Privacy Policy

Account information: name, email address, phone number, country, role, language preference and login credentials. Passwords are stored only as salted hashes, and second-factor secrets are protected.

Professional information: specialties, license or registration numbers, national identification, identity and credential documents submitted for verification, practice locations, working hours, fees and public profile content.

Patient and health information: identification (such as national ID and date of birth), appointments, consultation notes, diagnoses, prescriptions, orders, lab results, uploaded documents and images, and other records that you or your professional add.

Messages: content and metadata of messages sent through the portal, email and WhatsApp, including your WhatsApp phone number and profile name when you write to us. Voice recordings made for dictation are processed to produce text.

Payment information: plan, status and transaction records. Card details are collected by our payment processors or by Apple, and we do not store full card numbers.

Device and usage information: IP address, browser and device type, app version, push-notification tokens, and logs of access and security events.

To provide the Service: accounts, profiles and directory listings, scheduling, records, prescriptions and documents, notifications and messaging between patients, professionals and their staff.

To verify professional credentials, secure accounts, prevent fraud and abuse, and keep audit logs of sensitive actions.

To process payments and manage plans, provide support, send service communications, and fix and improve the Service.

To comply with law, respond to lawful requests, and establish or defend legal claims.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use patients' health information for advertising.

Where the law requires a legal basis, we rely on: performing our contract with you; the instructions of the professional or organization that controls clinical data; our legitimate interests in securing and improving the Service, balanced against your rights; your consent where it is required (you may withdraw it at any time); and compliance with legal obligations. Health information is processed only as needed to provide care-related services requested by the patient or the professional, or as the law permits.

We use the WhatsApp Business Platform, operated by Meta Platforms, to send appointment confirmations, reminders and messages from professionals, and to receive messages you send to our WhatsApp number. To do this, Meta processes your phone number and the content of those messages under its own terms and privacy policy. Messages you send us may be shown to the professional or clinic you are communicating with and stored in the Service as part of your conversation.

We send only service messages related to your care and account, not advertising. You can ask your professional or us to stop WhatsApp messages at any time, or block our number in WhatsApp.

Voice dictation, message translation, document intake and our support assistant use artificial intelligence services from third-party providers (currently OpenAI). We send them only the content needed for the feature being used, under terms that do not allow them to use that content to train their models. Professionals must review AI output before relying on it.

With the professionals, organizations and staff you use the Service with, according to the access they are given. With patients, the information their professional chooses to share with them. Public professional profiles are visible to anyone.

With service providers that process data on our behalf under confidentiality and security obligations: Vercel (hosting and file storage), Neon (database), Meta Platforms (WhatsApp messaging), Resend (email delivery), OpenAI (AI features), Google (push notifications and, if a professional connects it, Google Calendar), Sentry (error monitoring, without session recording), and our payment processors, including Apple and RevenueCat for in-app purchases.

When required by law or valid legal process, to protect the rights, safety and property of users, the public or us, and in connection with a merger, acquisition or sale of assets, subject to this Policy.

We keep information while your account is active and as long as needed to provide the Service. Clinical records may be kept for the period that the law or the professional's record-keeping obligations require, even after an account is closed; after that they are deleted or de-identified. Security logs are kept for a limited period. Encrypted backups are purged within 90 days.

You can delete your account from the app or ask us to do it. Instructions: https://www.zanapronto.com/en/eliminar-cuenta.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise these rights in your account settings or by writing to legal@nouvos.one. We will verify your identity and respond within 30 days, or sooner where the law requires. Requests about clinical records controlled by a professional will be forwarded to that professional or handled with them. You may also complain to your local data protection authority. We will not discriminate against you for exercising your rights.

We use administrative, technical and organizational safeguards, including encryption in transit (HTTPS/TLS), encrypted storage at our infrastructure providers, private storage of clinical files served only after an access check, hashed passwords, optional two-factor authentication, role-based access controls, rate limiting, and audit logs of sensitive actions. No system is completely secure, and we cannot guarantee that information will never be accessed, disclosed, altered or destroyed by a breach. If a breach affects your information, we will notify affected professionals, users and authorities as the law requires.

We are based in the United States and our providers process information in the United States and other countries. Wherever it is processed, we protect it as described in this Policy and use safeguards required by applicable law for international transfers.

The Service is not directed to children for their own use. Information about a minor is entered by a parent, legal guardian or the minor's professional, and the guardian can exercise the minor's rights. If you believe a child has given us information without appropriate consent, contact us and we will delete it.

We use cookies and local storage that are needed for the Service to work, such as keeping you signed in and remembering your language. We do not use advertising cookies or third-party advertising trackers.

We may update this Policy. We will post the new version with its effective date and, for material changes, notify you through the Service or by email.

Nouvos Solutions LLC, 909 Davis Street, Suite 500, Evanston, Illinois 60201, United States. Email: legal@nouvos.one (subject: "Privacy").