What a request can cover

These instructions cover data Flow Clinic receives from Facebook Messenger or Instagram, including account identifiers, profile name and photo, message content and metadata, and links between a conversation and a clinic customer record. They may also be used for Flow Clinic account data for which we act as controller.

How to submit a request

If you are a clinic customer, first contact the clinic you messaged or visited. The clinic is the controller and is best placed to identify the relevant clinical record or conversation.
If the clinic is unavailable, or the request concerns a clinic's Flow Clinic account or Meta connection, email sawasdee@flowclinic.tech with the subject “Data Deletion Request”.
Include the clinic name, Facebook Page or Instagram account, the channel used, approximate profile name, and conversation date range. Never email a password, access token, OTP, or unnecessary health records.
We will acknowledge the request, seek only the information needed to verify identity and locate the records, and explain the outcome or any legal reason that requires limited retention.

What happens after verification

Data that does not need to be retained will be deleted or de-identified as appropriate.
Records a clinic must retain, such as accounting or clinical records, may remain access-restricted until the applicable legal retention period ends.
If a clinic ends its subscription entirely, clinic data is kept for 90 days from the end date so it can be exported, and is then deleted or de-identified, as set out in clause 12 of /en/terms.
Removal from normal use may occur before deletion or de-identification is completed in primary systems and backups.
Deleting data from Flow Clinic does not delete copies retained independently by Facebook, Instagram, the clinic, or other message recipients. Use the relevant provider's controls where necessary.

For clinic administrators disconnecting Meta

Turning off the Facebook channel in Flow Clinic stops new message processing. It is not a request to delete existing history and does not by itself confirm that Meta permissions have been revoked. To remove the app's authorization and request deletion of related data, remove Flow Clinic from Meta Business Integrations and email sawasdee@flowclinic.tech.