Privacy Policy

1. The roles: who is responsible for your data

If you are a patient of a clinic or practice that uses Tavelu: that establishment is the data controller — it decides to record your data and to use it to care for you. We are the data processor: we process your data solely on behalf of the establishment, so that the platform works. You exercise your rights over your data before the establishment that cares for you; we help it comply.

If you are a platform user (medical or administrative staff of the establishment) or a visitor, we are the controller of your account data or your business contact data.

2. Which data is processed — including health data

• If you are a patient: identification and contact details (names, national ID number, phone, email, address, date of birth, gender, emergency contact), appointments, and the clinical record the establishment keeps about your care: allergies, medication, medical history, blood type, vital signs, clinical notes, prescriptions, certificates, vaccines, studies and medical photos or documents, health insurance, recorded payments (amount and method; we do not store card data), and your WhatsApp messages with the establishment's assistant.
• If you are a user of the establishment: name, email, phone, role and activity in the system.
• If you are a visitor or business contact: the data you send us through WhatsApp or forms.

Much of this information is health data: a special category under Ecuador's Organic Law on Personal Data Protection (Ley Orgánica de Protección de Datos Personales, LOPDP; Arts. 25, 26, 30 and 31). It is processed with reinforced protection, under the duty of confidentiality and the professional secrecy of the healthcare staff caring for you.

3. What it is used for

Exclusively so that the establishment caring for you can manage its service: booking and reminding you of appointments over WhatsApp, communicating with you, keeping your clinical record and running its operation. We never sell data, we never use it for advertising, and we never use it to train artificial-intelligence models.

4. Artificial intelligence

The platform includes artificial-intelligence features. You should know precisely what is sent, because in some cases it is your clinical information:

• Consultation dictation. The professional may dictate the note aloud instead of typing it. In that case the audio of the consultation is sent to the provider to be transcribed, and the transcribed text is organized as a progress note. The audio is not stored on the platform: it is used to transcribe and then discarded.
• Summary of your record and assistance to staff. To answer the person caring for you, the platform may send data from your record: file, clinical notes, prescriptions, certificates, appointments and insurance.
• Activity summaries of the establishment, which do not identify your care in particular.

The provider is OpenAI, in the United States (see the next section on international transfer). Its API terms establish that the data sent is not used to train its models and that it may be retained transitorily and in a limited way (up to 30 days) for abuse monitoring.

AI only assists: it does not diagnose or decide. Whatever it writes stays under the professional's review and signature, and decisions about your care are always made by the healthcare staff.

5. Where the data is stored and who else processes it

We use first-tier technology providers, some located in the United States:

• Supabase — database and files (encrypted)
• Vercel — application hosting
• OpenAI — artificial-intelligence features
• Meta (WhatsApp) — messaging with the establishment that cares for you
• Upstash — temporary memory of the WhatsApp assistant
• Resend — system emails (invitations and account notices)

Those providers are in the United States, a country that the Ecuadorian authority has not declared as having an adequate level of data protection. We say it plainly because the law requires us to inform you: it means that, once there, your data is not covered by a declaration of equivalence with Ecuadorian protection.

The transfer relies on article 60 of the LOPDP: it is necessary to perform the care you contracted with the establishment (item 4) — without it there would be no calendar, no reminders and no clinical record — and, when you record your consent, you give it informed of the above (item 2).

In addition, and as reinforcement, each provider has signed a data processing agreement with us that contractually obliges it to protect the information, to use it only on our behalf and not to use it for its own purposes.

6. How it is protected

Isolation of each establishment's information, encryption in transit and at rest, role-based access control (each user sees only what their function requires), short-lived file links, signed authentication between system components, periodic backups and internal security audits.

7. How long it is kept

Contact data, while the establishment keeps its account active. The clinical record (health record) additionally has a mandatory retention under Ecuador's health regulations (Regulation of the Single Health Record of the Ministry of Public Health): active archive for 5 years from the last visit and passive archive for 10 additional years — 15 years in total. That period also protects your right to make a claim about your care.

8. Your rights

Under the LOPDP you have the right to access, rectify, update, delete, object to the processing of and request the portability of your data, among others. You exercise them directly before the establishment that cares for you (the controller); the platform gives it the tools — it can hand you a complete copy of your data and clinical record, or handle your deletion request.

About deletion: when you request it, the establishment immediately erases your contact data and stops communicating with you. Your health record is kept only for the retention period required by health regulations (Art. 18 item 2 of the LOPDP); once that period expires, it is deleted or fully anonymized.

Users and business contacts: write to us at soporte@jwautomatizations.com. If you believe your rights were not attended to, you may turn to Ecuador's Personal Data Protection Superintendency (Superintendencia de Protección de Datos Personales).

9. Minors

Data of patients who are minors is recorded by the establishment with the consent of their legal representatives, in accordance with the LOPDP.

10. The public website (tavelu.com)

This section is only about the public website. If you never signed in to the system and only looked at the website, this is all that was recorded about your visit.

Our own measurement, without cookies. We note which page was viewed, one word about where you came from (for example google, instagram or direct), whether you came from a phone or a computer, and isolated moments such as clicking to write on WhatsApp or looking at the prices. No cookies or advertising trackers are used, and your IP is not stored: the server sees it for an instant to prevent abuse and discards it without recording it. To link the steps of one visit, a random number is used that lives in the browser tab and is erased when you close it. These signals go to an internal JW Automatizations panel and are deleted automatically after 12 months.

Hosting provider measurement. The website is hosted on Vercel, which also keeps its own aggregate visit count (Vercel Web Analytics), also without cookies.

The assistant demo. If you write in the trial chat on the home page, it works differently and you should know it: the browser stores a random identifier that does survive closing the tab, so that when you come back you continue in the same conversation. What you write and your IP address are sent to the service that operates the assistant, to be able to reply and to limit abuse. It is a public demo on a made-up clinic: do not write real personal data there, yours or anyone else's, nor health information.

Since the measurement stores nothing that could identify you, this website shows no cookie notice. The trial chat identifier only appears if you decide to write to it. If at some point something else that does identify you is added, your consent will be requested first.

11. Changes to this policy

We will publish updates on this same page with their date. Relevant changes will be announced within the platform.