Privacy Policy

1. Who we are

Juno is operated by MedPath AI Pte. Ltd. (UEN 202315420D), a company incorporated in Singapore. This policy explains how we handle personal data under the Personal Data Protection Act 2012 (PDPA).

2. Two different roles

The distinction matters throughout this policy:

• Our own customers. When a business signs up for Juno, we decide how their account data is used. We are the organisation responsible for it.
• Their customers’ messages. When a business uses Juno to message the public, we handle that content on their instructions, as a data intermediary. The business decides what is collected and why. If you messaged a business and want your data removed, contact that business — we act on their instruction, not our own.

3. What we collect

• Account data — name, work email, password hash, workspace name, role, and billing details.
• Conversation content — messages, attachments, contact names and phone numbers exchanged between a business and the people it talks to, and records of orders and payments discussed in those conversations.
• Technical data — IP address, browser and device information, and timestamps of actions taken in the console.

We do not ask for and do not want special categories of data such as health, financial account credentials, or government identifiers. Businesses using Juno are responsible for not routing such data through it.

4. Why we use it

• To provide the service — delivering, storing and displaying messages.
• To generate AI replies, summaries and intent signals, at the business’s request.
• To bill for usage and prevent abuse.
• To support and troubleshoot, where a business asks us to look at something.
• To meet legal obligations.

We do not sell personal data, and we do not use conversation content to advertise to anyone.

5. AI processing

Where a business enables AI features, message content is sent to third-party model providers to generate a reply, summary or score. We contract for those providers not to train their models on this content. AI output is generated automatically and may be wrong; a business remains responsible for what it sends to its own customers.

6. Connected stores (Shopify)

A business can connect its Shopify store. When it does, we read that store’s orders, checkouts, customers, products, inventory and fulfilments, so that the business’s staff can see a customer’s order while answering them, and so the store can send order confirmations, shipping updates and abandoned-checkout reminders on the messaging channel that customer already uses. Nothing else is read, and the data of one store is never combined with another’s or used to advertise.

For that data we act on the merchant’s instructions and not on our own — the second of the two roles in section 2. It is kept while the store is connected. Disconnecting the store, or uninstalling the app in Shopify, removes the connection and the orders we mirrored from it. We also act on Shopify’s privacy requests: a customer erasure request deletes what that store told us about that customer, and a shop erasure request deletes the store’s data outright. If you are a shopper and want your data removed, ask the shop you bought from — we act on their instruction, not our own.

7. Who we share it with

• Meta Platforms — messages sent or received over the WhatsApp Business Platform necessarily pass through Meta, under its own terms and privacy policy.
• Cloud hosting and infrastructure providers that run the service.
• AI model providers, as described above.
• Payment processors, for subscription billing.
• Authorities, where we are legally required to disclose — and only to the extent required.

8. Where data is held

Data is hosted in Singapore where practical. Some providers listed above process data outside Singapore; where that happens we take steps intended to give the data a standard of protection comparable to the PDPA.

9. How long we keep it

Conversation content is retained for as long as the business’s workspace is active, and deleted within a reasonable period after the account is closed, unless we are required to keep it. Account and billing records are kept as long as needed for legal and accounting purposes.

10. Security

Access is authenticated and scoped per workspace, data is isolated per tenant at the database level, credentials for third-party channels are encrypted at rest, and traffic is encrypted in transit. No system is perfectly secure, and we do not claim otherwise.

11. Your rights

Under the PDPA you may ask for access to the personal data we hold about you, ask us to correct it, and withdraw consent to its use. Write to service@medpath.com. We will respond within a reasonable time. Withdrawing consent may mean we can no longer provide the service.

12. Changes

We may update this policy. Material changes will be notified to workspace administrators, and the date at the top of this page will change.

Contact

MedPath AI Pte. Ltd. (UEN 202315420D)
81 Ayer Rajah Crescent #02-53, Singapore 139967
service@medpath.com