Rebytes Desk is a staff tool. It is used by employees of a clinic to handle that clinic's own WhatsApp conversations, patient records, appointments and invoices. It is not a consumer app and it is not used by patients.
The clinic is the controller of the data shown in the app. Rebytes acts as a processor on the clinic's behalf, under the agreement between Rebytes and that clinic.
What the app handles
| Data | Why | Where it comes from |
|---|---|---|
| WhatsApp messages, including any photos, documents and voice notes sent in a conversation | So an agent can read and answer the clinic's enquiries | The clinic's own WhatsApp session, via the Rebytes platform |
| Patient name, phone number, file number, date of birth, sex, appointments, invoices and balances | So an agent can identify who they are speaking to, book, and bill | The clinic's own Odoo system |
| Agent name, login and role | To sign in and to attribute actions to the person who took them | The clinic's administrator |
The app does not ask for, and cannot reach, anything on the device beyond what a task requires: the photo library and camera only when an agent attaches a file to a message, and Face ID or the device passcode only to unlock the app after it has been left idle.
What the app stores on the phone
- A session token, in the iOS keychain, restricted to this device and readable only while the device is unlocked. Signing out deletes it.
- Display preferences — colour theme, accent, alert and lock intervals, the agent's own quick replies, and the clinic name typed at the last sign-in.
Patient records and message content are not written to the phone's storage. They are held in memory while a screen is open and are gone when the app closes.
Security
Traffic between the app and the Rebytes platform is encrypted in transit (TLS), and data at rest on Rebytes' servers is encrypted. Access is scoped per clinic: an agent signed into one clinic cannot read another clinic's data. A clinic administrator can revoke an agent's seat at any time, and the app signs that agent out.
How WhatsApp encryption applies here. Messages travel between the patient's WhatsApp and the clinic's own WhatsApp session, end-to-end encrypted by WhatsApp itself. The clinic's session is one end of that encryption, and Rebytes operates it on the clinic's behalf — so the platform necessarily handles the messages in readable form in order to show them in the app, match them to a patient file and store the conversation.
That means the accurate description is encrypted in transit and at rest, with access scoped per clinic — not “end-to-end encrypted” in the sense a patient would understand it, which would imply nobody but the two of you can read the conversation. We state it this way rather than claim a protection this architecture does not provide.
Notifications
Alerts about conversations left unanswered are scheduled on the device itself. No message content is sent to Apple's push service or to any third party in order to produce them.
What we do not do
- No analytics, telemetry or crash-reporting SDK is present in the app.
- No advertising, and no tracking across apps or websites.
- No data is sold, and none is shared with third parties for their own purposes.
Retention
Conversations, patient records and appointments live in the clinic's Rebytes platform and in the clinic's Odoo system, and are retained under that clinic's own policy and the medical-record retention rules that apply to it. The app is a window onto them and keeps no separate copy.
Your rights, and who to ask
If you are a patient of a clinic that uses Rebytes and you want to see, correct or delete the records the clinic holds about you, contact that clinic directly — they control the data. If you are a clinic and need assistance with a request, write to support@nexus-wa.com.
Accounts
Rebytes Desk does not create accounts and has no sign-up. Agent accounts are provisioned by the clinic's own administrator. See the support page for how access is removed.
Changes
If this policy changes materially we will update the date at the top and notify clinic administrators.