Project Line

Privacy Policy

Effective date: 16 May 2026

1. Who we are

Project Line ('we', 'us', 'our') is the developer of Intelligent Clinic Management Platform, a SaaS platform for medical and dental clinics. We are established in Israel and have no establishment in the United Kingdom. A UK representative under Article 27 of the UK GDPR will be appointed and named on this page before we begin processing the data of clinics established in the United Kingdom; until then, all such requests should be sent to the contact address below. For any privacy question or to exercise your rights, contact us at support@projectlineil.com.

2. Scope of this policy

This policy describes how we handle personal data when a clinic (the 'Customer') uses Intelligent Clinic Management Platform. The clinic is the data controller for its patient information. Project Line acts as a data processor on the clinic's behalf, under written instructions and our Data Processing Agreement.

3. What data we process

4. Why we process it

We process the above data solely to operate the service on behalf of the clinic: deliver inbound and outbound calls, manage the clinic's calendar, generate prescriptions, send appointment reminders, allow the clinic to export its data, and provide customer support. We do not use clinic or patient data to train AI models or for advertising of any kind. The clinic's own mailings to its patients fall into two groups: service messages — invoices, changes to the terms, account-security notices and appointment reminders — are sent as part of the contract, while marketing messages such as clinic news and offers are sent only with the recipient's separate consent, which may be withdrawn at any time (section 3A of the Terms of Service; PECR 2003, reg. 22). Patient records are health data: a special category under Article 9 GDPR and protected health information under HIPAA. We process them only because the service cannot work without them — without the patient's record there is no appointment, no prescription and no invoice; the lawful basis belongs to the clinic (consent or the contract for medical treatment, Article 9(2)(h) GDPR — medical diagnosis and the provision of health care), and Project Line processes such data only on the clinic's documented instructions.

5. Lawful basis

For European patients (EU GDPR): we rely on the clinic's lawful basis for processing patient data (consent or contract for medical treatment), with Project Line acting as processor under Article 28 GDPR. For UK patients: we process under the UK GDPR and the Data Protection Act 2018, with Project Line acting as processor under Article 28 UK GDPR; the supervisory authority is the Information Commissioner's Office (ICO). For US patients (HIPAA): a Business Associate Agreement (BAA) is available on the BAA (US) page.

6. Sub-processors

We rely on the following trusted infrastructure providers: The full list, with updates, is on the Sub-processors page.

7. Where data is stored

Primary storage: Microsoft Azure SQL Database in the Israel Central region. Backups: point-in-time restore covers 7 days; weekly backups are kept for 8 weeks and monthly backups for 12 months. Backups are encrypted and held in the same region. Each clinic has its own isolated row-set with token-scoped access — no cross-clinic visibility, even by us, without explicit access.

8. How long we keep it

While the clinic's subscription is active, we keep all data necessary to operate the service. Within 30 days of subscription cancellation, the clinic's data and its patients' data are deleted from the live database. Backups are taken of the database as a whole, so data belonging to a deleted clinic remains in the encrypted backups until those backups expire (no more than 12 months); the backups serve disaster recovery of the system as a whole and are not otherwise processed. Before closing the account the clinic must export its records (export function in the application) and keep them for the period that the law of its own country lays down for health records — in the United Kingdom the NHS Records Management Code of Practice 2021 sets a minimum of 8 years after the patient's last contact for adult health records, and 10 years after death for GP records. The clinic, as controller, can request deletion by email at any time, subject to those retention obligations.

9. Sharing & disclosure

We do not sell patient or clinic data. We do not share it with marketing, analytics or social networks. We disclose only as required:

10. Your rights

Patients should address access, correction or deletion requests to their clinic first — the clinic is the controller. The clinic can fulfil these from the Intelligent Clinic Management Platform application directly. If the clinic does not respond within 30 days, you may contact us at support@projectlineil.com or submit a request via the Patient Portal. Clinics have the right to: (a) export their complete dataset as a ZIP at any time; (b) request permanent deletion within 30 days; (c) receive a copy of our DPA / BAA on request; (d) lodge a complaint with their local supervisory authority (in the UK, the ICO; elsewhere, for example, the CNIL, the AEPD, the Garante, the BfDI, the Israeli PPA or the US HHS Office for Civil Rights). Anyone who receives marketing messages may withdraw that consent at any time — through the unsubscribe link in the email (or the unsubscribe button the mail application shows), by replying STOP to a text or WhatsApp message, or by asking the practice to clear the consent tick in the patient record. Withdrawal is free, takes effect immediately and does not stop service messages.

11. Security

Concrete controls in place today:

12. Children

Clinics may treat patients under 18. We rely on the clinic to obtain parental consent for processing minors' data in accordance with the clinic's jurisdiction.

13. Changes to this policy

We will post any material change to this page at least 30 days before it takes effect, and notify the clinic's primary contact by email.

14. Contact

Project Line
Email: support@projectlineil.com
Jurisdiction: Israel