Privacy Policy

encnt (“encnt”, “we”, “us”) designs and builds AI calling agents, workflow automations and software for healthcare, wellness and service businesses. Our office is at White Swan Building, Sheikh Zayed Road, Al Wasl, Dubai, United Arab Emirates.

This policy applies when you:

• browse encnt.com or any page we host on it;
• send us an enquiry through the contact form or by email;
• try the AI voice agent demo;
• comment on or message our Facebook Page, Instagram or Threads account;
• visit a practitioner's page we host for them (see section 7); or
• work with us as a client, or as a contact at a client.

It doesn't cover the separate websites, phone lines or apps that we build and run for clients under their own brand. Those are governed by the client's own privacy notice.

When you fill in the contact form

Your name, email address and message are required. You can also give us your phone number, company, industry, the kind of automation you're interested in, rough monthly call volume, current monthly cost, and any compliance requirements. We only ask for these because they let us come back with a useful answer on the first reply.

When you try the voice agent

Your browser asks for microphone permission. If you allow it, your voice is streamed to our voice provider, ElevenLabs, so the agent can hear and answer you. The conversation is transcribed as part of that process. You can end the call at any time, and nothing is recorded before you press start.

When you sign in to the admin area

Practitioners and staff with an account give us an email address and a password. We store the password only as a one-way bcrypt hash, so nobody at encnt can read it.

Automatically, when you visit

Like any website, our servers receive your IP address, browser and device type, the page you asked for, the referring page and the time of the request. We use this to keep the site running and to spot abuse.

What we don't collect

We don't run advertising pixels, cross-site trackers or third-party analytics on encnt.com. We don't buy contact lists, and we never ask website visitors for payment card details.

• Replying to enquiries. Reading your message, preparing an automation audit or proposal, and following up on it.
• Running the demo. Letting the voice agent hold a real conversation with you.
• Delivering client projects. Building, testing and supporting the automations described in your signed proposal.
• Security and reliability. Preventing spam and misuse, investigating faults, and keeping admin accounts safe.
• Legal and accounting duties. Keeping invoices and records that UAE law requires us to keep.

We will not sell your personal data, rent it out, or add you to a marketing list you didn't ask to join. We don't use what you send us, or client data, to train AI models that anyone outside your project can use.

We handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Where the EU or UK General Data Protection Regulation applies to you, these are the grounds we rely on:

• Consent for the voice demo, which only starts when you grant microphone access and press start. You can withdraw it by ending the call.
• Steps before a contract, and the contract itself when you ask us for an audit or proposal, or become a client.
• Legitimate interests for server logs, fraud and abuse prevention, and keeping a record of our conversations with you. We have weighed these against your rights and kept them narrow.
• Legal obligation for tax, accounting and any lawful request from an authority.

We use a handful of providers (“processors”) who handle data on our instructions and for no other purpose:

On client projects we may connect further tools you already use, such as your CRM, calendar, telephony or practice-management system. Those are listed in your proposal and you approve each one before we connect it.

Beyond that, we only disclose personal data if the law requires it, to protect someone's safety, or as part of a sale or merger of our business, in which case this policy would continue to apply to your data.

When you comment on or message encnt's Facebook Page, Instagram account or Threads account, we receive information through the official Meta APIs:

• your public comments and replies on our posts, with your username, display name and account ID;
• messages you send us, and the messages we send back (for example, when you comment a keyword asking for the breakdown of an automation);
• aggregate post statistics from Meta (reach, likes, comments, saves, shares), which are not linked to you.

We use this to reply to you, send you the information you asked for, follow up if you showed interest in our services, and understand which posts are useful. We do not sell it or use it for advertising profiles.

Automated replies. AI (Anthropic's Claude API) helps draft our replies and sort comments by topic, based on your comment and the post it was left on. Our automation runs on n8n, hosted by Railway, which stores comment and message records. You can always ask to speak to a person.

Retention. Social media comment and message records are kept for up to 12 months after our last interaction, then deleted, unless you become a client.

Deletion. Email privacy@encnt.com with your username, or message us “delete my data”. We delete your records within 30 days. Full instructions: encnt.com/data-deletion

The voice agent and chat assistants on our site produce answers automatically, without a person reviewing each reply. Please don't share health information, ID numbers or payment details with a demo. None of these assistants give medical, legal or financial advice.

When we deploy calling agents for clients, we set them up to say they are automated where the law requires it, and we build in a route to a real person.

We host profile pages for therapists and other practitioners at addresses like encnt.com/practitioner-name, and we run automations inside client businesses. In both cases the practitioner or client is the controller of the personal data involved and we are their processor.

That means if you booked, messaged or spoke to an assistant on one of those pages, the practitioner is responsible for your data and is the right first contact for any request about it. If you contact us instead, we'll pass your request to them promptly and help them answer it.

With clients, we sign a data processing agreement on request. Where a project involves patient health information, we agree the specific safeguards in writing before any real data flows through the system.

• Enquiries are kept for 24 months after our last exchange with you, then deleted, unless you become a client.
• Client records (contracts, invoices, project correspondence) are kept for the length of the engagement and then for the period UAE commercial and tax law requires, currently up to five years.
• Voice demo conversations are not saved to our own systems. ElevenLabs processes the audio to run the call under its own data retention terms.
• Social media comments and messages are kept for up to 12 months after our last interaction, then deleted, unless you become a client.
• Admin accounts are deleted within 30 days of the account being closed.
• Server logs are kept for a short period by our hosting provider and then rotated out.

You can ask us to delete your data sooner. See section 12.

encnt.com sets a single cookie, auth-token. It is only created when a practitioner or admin signs in, it is marked HTTP-only so scripts on the page can't read it, and it is removed when you sign out. It is strictly necessary for the admin area to work.

Your browser may also store a small display preference (light or dark theme) in local storage. It never leaves your device.

We don't use advertising or analytics cookies. If that ever changes, we'll ask for your consent first and update this section.

All traffic to encnt.com is encrypted in transit with TLS. Passwords are hashed with bcrypt. Admin access is split by role, so a practitioner can only see and edit their own page. Access to client systems is limited to the people working on that project and removed when the work ends.

If we become aware of a breach that affects your personal data, we will notify you and the relevant authority within the time the law requires, and explain what happened and what we are doing about it.

We are based in the UAE, and several of our providers store or process data in the United States and the European Union. When personal data leaves the country it was collected in, we rely on the transfer mechanisms the applicable law allows, such as adequacy decisions or standard contractual clauses, and on our providers' own security commitments.

Depending on where you live, you can ask us to:

• confirm whether we hold data about you and give you a copy;
• correct anything that is inaccurate or incomplete;
• delete it, where we have no legal reason to keep it;
• limit or stop a particular use of it;
• send it to you or another provider in a common, portable format;
• withdraw consent you gave earlier.

Email privacy@encnt.com with your request. We may ask you to confirm your identity before acting on it. We reply within 30 days, and there is no charge unless a request is plainly excessive.

If you're unhappy with how we've handled your data, you can complain to the UAE Data Office or to the data protection authority where you live. We'd appreciate the chance to put it right first.

Our services are built for businesses and their staff. They aren't aimed at anyone under 18, and we don't knowingly collect data from children. If you think a child has sent us personal data, let us know and we will delete it.

When we change this policy, we update the effective date and version at the top of the page and record it in the revision history at the bottom. If a change materially affects how we use data we already hold, we'll email active clients before it takes effect. Our Terms of Service explain the rules for using the site and our services.

For anything about privacy or your data, email privacy@encnt.com, or write to encnt, White Swan Building, Sheikh Zayed Road, Al Wasl, Dubai, UAE.