KDC Web Tools · Kitcha Dental Clinic
KDC Web Tools Privacy Policy
How KDC Web Tools, the clinic's internal software, accesses, uses, shares, protects, keeps and deletes data received from Google APIs.
At a glance
Data we access
Only the clinic's own Google Ads, Business Profile, Search Console, Tag Manager and Drive data.
DetailsHow we use it
To run the clinic's own ads, listing and website. Not sold, not used to train AI models.
DetailsProtection
Encrypted connections, the clinic's own server, owner approval for every change.
DetailsDeletion
Ask us to delete data by email. We reply within 30 days.
Details
About this policy
This policy covers KDC Web Tools, a set of internal software tools operated by Kitcha Dental Clinic, Chiang Mai, Thailand ("the clinic", "we"). It explains what data the tools access from Google APIs, and how we use, share, protect, keep and delete it.
For personal data the clinic collects in other ways, such as through its website, by phone or at the clinic, see the clinic's Privacy Policy.
Who uses the tools and how they connect to Google
The tools are internal. Only the clinic owner and staff authorised by the owner use them, to manage the clinic's own Google accounts. Patients, website visitors and other members of the public do not sign in to the tools or connect their Google accounts to them.
The Google Ads, Search Console, Tag Manager and Drive tools use a service account that belongs to the clinic's own Google Cloud project and has been given access only to the clinic's own accounts. The Google Business Profile tools sign in with the clinic's own Google Workspace account ([email protected]) using the permission https://www.googleapis.com/auth/business.manage.
Google user data we access
The tools work only with the clinic's own accounts:
| Google service and permission | Data we access |
|---|---|
Google Ads API https://www.googleapis.com/auth/adwords | Campaigns, ad groups, ads, keywords, budgets and settings of the clinic's own Google Ads account, and its performance reports (impressions, clicks, costs, conversions and the search terms that showed our ads) |
Google Business Profile APIs https://www.googleapis.com/auth/business.manage | The clinic's own business profile (name, address, opening hours, categories, description, services, photos and posts), its performance figures, and the reviews on the profile with our replies. Reviews show the reviewer's public name, profile photo, rating and comment |
Google Search Console API https://www.googleapis.com/auth/webmasters.readonlyhttps://www.googleapis.com/auth/webmasters | Search performance of www.kitchadentalclinic.com (search queries, pages, clicks, impressions and average position, by country and device) and our sitemaps |
Google Tag Manager API https://www.googleapis.com/auth/tagmanager.edit.containershttps://www.googleapis.com/auth/tagmanager.edit.containerversionshttps://www.googleapis.com/auth/tagmanager.publish | The settings of the clinic's own website tag container |
Google Drive API https://www.googleapis.com/auth/drive | Files in the clinic's own shared drive, and the daily backups of our website, which our website stores in the clinic's Google account. These backups contain the personal data collected through our website forms |
Data about people
Google gives us advertising, search and listing results as totals, such as the number of clicks or the search terms that led people to our ads or website. These totals do not show who searched or clicked. Two kinds of data from these tools name people: the reviews on our Business Profile, which are already public on Google, and the website backups described above, which we handle like the rest of our website data. Our tools do not match reviews with patient records.
How we use the data
| Google service | What we use it for |
|---|---|
Google Ads API | Reporting on the clinic's own advertising, and creating, checking and updating the clinic's own campaigns. Every change is first checked with a validation-only request, new campaigns are created paused, and nothing runs without the clinic owner's approval |
Google Business Profile APIs | Keeping the clinic's listing accurate, reading and replying to reviews, and measuring how people find the clinic on Google Search and Google Maps |
Google Search Console API | Understanding how people find our website, preparing internal reports and submitting sitemaps |
Google Tag Manager API | Setting up and publishing the measurement tags on our website |
Google Drive API | Exchanging internal files and reports between clinic systems and staff, and copying the latest website backup to a test copy of the website on the clinic's own server, so that changes can be checked before they reach the live website |
We use the data only to run and improve the clinic's own advertising, Google listing and website, and to report on them inside the clinic. Changes made through the tools, such as creating campaigns, editing the clinic's profile, publishing tags or replying to reviews, are approved by the clinic owner before they are sent to Google.
We do not sell this data. We do not use it to serve, target or personalise advertising to individuals, to build advertising audiences, customer lists or profiles of people, or for credit or lending decisions.
AI assistance
Clinic staff use an AI assistant, provided by a technology service provider acting on our behalf, to run these tools, analyse reports and prepare draft changes and review replies. Data from Google APIs is given to it only for the task staff ask it to do, and the provider does not use it to train AI models.
Sharing and disclosure
We do not share, transfer or disclose data received from Google APIs to anyone else, except:
technology service providers acting on our behalf, including AI processing services, which do not use the data to train AI models;
file storage and internal communication service providers acting on our behalf; and
when the law requires it.
We do not sell data received from Google APIs or transfer it to data brokers or information resellers.
How we protect the data
Data travels between the tools and Google over encrypted HTTPS connections.
The tools run on the clinic's own server, on the clinic's private network in Thailand.
The sign-in keys for the tools are kept on that server in files that only the clinic's administrator account can read.
Only the clinic owner and staff authorised by the owner can run the tools.
Every change the tools send to Google is approved by the clinic owner first.
Where we store it
On the clinic's own server in Thailand. Reports and working records may also be kept with file storage service providers acting on our behalf, including a private code repository, and short report summaries are shared with staff through an internal communication service provider.
How long we keep it and how to ask us to delete it
We keep advertising, search and listing reports and records of changes for up to 24 months, and then delete them. We keep copies of Google reviews and our replies only while the review is still shown on Google. Authorization tokens are kept until access is revoked. Website backup files are kept for no more than 30 days.
The test copy of the website is replaced with the latest backup every day; the downloaded backup file is deleted as soon as it has been loaded, and only the previous day's test copy is kept. Reviews stay on Google, where the reviewer can edit or delete them.
Asking us to delete data
To ask us to delete data that the tools received from Google APIs about you, such as a copy of your review, email [email protected]. We reply within 30 days and delete the copies we hold, unless the law requires us to keep them. Your other rights over personal data held by the clinic are explained in the clinic's Privacy Policy.
Google API Services User Data Policy and AI model training
KDC Web Tools's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not use data received from Google APIs, including data from Google Workspace APIs such as the Google Drive API, to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.
Removing access
The clinic can remove the tools' access at any time in the settings of its Google accounts; the tools then stop receiving data. No one outside the clinic connects a Google account to these tools, but anyone can review and remove the apps connected to their own Google account at any time at myaccount.google.com/permissions.
Changes to this policy
If the tools start to use Google user data in a new way, we will update this policy and its effective date before the change.
Contact
Kitcha Dental Clinic
Chiang Mai, Thailand · www.kitchadentalclinic.com
[email protected] — about this policy or about data we hold from Google APIs
App home page