Privacy Policy

1. Who this policy applies to

This policy applies to website visitors, people who contact EllaDesk, clinic representatives and professionals who use or evaluate our services, and people who interact with a customer clinic through an EllaDesk WhatsApp integration.

2. Data we may process

Depending on your interaction with EllaDesk, we may process the data below.

• identification and contact data, such as name, phone number, email address, and the content of submitted requests;
• technical and browsing data, such as IP address, browser type, online identifiers, visited pages, and cookie or similar-technology data when enabled;
• account, configuration, and operational data provided by customers, including administrative information needed to configure service and scheduling flows;
• messages, conversation metadata, and appointment information processed through the WhatsApp integration, as needed to provide the service to the clinic;
• payment-related data, administrative documents, follow-ups, and other information that a clinic configures for its flows.

EllaDesk is intended for administrative processes. Please do not send patient data or clinical information through the website. Where sensitive personal data is entered by a customer or a person in a conversation, it may receive the protection required by applicable law and the relevant clinic's instructions.

3. Purposes and legal bases

We process personal data for the purposes below.

• responding to contacts, demonstrations, requests, and exercising rights;
• operating, configuring, providing, maintaining, and improving the website and EllaDesk services;
• enabling administrative conversations, scheduling, confirmations, rescheduling, and handoffs defined by the customer clinic;
• preventing fraud, incidents, and misuse, and protecting system security;
• meeting legal, regulatory, and valid authority requests; and
• producing aggregate metrics or statistics to understand website use, where applicable.

As applicable, processing is based on performance of a contract or pre-contractual steps, compliance with a legal or regulatory obligation, legitimate interests in operating and protecting the service, or consent where required. In customer flows, the clinic normally determines the purposes of care for its patients; the allocation of responsibilities should be set out in the applicable agreement with each customer.

4. WhatsApp and Meta

When a clinic connects its channel to EllaDesk, we use Meta-provided interfaces and services to operate the WhatsApp integration. Meta and related companies may process data under their own terms, policies, and practices, which APTA does not control. We recommend consulting the Meta and WhatsApp documentation and policies applicable to your use of the channel.

EllaDesk processes the content and metadata received through the integration only as needed to perform the configured administrative flows, support the customer, maintain security, and comply with applicable obligations. We do not use messages to make diagnoses, provide medical advice, or make clinical decisions.

5. Sharing and service providers

We may share personal data with providers that help us host, secure, maintain, analyze, or provide the service; with communication and integration providers, including Meta/WhatsApp where the integration is used; and with the clinic or professional responsible for the service flow. These recipients act according to their role, applicable agreements, and relevant law.

We may also share data where necessary to comply with law, respond to a valid legal process, protect rights, security, or property, or in a corporate transaction, subject to applicable legal requirements.

6. International transfers

Some infrastructure, communication, or technology providers may process data outside Brazil. When this occurs, we will use the measures and safeguards required by applicable law to enable the international transfer. Meta services may also involve international processing under their own mechanisms and policies.

7. Retention and security

We retain data for as long as necessary to fulfill the purposes described in this policy, meet legal obligations, resolve disputes, exercise rights, and preserve service security. The period may vary according to the nature of the data, the customer-contracted flow, and legal requirements. At the end of the applicable period, data will be deleted, anonymized, or retained only where law permits or requires.

We use reasonable technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, or improper destruction. No system is completely fail-safe; customers and users should also protect their credentials, devices, and access to connected channels.

8. Your rights

Under Brazil's General Data Protection Law (LGPD), you may, as applicable, request confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, withdrawal of consent, and review of automated decisions. For data processed on behalf of a clinic, we may refer the request to the responsible clinic or cooperate with it to handle the request.

9. Children and adolescents

The website and service are not directed to children. If a clinic flow processes children's or adolescents' data, the flow owner must ensure the legal basis and safeguards required by applicable law. Contact us if you identify inappropriate use.

10. Changes to this policy

We may update this policy to reflect changes in the service, the law, or processing practices. The current version and its update date will remain on this page. Where appropriate, we will provide additional notice.

11. Contact

For questions, privacy requests, or to exercise your rights, email [email protected]. Privacy requests are handled exclusively by email.