Privacy Policy

1. Who decides about the data

Data of patients and of anyone who talks to a clinic on WhatsApp: the clinic is the controller. We are a processor (operador): we handle this data only to provide the service to the clinic, on its instructions and under a data processing agreement (DPA) signed with each clinic.

Data of the clinic team's accounts, of people who fill in the contact form on our site and of visitors to our pages: we are the controller.

2. What data we handle

• Clinic team accounts: name, e-mail, role (owner, reception, marketing), password stored only as a hash, a log of actions in the system (for example who answered a conversation or marked a booking).
• WhatsApp conversations received through the official API (Meta's WhatsApp Business Platform): phone number, WhatsApp profile name, message text, time and delivery status. Photos and voice messages stay at Meta and are fetched only when the team opens the conversation; we do not store the file.
• Where the conversation came from: the Meta ad that led to the message (ad id, headline and text, click id), or the clinic's web page, UTM parameters and click ids (gclid, fbclid) recorded by the clinic's site script.
• What the clinic's team records: conversation stage, bookings, service, insurer, value, notes, category (for example why a patient was lost) and the patient's consent to marketing messages.
• Script on the clinic's site: keeps in the visitor's browser (localStorage, no cookies) how they arrived at the site, for up to 30 days, and sends it when they click a WhatsApp link. If the clinic turns on the short form, also the phone number typed and the consent.
• Contact form on our site: name, clinic, phone, e-mail and message.
• Panel cookies: login session, chosen language and selected clinic. They are needed for the panel to work; we use no advertising cookies.

3. Health data

Patients' messages may contain sensitive data, such as health information. We handle it only on the clinic's behalf and for the contracted service, with access limited by role. The clinic is responsible for the legal basis (for example protection of health or performance of a contract with the patient) and for the consent required for marketing messages.

4. Why we use the data and on what legal basis

We do not sell data, we do not use patients' data for our own advertising, and we do not use data received from Meta for anything other than providing the service to the clinic.

• Providing the service to the clinic (inbox, bookings, reminders, campaigns, report): performance of our contract with the clinic; for patients' data, on the clinic's instructions.
• Showing the clinic which ad, page or link each conversation came from: performance of our contract with the clinic.
• Automatic AI reading, only when the clinic turns it on: a summary and a suggested category for each conversation, which the team confirms or corrects. Names, phone numbers and e-mails are removed from the text before it is sent to the model. If voice transcription is on, the audio is sent to the model to be turned into text and cannot be anonymised first.
• Security and abuse prevention (locking after wrong passwords, technical logs): legitimate interest.
• Answering people who fill in the contact form: steps before a contract, at their request.
• Legal obligations and defending rights: legal obligation and regular exercise of rights.

5. Who we share it with

We use these providers (sub-processors), each under contract and only for what is needed:

• Meta Platforms (WhatsApp Business Platform): sending and receiving messages, message templates approved by Meta.
• Vercel Inc.: application hosting, on servers in Brazil (São Paulo).
• Supabase Inc.: database, on servers in Brazil (São Paulo).
• OpenRouter Inc. (United States) and the chosen AI model provider: only for the AI reading, when on, with text stripped of names and phone numbers and the no-retention option turned on.

6. International transfers

Clinic and patient data is stored on servers in Brazil. It leaves Brazil only in three cases: (a) the AI reading, when the clinic turns it on, sends the text, already stripped of names and phone numbers, to OpenRouter and the model provider in the United States; (b) Meta itself handles WhatsApp messages on its own infrastructure, also outside Brazil; (c) our team in Poland (European Union) opens the panel to give support. These transfers follow article 33 of the LGPD, with standard contractual clauses (ANPD Resolution CD/ANPD No. 19/2024) or another lawful mechanism, and, within the European Union, the GDPR.

7. How long we keep it

• Clinic and patient data: while the contract with the clinic is active. After it ends, or when the clinic asks, we delete it within 90 days, except what the law requires us to keep.
• Team accounts: until the clinic deactivates the user or the contract ends.
• Contact form: up to 12 months after the last contact, if no contract follows.
• Technical security logs: up to 6 months.

8. Security

Encrypted connections (HTTPS); each clinic's data is kept apart and each user sees only what their role allows; passwords stored as hashes; the account locks after five wrong passwords; each clinic's Meta access keys are stored encrypted; calls from Meta are accepted only with a valid signature.

9. Your rights

You can ask for confirmation, access, correction, anonymisation, portability, deletion, information about sharing and withdrawal of consent (LGPD article 18; GDPR articles 15 to 21).

If you are a patient or talked to a clinic on WhatsApp, contact the clinic first: it decides about your data. If you write to us, we forward the request to the clinic within 5 business days and help it answer. For deletion, see also the Data deletion page.

For data we control (team accounts, contact form), write to contact@docpulso.com. We answer within 15 days. You may also complain to Brazil's data protection authority (ANPD) or to the authority of your EU country.

10. Data protection officer (encarregado)

Data protection officer: Philippe Skibniewski, contact@docpulso.com.

11. Children

The panel is for clinic professionals, not for children. When a clinic treats minors, it is responsible for the parental consent the law requires.

12. Changes to this policy

We may update this policy. The date at the top shows the latest version. Clinics are told about important changes in advance.