient information in your request.
International transfers
Our service providers operate in the United States and elsewhere, so your information may be processed outside the country you live in, under appropriate safeguards.
Children
This is a business-to-business website. It is not directed at children and we do not knowingly collect information from them.
Changes
If we change this policy we will update the date at the top of the page. Material changes will be described here rather than made quietly.
Contact
The quickest route to us is to book an appraisal call and raise your question on it. Please do not include patient information, medical records, or confidential datasets in a booking note.