Privacy policy

1. Data controller

• Controller: LEGAL ENTITY NAME
• Tax ID: TAX ID / NIF
• Registered address: FULL ADDRESS
• Data protection contact: PRIVACY EMAIL
• Data Protection Officer: NAME OR “not appointed”

2. What data we process and where it comes from

Data you give us in the demo form: name, clinic name, email address, phone number, number of physiotherapists and whatever you write in the message field.

Technical browsing data: IP address, browser type and pages visited, generated automatically when you access the site.

3. Why we use it and on what legal basis

• To handle your demo request and get in touch with you. Basis: pre-contractual measures at the data subject's request (Art. 6(1)(b) GDPR).
• To send you commercial information about AI-vanti. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• To keep the site secure and working. Basis: legitimate interest (Art. 6(1)(f) GDPR).

4. Your clinic's patient data

This section matters and is worth reading in full.

When you hire AI-vanti, the receptionist processes your patients' data (name, phone number and the reason for the visit in general terms). In that processing you, as the clinic, are the data controller and LEGAL ENTITY NAME acts as a data processor on your behalf.

That relationship is governed by a data processing agreement under Article 28 GDPR, signed before the service goes live, setting out the purposes, duration, security measures and sub-processors.

The reason for the visit may constitute special category data (health, Art. 9 GDPR). The service is configured to collect only the minimum needed to book the appointment and does not store clinical records or produce clinical assessments.

5. How long we keep it

Form data is kept for the duration of the commercial relationship and thereafter for the statutory limitation periods. If you ask us to delete it, we will, unless a legal obligation requires us to keep it.

Specific retention period for commercial leads: PERIOD, e.g. 24 months from last contact.

6. Who we share it with

We do not sell or transfer your data. It is processed on our behalf by the providers needed to deliver the service:

• Website hosting: HOSTING PROVIDER
• Artificial intelligence models: AI PROVIDER
• Telephony and messaging: VOICE / WHATSAPP PROVIDER
• Contact management tool: CRM OR EMAIL TOOL
• International data transfers: STATE WHETHER THEY OCCUR AND WHICH SAFEGUARDS APPLY — standard contractual clauses, adequacy decision, etc.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to PRIVACY EMAIL, stating which right you are exercising and proving your identity.

If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit, access control, activity logging and periodic review of providers. Service conversations are stored encrypted with restricted access.