Privacy Policy

BossCE AI

Privacy Policy

Last updated: October 2026

Website: https://bossce.com (“BossCE”, “we”, “us” or “our”)

BossCE respects your privacy. This policy explains what information we collect when you use the website and BossCE AI, how it is used, who processes it, and your rights under the Personal Data Protection Act 2010 (Malaysia) (“PDPA”).

 

1. Information We Collect

  • Questions and uploads: the questions you type into BossCE AI and any documents or images you upload (PDF, Word, TXT, JPG, PNG, WEBP or HEIC).
  • Account details (if you register): your name, email address, password (stored only in encrypted form), profession, registration council, professional registration number, country of practice, the date you accepted our Terms, and whether you opted in to email updates.
  • Library suggestions (if you suggest a document): the file you submit, its title, document type, any note you add, and the account and date of the suggestion.
  • Contributor articles (if you write for BossCE): the article, references, images and captions you submit, your conflict-of-interest declaration, your short bio and LinkedIn link, and the date you confirmed patient consent for any clinical images.
  • Partner accounts (organisations only): the organisation name, website, category, logo and wait card line; the contact person’s name, job title, work email, phone number and password (stored only in encrypted form); the package and billing period chosen; the date and version of the Partner Agreement accepted; and invoices, payment status and placement statistics.
  • Contact form details: your name, email address and message if you contact us through the website.
  • Technical data: your IP address, browser type and pages requested, which our web server processes to deliver and secure the site.
  • Usage statistics: the pages you view, how long you actively read them, the website or campaign link that brought you here, your device type, operating system, browser language and time zone (see section 5).
  • Cookies: essential cookies, and Google Analytics cookies only if you accept them, as described in our Cookie Policy.

Registration is optional. Guests can use BossCE AI with a lower daily limit without creating an account.

 

2. Patient Information

Do not submit patient-identifiable information. Remove names, NRIC or passport numbers, dates of birth, record numbers, faces and any other identifiers from text, images and documents before using BossCE AI. You are responsible for ensuring that anything you submit complies with the PDPA and your professional obligations.

 

3. How We Use Information

  • To generate answers to your questions and analyse documents or images you upload
  • To operate, maintain and secure the website, including applying daily usage limits
  • To create and manage your account, confirm your email address, and verify your professional registration against the public register of the council you name
  • To send service emails about your account, such as confirmation and verification notices
  • If you opt in, to send BossCE updates, clinical education and relevant professional offers. You can unsubscribe at any time.
  • To review, edit and publish articles you contribute, show your author profile with them, and tell you the outcome
  • To review documents you suggest for the BossCE Library and tell you the outcome
  • To respond to enquiries sent through the contact form
  • To measure how the website and BossCE AI are used, so we can improve them and report overall usage to partners and sponsors
  • To comply with legal obligations

We do not sell personal data, and we do not use your questions or uploads to train our own AI models. We do not share your account details with sponsors or other third parties. Usage figures we share with partners or sponsors are totals only (for example, monthly visitors or questions answered) and never identify you. If we offer sponsored education in future, any communication will come from BossCE, only to users who opted in, and sponsored content will be clearly labelled.

 

4. AI Processing and Third-Party Services

  • Google Gemini API: your question, recent conversation context and any uploaded files are sent to Google’s Gemini API to generate an answer. BossCE uses Google’s paid API service, under which Google does not use this content to improve its products. Google may retain it for a limited period for abuse monitoring, as set out in Google’s terms.
  • Uploaded files: files are stored by Google’s Gemini Files API for up to 48 hours and then deleted automatically.
  • BossCE Library (Google Gemini File Search): documents approved for the BossCE Library, such as IFUs, guidelines and open-access papers, are stored and indexed in Google’s Gemini File Search service so that BossCE AI can quote them when answering any user’s question. To find relevant excerpts, your question is also sent to this service.
  • Library pre-screen: when you suggest a document, it is sent to the Gemini API for an automated check (patient data, currency, accuracy, promotional content and copyright) before a person reviews it.
  • Contributor pre-screen: when you submit an article, its text is sent to the Gemini API for an automated check (patient data, promotional content, unsupported claims and references) before a person reviews it.
  • Google Search: to find sources for each answer, search queries based on your question are sent to Google Search.
  • Google Analytics (only with your consent): if you accept analytics cookies in our cookie banner, Google Analytics 4 records the pages you visit, how you reached the site, your device and approximate location, using cookies. Google Analytics 4 does not store IP addresses. If you decline, Google Analytics sets no cookies. You can change your choice at any time in the cookie settings.
  • Cloudflare Turnstile: our contact and partnership forms use Cloudflare Turnstile to check that a real person, not a bot, is sending the form. Cloudflare processes technical information about your browser and device, including your IP address, for this check only. Turnstile does not set advertising or tracking cookies.
  • Stripe (partner payments only): invoices for partner organisations are created and paid through Stripe. We send Stripe the organisation name, contact email and invoice details. Card and bank details are entered on Stripe’s pages and processed by Stripe; BossCE never sees or stores them. Stripe processes this data under its own privacy policy, and it may be processed outside Malaysia.
  • Google Fonts: some website fonts are loaded from Google, which receives your IP address when your browser requests them.
  • Web hosting: our hosting provider stores and serves the website and its server logs.

 

5. Storage and Retention

  • Conversation history: your recent questions and answers (up to the last 20 exchanges) are held in a temporary server session linked to a session cookie. They are deleted when you click Clear Discussion or when the session expires after a period of inactivity. BossCE does not save question content to a permanent database.
  • Usage-limit records: to apply daily limits, we store a query count linked to your account if you are signed in, or to a one-way encrypted (hashed) form of your IP address if you use BossCE as a guest. These records expire after 24 hours.
  • Question statistics: for each question, we record the date and time, your account (if signed in), your profession and country, the broad clinical topic (for example “Endodontics”), how you reached the site, and whether sources were found. We do not store the text of your question or the answer. These records are kept for up to 13 months and are used to improve BossCE and to report overall usage. Partners and sponsors only ever see totals.
  • Library suggestions: the file is held in a private, non-public folder on our server until we decide. If it is approved, it is indexed in the BossCE Library, and a private archive copy is kept on our server as a record of exactly what the library contains. Both stay until we delete the document from the library. If it is rejected, the file is deleted. We keep a short record of each suggestion (title, type, decision and the account that suggested it) for audit purposes.
  • Website analytics: we also measure visits with our own cookie-free analytics, which uses no cookies or browser storage. For each page view we record the page, active reading time, referring website or campaign tag, device type, operating system, browser language and time zone, plus a visitor code made from your IP address and browser that changes every day and cannot be reversed. We do not store your IP address. If you are signed in, your page views and sign-ins are linked to your account so we can see how clinicians use BossCE. These records are deleted after 400 days.
  • Account details: kept while your account is active. If you ask us to delete your account, we delete your account details within 30 days, except where we must keep limited records to meet legal obligations.
  • Contributor articles: published articles stay public, with your name, profession, country, bio, LinkedIn link and conflict-of-interest declaration, until you ask us to withdraw them or we remove them. Your email address and registration number are never published. Articles that are declined or withdrawn are kept as unpublished records, and we delete them if you ask.
  • Partner records: partner account details are kept while the partnership is active. Invoices, payment records and the accepted Partner Agreement are kept for at least 7 years after the end of the financial year they relate to, as required for tax and accounting records. Logos and links are removed from the site when a partnership ends.
  • Contact enquiries: kept in our email inbox for as long as needed to respond and for reasonable record-keeping.

 

6. Transfers Outside Malaysia

Google and our service providers may process information on servers outside Malaysia. By using BossCE AI, you consent to this transfer for the purposes described in this policy.

 

7. Security

All site traffic is encrypted with SSL/TLS. Our AI API key is stored securely on the server and is never exposed to browsers. No system is completely secure, so please do not submit identifiable patient information.

 

8. Your Rights

Under the PDPA, you may request access to or correction of personal data we hold about you, withdraw consent (including to email updates), ask us to limit its processing, ask us to withdraw an article you contributed, or ask us to delete your account. Because conversation history is temporary and not linked to an identity, you can delete it yourself at any time with Clear Discussion.

 

9. Changes to This Policy

We may update this policy from time to time. The “Last updated” date above shows when it was last changed.

 

10. Contact

For privacy questions or requests, contact hi@bossce.com.