Privacy Policy

Venubee provides patient-experience and waiting-room software from 405 Time Square, Ayodhya Chowk, 150 Feet Ring Road, Rajkot, India 360005. For account, billing, website, and direct-support information, Venubee acts as the data controller.

A clinic or practice generally controls the patient, visitor, feedback, queue, and other customer content it enters into Venubee. For that content, the clinic or practice is the controller and Venubee processes the data on its documented instructions. Questions about data entered by a clinic should normally be directed to that clinic first.

Venubee collects the information we need to provide, secure, support, and improve our SaaS platform. The types of information we collect depend on how you use the website, dashboard, and related services.

• Account information - such as your name, email address, company or organization name, role, login credentials, and account settings.
• Billing information - such as billing address, subscription plan, payment status, invoices, and limited payment details provided by our payment processor. We do not store full card numbers.
• Customer content - such as files, media, playlists, messages, configuration, and other information you upload, submit, or manage through the service.
• Connected-service information - when you connect a third-party service such as Canva, we receive and process the authorization tokens, identifiers, and content needed to provide the integration. For Canva, this can include encrypted access and refresh tokens, a Canva design identifier, limited design metadata, and the PNG image you choose to export into Venubee.
• Usage and device information - such as log data, IP address, browser type, device identifiers, pages viewed, feature usage, error reports, and approximate location derived from IP address.

Please do not upload sensitive personal information unless it is necessary for your permitted use of the service and you have the legal right to do so.

We process personal information only when a legal basis applies:

• Contract - to create accounts, authenticate users, provide subscribed features, deliver customer content, support integrations, and administer billing.
• Legitimate interests - to secure the service, prevent fraud and abuse, diagnose errors, provide support, and improve reliability. Where local law permits, this may also cover dashboard product analytics, public-website measurement, and campaign attribution after considering the impact on your rights.
• Consent - for optional website and dashboard tracking where we ask for permission, including visits from the EU, EEA, UK, Gibraltar, and unknown regions. You can refuse or withdraw consent without losing core service access.
• Legal obligation - to keep required tax, accounting, payment, and legal records and respond to valid legal process.

Where a clinic uses Venubee to process patient or visitor data, the clinic determines its own lawful basis. Venubee processes that data under its agreement with the clinic.

If you choose to connect Canva, Venubee uses Canva's Connect APIs to create or open a design on your behalf and import the first page of the finished design as a PNG image. Venubee requests access to create designs, read the design metadata needed to reopen them, and export design content. We do not request access to browse or manage your Canva asset library.

Canva authorization tokens are encrypted at rest and are used only from Venubee's backend. We keep the Canva design identifier so that you can reopen and refresh the design. Imported PNG files are stored in your Venubee organization's media library and can be published to the connected displays you select.

You can disconnect Canva at any time from Dashboard Settings. Disconnecting asks Canva to revoke Venubee's authorization and always removes the stored connection tokens from Venubee. If Canva cannot be reached to confirm revocation, you should also remove Venubee from your Canva account settings. Images already imported into Venubee remain in your media library until you delete them, because playlists and connected displays may still use those files. Deleting an unused imported image removes its stored file from Venubee.

Your Canva account and activity within Canva are also governed by Canva's Privacy Policy and Terms of Use.

We use the information above to:

• Provide, operate, maintain, and improve Venubee.
• Create and manage user accounts, organizations, and subscriptions.
• Process payments, issue invoices, and prevent billing fraud.
• Deliver customer content and keep connected services in sync.
• Provide support, respond to requests, and send service updates.
• Monitor security, prevent abuse, and troubleshoot technical issues.
• Analyze aggregate usage trends and improve product performance.
• Comply with legal, tax, accounting, and regulatory obligations.

We do not sell personal information. We do not use customer content for third-party advertising or to train third-party artificial intelligence models.

Venubee uses essential cookies or browser storage to keep you signed in, secure the service, remember your privacy choice, and provide features you request. These are not used for advertising. A privacy-choice record is stored in your browser so we do not ask on every visit.

For visitors in the EU, EEA, and UK, public-website measurement does not use persistent analytics identifiers until optional tracking is allowed. SelectingAllow all enables persistent analytics identifiers and browser-based advertising measurement and Google remarketing on the public website. Other visitors see a privacy notice; optional public-website analytics, campaign measurement and Google remarketing may be enabled by default unless a previous refusal or a browser privacy signal prevents it. The notice acknowledgment does not record consent. On the public website, optional campaign measurement also records when you start, watch at least half, or complete the product video. The dashboard registration page may use browser-based advertising measurement for page views, completed registrations, and trial starts when tracking is allowed. Browser-based advertising measurement is limited to that registration flow in the dashboard. It may send browser identifiers and the visited page URL to the measurement provider. Google Ads measures successful trial registrations using a random transaction ID to avoid duplicate conversion counts. A registration-page visit is not a trial conversion. This integration does not send registration form fields, email addresses, or phone numbers to Google Ads. The dashboard registration integration remains measurement-only and does not enable personalised ads or enhanced conversions. Separately, when optional tracking is allowed on the public website, Google Analytics and Google Ads may use browser identifiers and visits to build advertising audiences and show relevant ads on Google services and partner sites. Refusal or Global Privacy Control disables this remarketing. Authenticated dashboard and patient pages are not added to Google remarketing through this integration. For selected website and dashboard conversion events, we may also send server-side advertising measurement under the same regional tracking rule. The server event is limited to the event name and time, a fixed source domain, a random deduplication ID, the browser user-agent, and a one-way hash derived from a random anonymous tracking and revocation ID. The unhashed ID is not sent to the measurement provider. The ID is not proof of an explicit opt-in. Verified purchase events also include the payment-confirmed currency and full transaction value, including paid add-ons. For checkout verification, that user-agent is encrypted and retained for no more than seven days. The checkout context is removed when payment is confirmed or consent is withdrawn; any queued copy is removed after delivery, final failure, or expiry. The server event does not send names, email addresses, phone numbers, organisation details, patient information, health data, IP addresses, advertising browser or click cookies, URL paths, or custom parameters other than the verified purchase currency and value described above. If you reject permission, optional browser-based and server-side advertising measurement is not used. If you withdraw permission, we immediately disable browser-based measurement and send a server-side revocation that cancels pending checkout conversion context; events already delivered cannot be recalled. We also remove analytics and advertising identifiers accessible to the site from that browser after revocation. Product analytics in the authenticated dashboard uses a stable account identifier and the account email address to help us recognize users and improve the service. Interaction events may also include visible dashboard text, such as displayed account and organisation names, when those elements are clicked. This analytics follows the same regional rule: visitors in the EU, EEA, UK, and Gibraltar need an affirmative choice, while tracking may start by default elsewhere unless refused or blocked by a browser privacy signal. We do not use this choice as a condition of accessing core features.

On the public website and in the dashboard, you can change your tracking choice at any time using Privacy settings. You can also block storage through your browser or contact us to exercise your privacy rights. Blocking essential storage may affect login and security features. You may object to our dashboard analytics processing as described in theYour Rights section.

We share information only when necessary to operate Venubee, comply with the law, or protect our users and service. We may share information with trusted service providers that help us with hosting, storage, payment processing, analytics, customer support, email delivery, security, and related operations.

We may also disclose information if required by law, court order, or valid legal process; to enforce our agreements; to prevent fraud or abuse; or as part of a merger, acquisition, financing, or sale of business assets. We do not authorize service providers to use your information for their own marketing.

Depending on the features you use and our current deployment, providers may include:

• Payment providers for subscription checkout, payment processing, invoices, and fraud prevention.
• Canva for designs you choose to connect, open, or export.
• Website analytics and connected account service providers for optional features you use.
• Advertising providers, including Google, for optional campaign measurement and public-website remarketing.
• A product analytics provider for authenticated-dashboard usage data, including account email when tracking is allowed.
• Error and security diagnostics providers for service reliability and protection.
• Hosting, email, media-storage, and video-delivery providers needed to operate the service.

We require processors to protect personal information and process it only for contracted purposes. We do not sell personal information. When optional public-website marketing is enabled as described above, limited browser and visit information may be shared with Google for personalised advertising across its services and partner sites. You can turn this off through Privacy settings, and we honour Global Privacy Control.

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. These safeguards include encryption in transit, access controls, monitoring, backups, and vendor security review.

No system is perfectly secure. If we discover a security incident that affects your personal information, we will notify affected users as required by applicable law.

We keep personal information only as long as needed for the purpose described. Retention is determined by the account relationship, customer instructions, contractual commitments, the sensitivity of the data, security needs, and applicable tax, accounting, limitation, and regulatory periods. Active account and customer content is normally retained while the service is provided. Account closure starts deletion or de-identification, subject to required billing, fraud-prevention, dispute, and legal records.

Deleted data may remain in access-restricted backups until those backups rotate. We do not restore deleted data to active systems except when needed for disaster recovery. You may request deletion of personal information or customer content, subject to legal, security, backup, and billing record requirements.

Depending on where you are, you may have the right to access, correct, export, delete, restrict, or object to certain processing of personal information. You may also have the right to withdraw consent where our processing is based on consent.

To exercise your rights, contact us at support@venubee.com. We may need to verify your identity before completing a request.

You may also have the right to receive portable data, complain to the data protection authority where you live or work, and object to processing based on legitimate interests. We normally respond to verified requests within one month, subject to lawful extensions for complex or numerous requests. If Venubee holds the data only for a clinic, we may refer the request to that clinic.

Venubee and our service providers may process information in countries other than the country where you are located. When we transfer personal information from the EEA, UK, or Switzerland to a country without an applicable adequacy decision, we use an approved transfer mechanism such as standard contractual clauses and supplementary safeguards where required. You may contact us for information about the safeguard relevant to your data.

Venubee is intended for business use and is not directed to children. We do not knowingly collect personal information from children under the age required by applicable law.

We may update this policy from time to time. If we make material changes, we will provide notice by email, in-product notice, or another reasonable method. The updated policy will be effective when posted unless a later date is stated.

Questions, objections, or data-rights requests can be sent to support@venubee.com or Venubee, 405 Time Square, Ayodhya Chowk, 150 Feet Ring Road, Rajkot, India 360005. Please use the subject “Privacy request” and do not send identity documents unless we specifically request them through a secure method.