Privacy at LeadMara
Last updated 21 September 2026
LeadMara is software that clinics and agencies use to contact people who have enquired about their services, over WhatsApp. This page explains what the software holds about you, who else sees it, and what you can ask us to do about it.
Who is responsible for your data
LeadMara is a product of Indrit Kalaj, a sole trader registered in Albania under NIPT M32406020G, at Blv. Nene Tereza, Rruga Polican, Apartamenti 1, Shkalla 1, Kati 6, Banesa 23, Kamez, Tirane, Albania.
There are two different relationships here, and which one applies to you changes what you can ask of us.
If a clinic contacted you
The clinic or agency decides to contact you, chooses what to record about you, and decides how long to keep it. They are the data controller. We supply the software and process your data on their instructions, as their processor. You can exercise your rights with either of us - if you come to us, we will act on the clinic's instruction and tell you who they are.
If you use LeadMara at work
For operator and administrator accounts, we are the controller of the account itself - your name, work email and sign-in activity.
Health and other sensitive information
This deserves its own section, because the clinics using LeadMara sell medical, dental and cosmetic procedures, and conversations about them are rarely neutral.
Information of this kind reaches the software in three ways:
- the procedure recorded against your enquiry - a named treatment, which by itself can suggest a medical condition;
- answers the clinic asks for, which depending on the clinic can include stated medical conditions, allergies, whether you have had a procedure before, or an assessment of your condition;
- whatever you choose to write or send in a WhatsApp message - a description of a symptom, a photograph, a document. This is not constrained by the software, and messages and attachments are stored in full.
Under UK and EU data protection law, information about your health is a special category of personal data and needs a stronger justification than ordinary contact details. Where a clinic records it, that clinic is responsible for obtaining your explicit consent before doing so, and for being able to show that it did.
You are never obliged to share health information in order to be given an appointment or a price. If you would rather not put something in writing, say so and ask the clinic to discuss it on a call instead - call audio is never recorded.
Who inside the clinic can see it
The operator handling your enquiry can see your record and your full conversation. Administrators at the clinic can see the records of everyone their organisation is contacting, including yours, and can see who opened which record. Staff at other clinics using LeadMara cannot see anything about you. LeadMara is run by one person, who does not read your conversations in the ordinary course of running the service.
What we hold about people who are contacted
Your details reach us because a clinic uploaded them, or because you replied to a message.
| What | Detail |
|---|---|
| Who you are | Your name and your phone number in full international form. |
| What you enquired about | The service or procedure recorded against your enquiry, and any further answers the clinic chose to collect. See the section above. |
| Your messages | The full text of every WhatsApp message between you and the clinic, in both directions, and whether each was delivered and read. |
| Anything you send | A copy of every photo, document, voice note or location you send over WhatsApp is downloaded and stored on our systems. |
| Calls | When a call was placed, whether it connected, how long it lasted and how it ended. Call audio is never recorded. Calls run directly between the operator's device and WhatsApp and do not pass through our servers. |
| What the operator wrote | The operator's own notes after speaking to you, the outcome they recorded, and any follow-up date or appointment. |
| Permission and refusals | Whether you allowed the clinic to call you, and whether you refused a particular number. Refusals are kept deliberately, so that a refusal is not lost and you are not approached again through another department. |
| Access records | Which member of staff opened your record, and when. |
What we hold about people who use LeadMara at work
Your name, work email address, role, which parts of the organisation you belong to, and a record of when you signed in and which contact records you opened. If you enable notifications, we store a notification token for each of your devices, deleted when you sign out.
We also record the network addresses your organisation connects from. This is kept per organisation and never per person: the record says that your clinic connected from an address, not who was at it or when they were working. It exists so that an organisation which asks us to restrict access to its own premises can be set up by pointing at an address already known to work, rather than by typing one and locking its own staff out. These records are deleted after 30 days, and only LeadMara can read them — not your employer, and not an administrator at your organisation.
We do not use analytics, advertising identifiers, crash reporting or any other tracking in this app. Nothing profiles you.
Who else sees your data
| Who | What they receive | Why |
|---|---|---|
| Meta (WhatsApp) | Your phone number, the content of messages in both directions, any files exchanged, and call signalling. Meta holds this on its own account under its own terms. | WhatsApp is how the clinic talks to you. |
| Supabase | Everything listed above - this is where the database and files live. | Hosting. |
| Google (Firebase) | When a notification is sent to a member of staff, it carries your name - or your phone number if no name is stored - and, unless the clinic has turned previews off, the first 120 characters of your message. | Delivering notifications to staff devices. |
| Google (STUN) | The staff device's network address during call setup. Nothing about you. | Establishing the call connection. |
| Cloudflare | Request information, including IP address, for people using the web version. Not applicable to the mobile app. | Serving the website. |
| POK Payments | Nothing about you - only clinic billing amounts. Card details are entered directly into POK's own form and never reach us. | Clinic subscription payments. |
We do not sell your data, and we do not share it with anyone for advertising.
Where your data is held
Our database and files are hosted in the European Union. Meta and Google operate globally and may process data outside the EU under their own transfer safeguards.
How long we keep it
Messages, call records, notes, access records and any attachments you sent are deleted after 730 days - about two years. Records are also deleted when the clinic erases a contact. When that happens we keep a one-way fingerprint of the phone number and nothing else, purely so that the same number is not uploaded and contacted again by mistake - it cannot be turned back into a phone number.
Billing records are kept for as long as accounting law requires.
Your rights
If you are in the UK or the EU, you can ask to:
- see a copy of everything held about you;
- have it corrected if it is wrong;
- have it deleted;
- object to being contacted, at any time and for any reason;
- withdraw consent to health information being held, at any time;
- have it sent to you in a portable format;
- complain to your national data protection authority.
You never have to give a reason to stop being contacted. Reply STOP to any WhatsApp message, or tell the operator on a call, and the number is blocked from further contact. That block does not expire.
Children
LeadMara is not intended for anyone under 18 and clinics should not upload their details.
Changes
If this page changes, the date at the top changes with it.
Contact
Write to [email protected], telephone +355 69 222 8256, or post to Indrit Kalaj (LeadMara), Blv. Nene Tereza, Rruga Polican, Apartamenti 1, Shkalla 1, Kati 6, Banesa 23, Kamez, Tirane, Albania.
Back to LeadMara · Who we message for
WhatsApp Business API for clinics and agencies · Why WhatsApp numbers get banned, and how to avoid it