Privacy Policy

Last updated: October 22, 2026 · Versión en español

1. Who handles the data

Augur is a service of SALUD VISUAL, S.A., a corporation registered in the Public Registry of Panama (folio 659785), tax ID (RUC) 1565470-1-659785 DV 80, with its address at Calle 17, Edificio Enterprises, Departamento 3, Urbanización Paso Peatonal, Santa Ana, Panama City, Panama. Contact: radiaz@saludvisualsa.com, +507 212-1712.

• Data of people who message a clinic on WhatsApp: the clinic decides why and how it is used, and is the controller. SALUD VISUAL, S.A. processes it on the clinic's behalf and following its instructions.
• Data of clinic staff who use Augur and of people who contact us: SALUD VISUAL, S.A. is the controller.

2. Data we receive from Meta (WhatsApp Business Platform)

A clinic connects its own WhatsApp Business account to Augur through Meta's Embedded Signup, using a single-use invitation link we send to that clinic. From then on, Meta provides us with:

• the IDs of the WhatsApp Business account and of the phone number, the display number and its verified name;
• an access token that allows Augur to act on that clinic's behalf;
• the messages people send to the clinic's number, and the delivery status of the messages sent to them;
• if the clinic keeps using the WhatsApp Business app on its phone ("coexistence"), the messages the clinic sends from that phone;
• the list of the clinic's approved message templates.

We use this data only to provide the service to that clinic. We do not sell it, we do not use it for advertising or profiling, and we do not share it with other clinics.

3. What data we process

• From people who message a clinic: phone number, WhatsApp profile name, message content, voice-note transcriptions, image classification (administrative or clinical) and, for administrative images, the data read from them with identity numbers masked; plus the date, type and status of each message.
• Images and audio: processed in memory; we do not keep the file. Only the transcription or classification remains.
• Messages from the clinic's phone (coexistence): every one-to-one chat on that phone appears in the Augur inbox, including chats that are not with patients. Clinics should keep this in mind before connecting a number they also use for other purposes.
• From clinic staff: name, email, role and password (stored only as a hash). Server logs record which user signs in and who performs administrative actions, such as issuing a signup link or deleting a channel.
• From the clinic: contact details and service configuration (replies, opening hours, services).

4. What we use it for

• Understanding what the person needs and replying with what the clinic configured (opening hours, location, how to book).
• Handing over to a staff member anything that needs a person. Staff can take over any conversation at any time.
• Showing conversations in the clinic's inbox and alerting staff about urgent messages.
• Sending reminders and follow-ups with message templates the clinic has approved.
• If the clinic uses Kairos (the scheduling product of SALUD VISUAL, S.A.), passing it what is needed to book, confirm or move an appointment.
• Checking daily that the WhatsApp connection still works, keeping the service secure, and providing support.

5. Service providers that process data on our behalf

• Meta Platforms (WhatsApp Business Platform): carries the messages between the person and the clinic.
• OpenAI (United States): receives message text to recognize what the person is asking (the text is sent as written), voice notes to transcribe them, and images to classify them. When staff request a summary, a translation or a suggested reply, it also receives the conversation text. Under its API terms, OpenAI does not use this data to train its models and may keep it for up to 30 days to prevent abuse.
• Hostinger (server in the United States): hosts Augur, its database and its backups.
• Browser notification services (Google, Apple, Mozilla or Microsoft, depending on the staff member's browser): carry alerts about urgent messages, with up to 80 characters of text and numbers masked.
• 360dialog: only if the clinic connects its number through that provider instead of directly with Meta.
• Resend: sends internal alert emails to our team. It is not used to write to patients, or to clinics with patient data.

6. How long we keep it

• After 90 days, message content (text, transcriptions, data read from images), notes and summaries are deleted. Only the date, type and status of each message remain.
• After 730 days (2 years), that record is deleted as well.
• Internal technical copies: processing queues keep each message for 1 day after it is processed, or 30 days if processing failed, so it can be retried. Audit records, which contain no message content, are deleted after 180 days.
• Backups: one per day; the 14 most recent are kept. Deleted data leaves the backups no later than 14 days after deletion.
• The Meta access token: until the clinic disconnects Augur or closes its account (see section 9).

This is deletion of content and data minimization; we do not call it anonymization, because the record kept for up to 2 years is still linked to a phone number.

7. International transfers

Data is processed outside Panama, in the United States (OpenAI and the Hostinger server). Clinics must tell their patients about this in their own privacy notice.

8. Security

• All connections are encrypted (HTTPS).
• Access to Augur is per user and role, and each clinic's data is kept separate from the others'.
• The Meta access token and the phone number's PIN are stored encrypted (AES-256-GCM) and are never displayed in the product, not even to the clinic's own staff.
• Passwords are stored only as hashes.
• Backups are kept on the same server, with restricted access.

9. Your rights and how to exercise them

Anyone who messaged a clinic may request access to, correction, deletion or portability of their data, or object to its processing, under Panama's Personal Data Protection Law (Law 81 of 2019). The most direct way is to ask the clinic. You can also write to radiaz@saludvisualsa.com with your phone number and the clinic's name. We reply within 10 business days at the latest.

To delete your data, see how to delete your data.

Disconnecting Augur from WhatsApp: a clinic can remove Augur's access at any time from its business portfolio settings in Meta (Business Suite). When Meta notifies us, Augur automatically deletes the access token and deactivates the channel.

10. Changes and contact

We will publish any change to this policy here, with its date. Questions: radiaz@saludvisualsa.com, +507 212-1712.