Privacy Policy

Effective date: 14 October 2026

1. Who we are and what this policy covers

Medfin AI Limited provides financial analytics and workflow software for dental practices. This policy explains how we handle personal data through our website, platform, Finley AI assistant, connected services and customer communications.

Contact us about privacy or data deletion at support@medfin.ai, or write to Medfin AI Limited, WeWork, 51 Eastcheap, London, England, EC3M 1DT.

When a practice or dental group uses Medfin, it normally decides why personal data is processed and is the data controller. We process that data on its instructions under our Data Processing Agreement, or DPA. This includes customer user accounts, practice financial records and patient and staff information. The practice's privacy notice explains its own purposes and legal grounds.

We are a separate controller for our website enquiries, our own customer relationship management, subscription billing and legally required business records. We may therefore handle the same person's details for both the customer's purposes and our own.

2. Information we handle

We receive information directly from you, from your practice or employer, and from services connected to Medfin. Depending on how you use Medfin, this includes:

• Names, contact details, roles, account permissions and authentication records.
• Patient identifiers, contact details, appointments, treatment and plan information, and related charges and payments. Treatment information can include health data and can relate to children.
• Staff and associate details, pay arrangements, performance information, supplier records, invoices, bank details and payment transactions.
• Uploaded documents, Finley conversations, connected-service results, support messages, and meeting recordings or transcripts where recording or transcription is used.
• IP addresses, device and browser details, usage events, cookies, application logs and diagnostic information.

The platform is for business users. Practices may use it to process children's patient records, but we do not offer Medfin accounts to children.

3. Why we use information

We process customer information to provide analytics, manage access, process documents, support payment and staff workflows, answer questions through Finley, operate integrations and support the service. Customers must have a lawful basis for their instructions, including the additional legal condition required for health data.

Where we act as controller, we rely on:

• Our legitimate interests in answering business enquiries, managing customer relationships, administering subscriptions, protecting our website and systems, and establishing or defending legal claims. We consider the effect on individuals before relying on these interests.
• Contractual necessity where the individual is personally a party to a contract with us, or asks us to take steps before entering one.
• Legal obligations for our accounting, tax and other mandatory records.
• Consent where required for marketing or optional cookies. Where business marketing is permitted without consent, we rely on our legitimate interest in promoting Medfin to relevant business contacts.

You can object to direct marketing at any time. Use the unsubscribe option in a marketing message or email us. We may keep a minimal record of your objection so that we respect it.

Some information is needed to answer an enquiry, administer a subscription or provide a requested feature. Without it, we may be unable to do so. Connecting an optional service is your choice.

3.1 Anonymous statistics and benchmarking

We may create anonymous aggregate statistics to operate and improve Medfin. Cross-customer benchmarking is optional and requires an authorised customer administrator to opt in. Anonymous benchmarks may appear in the service, reports, research and marketing materials, without identifying contributors, practices or individuals.

Customers can withdraw through the service or by contacting us. We then stop including their personal data in further benchmarking. Existing results may remain in use only while they remain effectively anonymous and do not identify a customer or practice. Google data is subject to the restrictions in section 4.1.

4. Finley and other AI features

Finley and our document-processing features send relevant prompts, documents, conversation history and tool results to AI services provided through Google Cloud and Microsoft Azure. These services produce answers, summaries, extracted information and proposed actions. Information from a connected service can therefore become part of an AI request and response.

We save conversations and information Finley retrieves so you can return to earlier work. Our hosting, workflow and monitoring providers may also retain copies. Diagnostic records in PostHog can contain the requests sent to Finley and its tools, and the information they return.

If you share a conversation or place it in a shared area, people with access may see its contents. A connected account belongs to the person who authorised it; sharing a conversation does not give another person that account's credentials.

4.1 Google Calendar

Information we access and why. The Google Calendar connector lets you use Finley to list your calendars, read events, check availability, and create, update or delete events within the permissions you grant. We use this information to answer your Calendar questions and carry out the scheduling actions you request. Calendar information can include calendar names and identifiers, event titles, descriptions, times, locations, organiser and attendee names and email addresses, responses, availability and meeting links. Creating or changing events can send invitations or updates to attendees.

Google handles sign-in and authorisation. We store the access and refresh tokens Google issues to maintain your connection without requiring you to sign in for every request. We do not receive your Google password. The permissions granted to this connector do not give it access to Gmail messages or Google Drive files.

Who processes this information. Calendar information relevant to your request can be sent to AI services provided through Google Cloud and Microsoft Azure so Finley can interpret your request and produce an answer or action. Supabase stores connection credentials and saved conversation data. Vercel hosts the application and processes workflows, which can retain copies of messages and Calendar results. PostHog receives diagnostic records that can include AI requests, responses and tool inputs and outputs. Calendar information can also be saved in your Finley conversation history.

We share Google data with these providers with your consent to deliver the features you choose. We may also share it where necessary for security or legal compliance. A business transfer involving this data requires your explicit prior consent. People with access to a conversation you share may see the Calendar information within it.

How we protect it. We encrypt data in transit and store Google access and refresh tokens encrypted in Supabase Vault. Access to connected accounts and saved conversations is restricted by user and practice permissions. Sharing a conversation does not share your Google credentials. Our staff and contractors may read identifiable Google data only with your explicit agreement to access the specific data, where necessary for security purposes such as investigating a security-related bug or abuse, or where required by law.

Limits on use. Our handling of Google API data follows the Google API Services User Data Policy and the Google Workspace user data and developer policy, including their Limited Use restrictions. These restrictions also apply to information derived from that data and take priority over broader descriptions elsewhere in this policy.

We do not use data obtained through Google Workspace APIs, including Google Calendar data or information derived from it, to develop, train or improve non-personalised artificial intelligence or machine-learning models. We do not sell this data, use it for advertising, credit scoring or lending, or include it in cross-customer benchmarking. We require providers processing it for us to respect these limits.

Disconnecting and deleting data. You can disconnect Google Calendar in Finley's connections settings and revoke Medfin's access through your Google Account connections. Disconnecting in Medfin deletes the connection credentials from our operational systems and stops future access through that connection. It does not undo changes already made in Google Calendar or automatically erase information saved in conversations.

Deleting a Finley conversation removes its main stored history and associated tool results. Separate workflow records, diagnostic records and backups are not necessarily deleted at the same time. Section 7 explains their retention, including our seven-day database recovery window and PostHog's 30-day AI content retention.

To request deletion of retained Google data, email support@medfin.ai. We will verify your request and, where we process the information for your practice, coordinate with that practice and our relevant providers to carry out the applicable deletion obligations. This includes relevant retained copies, subject to the backup and legal exceptions in section 7.

5. Who receives information

Webflow hosts our marketing website. We use service providers for hosting, databases, AI processing, communications, support, analytics and payments. Our main providers include Google Cloud, Supabase and Vercel for hosting and storage; Google Cloud and Microsoft Azure for AI processing; and PostHog for analytics and diagnostic records.

Depending on the features used, our other providers include:

• Google Workspace, Slack, Intercom, Notion, Linear, Resend and Attio for communications and operations.
• Wispr and Granola for transcription and meeting notes.
• Yapily for open banking and payment services.

The DPA describes what these providers are authorised to do with customer data. Contact us for current provider details and processing locations.

We share information with people at your practice according to their permissions, and with connected services or other recipients when carrying out requested actions. Providers of services you connect also handle information under their own privacy terms.

We may disclose information to professional advisers, authorities or prospective business purchasers where necessary and lawful, subject to confidentiality and applicable contractual restrictions. The stricter limits in section 4.1 apply to Google data.

6. International processing and security

Our providers process information in the UK, the European Economic Area and, for some communications, support and operational services, the United States. The DPA identifies locations for customer-data processing. This includes access by people working overseas.

Where required, we use an applicable adequacy decision or appropriate contractual safeguards, such as EU standard contractual clauses and the UK Addendum or International Data Transfer Agreement. We assess transfers and apply supplementary safeguards where necessary. Contact us for details of the safeguards relevant to your information and how to obtain a copy.

We use access controls, confidentiality obligations, encryption, monitoring, backups and incident-response procedures appropriate to the data and risks. Access is limited according to role and need.

7. How long we keep information

We keep customer data while providing the service and according to the customer's documented instructions. Finley history remains available until the conversation is deleted or the data is removed under those instructions or our end-of-service deletion arrangements. Removing a user's access does not automatically delete historic transactions, approvals or audit records that the customer needs to retain.

Under the DPA, customers may request return of their data before the service ends or within 14 calendar days afterwards. We complete any requested return and delete customer data from operational systems without undue delay and within 30 calendar days after the relevant service ends. Customers can also instruct earlier deletion. These obligations extend to customer data held by our providers.

Database recovery backups. We use Supabase point-in-time recovery with a seven-day recovery window. Records deleted from the live database may remain in recovery backups until they fall outside that window. This period applies to database recovery backups, not to every file or other copy held by our providers. Where immediate deletion of a backup is not practicable, we prevent its use in normal operations and allow it to expire. If we restore a backup, we reapply deletions before returning the data to use.

Workflow and diagnostic records. Vercel retains completed workflow records for seven days after completion. Deleting a Finley conversation does not itself erase these retained workflow copies.

PostHog retains its main AI input and output content fields for 30 days after collection. These fields can contain prompts, responses and tool information. Other event properties remain separately. The 30-day period does not cover all diagnostic copies, including separate application traces, or the conversation history stored in Medfin.

We use diagnostic records to investigate failures and security issues, resolve support requests and monitor service reliability. Retention depends on the period needed for the relevant investigation, support request or service monitoring, subject to customer instructions and the deletion obligations above. Deleting a conversation or disconnecting a service does not automatically delete records held in PostHog. Requests sent to support@medfin.ai are handled separately with the relevant customer and providers.

Usage and performance analytics. We retain usage events and measures such as response times, token counts and costs separately from AI content so that we can assess feature use, reliability and performance over time. Records linked to a user or conversation remain personal data and are subject to the customer instructions and deletion obligations above. We may retain effectively anonymous aggregate statistics for the permitted purposes in section 3.1. The restrictions on Google data in section 4.1 continue to apply.

Information that law requires us to retain is restricted to that purpose and deleted when the requirement ends. For our own business records, retention depends on whether an enquiry or customer relationship remains active, the statutory period applying to accounting records, and whether information is needed for an unresolved dispute or legal claim. We remove or anonymise information when these purposes no longer justify keeping it.

8. Cookies and similar technologies

We use cookies and similar technologies for website and platform functions, including sign-in, security and remembering preferences. Optional technologies may help us understand usage and improve our website. Where consent is required, we ask before using them and provide a way to change your choice. Browser settings can also block or remove cookies, although some functions may stop working.

9. Your rights

Depending on the applicable law and circumstances, you can request access, correction, deletion, restricted processing or a portable copy of your information. You can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Send requests to support@medfin.ai. We may need to verify your identity. If your request concerns information we process for a practice, we will pass it to that practice and help it respond. Your practice or employer is normally the first contact for its patient or staff records.

You can complain to the UK's Information Commissioner's Office, or another competent data protection authority, including your local authority in the EEA. You do not have to contact us first.

10. Changes to this policy

We will update this policy when our practices change and show the effective date. Where appropriate, we will notify affected users directly. If a change to our use of Google data requires fresh consent, we will obtain it before making that change.