Privacy policy

Who we are

Viantaris is a software platform (SaaS) and a trade name, not a company. The data controller is Stiven David Perez Rivera, an individual, domiciled at Cra. 15 # 84-28, Barranquilla, Atlántico, Colombia. You can reach us about anything related to this policy at the email address and phone number listed below.

If that changes —because a company is formed to take over the operation— this policy will be updated and clients will be informed before the change takes effect.

Viantaris does not provide medical or health services. It is a technology tool that clinics and other businesses use to handle conversations, check their calendar and coordinate appointments. Clinical decisions, diagnoses and healthcare are the sole responsibility of the professional or institution using the platform.

As an individual, Viantaris is not required to register its databases in Colombia's Registro Nacional de Bases de Datos: Decreto 090 de 2018 limits that obligation to companies and non-profit entities with assets above 100,000 UVT and to public legal entities. This website provides information about the service; it does not sell or take payments online.

Two different roles, worth not confusing

Viantaris processes personal data in two situations that are not the same and carry different responsibilities:

• As controller, for the data of people who contact us directly: people interested in the product, people who write to the WhatsApp on this website, and the account data of our clients. Here we decide the purpose.
• As processor, for the data of the patients or end customers of a business that uses Viantaris. In that case the business is the controller: it decides what that data is used for, what information it configures on the platform and what instructions it gives. Viantaris processes the data on behalf of that business and according to its configuration.

In practice: if you are a patient of a clinic and chatted with its WhatsApp, the controller of your data is that clinic. You can contact us and we will point you in the right direction, but decisions about that data are made by whoever is serving you.

What data may be processed

It depends on what each business configures and on what happens in each conversation. The data the platform may process is:

• Contact details: phone number, name as provided by the person, and the public profile name on WhatsApp, Messenger or Instagram.
• On Messenger and Instagram, the identifier Meta assigns to the person for that page or account. It is not their phone number or email, and it only serves to reply to them in that same conversation.
• Conversation content: the messages exchanged and the files sent in it (images, audio, documents).
• Calendar data: date and time of appointments, the service requested and the name the booking is made under.
• Information the person provides during the interaction, which may include data they choose to share.
• Platform usage data: technical records of conversations and of the system's replies, needed to operate the service and to be able to audit what happened.
• Client account data: name, email and role of the team members who access the CRM.

Sensitive data. Health data is sensitive data (Ley 1581 de 2012, art. 5). Processing it requires the explicit authorization of the data subject, who must know they are not obliged to give it (art. 6 of that law and art. 6 of Decreto 1377 de 2013). When a clinic or another business uses Viantaris, that authorization is obtained by the business, because it is the controller; Viantaris processes that data only on its behalf and to provide it the service.

Data we receive from Meta (Facebook, Messenger and Instagram)

A business can connect its Facebook Page and its Instagram professional account to Viantaris with the «Conectar con Facebook» (Connect with Facebook) button. When it does, the person authorizing the connection chooses which Pages to share, and Meta gives us:

• The list of Pages that person authorized, with their name and identifier, and the Instagram account linked to each one.
• An access token for each authorized Page, which allows receiving and sending that Page's messages.

What we use it for, and only that: receiving the messages people send to the Page or the Instagram account, replying to them —through the automated system or a team member— and showing «seen» and «typing». We do not read posts, followers, ads or insights, we do not publish on behalf of the Page, and we do not use this data for advertising or sell it.

How we store it: tokens are stored encrypted and are never shown in the browser, not even to the person who connected them. Tokens for Pages that are not chosen are deleted as soon as the connection is completed or cancelled, and a connection that is not completed expires after 15 minutes.

What it is used for

• Handling the conversation: answering questions with the information the business has configured, checking availability, offering times and booking appointments.
• Handing the conversation to a team member when the system determines human intervention is needed.
• Providing and maintaining the service: operating it, resolving incidents and keeping a record of what happened so it can be reviewed.
• Security and control: detecting misuse and protecting the information.
• Responding to people who contact us out of commercial interest, and managing the relationship with our clients.

We do not sell personal data or share it for advertising purposes. Nor do we use a business's patient conversations for our own purposes unrelated to providing it the service.

Interactions handled by automated systems

Some of the conversations handled through Viantaris are answered by an automated system based on artificial intelligence, configured by the business using the platform. That system can answer questions, check calendar availability and coordinate an appointment.

The system stops replying and hands the conversation to a person when it detects that human judgment is needed. And it does not make clinical assessments or diagnoses: when a question requires a professional assessment, it is up to the business to handle it.

We recommend that each business inform its customers that they are chatting with an automated assistant, and the platform allows it: the business decides how the assistant introduces itself. At any time, the person writing can ask to speak with a human.

Providers involved

To provide the service we use these providers, which process data on our behalf or on behalf of our clients and only for the purpose stated:

• Supabase: database and conversation files. Hosted in the United States (Oregon).
• Hostinger: the server the platform runs on. United States.
• The provider of the artificial intelligence model that drafts the replies: a United States company.
• Meta (WhatsApp, Messenger and Instagram): the channels messages come in and go out through.
• Resend: platform emails to the business's team (password recovery and notices about the status of their channels). They do not include conversations or patient data.
• Twilio and ElevenLabs: only if the business turns on voice calls. United States companies.

If a business connects its own account with another artificial intelligence provider, that provider is chosen and contracted by the business.

These transfers are international data transfers. The United States is among the countries with an adequate level of protection according to Colombia's Superintendencia de Industria y Comercio (Circular Externa 005 de 2017), under article 26 of Ley 1581 de 2012. The artificial intelligence model provider may process a request in data centers in other countries.

Retention

Data is kept while the relationship with the business using the platform exists and while it is needed for the purposes described, unless a legal obligation requires keeping it longer.

When a business leaves Viantaris, we keep its data for 30 days so it can ask us for an export. After that period we delete it, except what a legal obligation requires us to keep. Daily backups rotate every 14 days, so within that additional period the data also disappears from them.

Your rights

Under Ley 1581 de 2012 and its complementary rules, as a data subject you may:

• Know, update and correct your data.
• Request proof of the authorization given, except when the law does not require it.
• Be informed of how your data has been used.
• File complaints with the Superintendencia de Industria y Comercio for violations of the rules.
• Revoke the authorization and request the deletion of your data, when no legal or contractual duty prevents it.
• Access, free of charge, the data that has been processed.

How to exercise them

Write to privacidad@viantaris.com stating your request, your identification and a way to contact you. You can also do it by phone at +57 304 362 2762.

If your data is processed by a business that uses Viantaris —for example, the clinic you chatted with— that business is the controller and is the one that must handle the request. If you write to us, we will tell you whom to contact and pass the request on to our client.

Deadlines. Inquiries (knowing what data of yours we hold and how we use it) are answered within 10 business days at most, extendable by 5 more with notice of the reason (Ley 1581 de 2012, art. 14). Claims (correcting, updating or deleting data, or revoking the authorization) within 15 business days at most, extendable by 8 more with notice (art. 15). If a claim is missing information, we ask you for it within the following 5 days.

Deleting your data

If you connected a Facebook Page or an Instagram account to Viantaris and want us to stop having access and delete what we store:

• Remove the access from Facebook: Settings and privacy › Settings › Business integrations › Viantaris › Remove. From that moment the tokens stop working and we can no longer receive or send messages for your Page.
• Write to us at privacidad@viantaris.com from your account's email asking for deletion. We delete the tokens and your Pages' connection and, if you ask, the conversations and contacts in your account, and we confirm by email when it is done.

If you wrote to a business that uses Viantaris on WhatsApp, Messenger or Instagram, that business is the controller of your data: ask it for the deletion. You can also write to us at privacidad@viantaris.com naming the business and the channel; we will pass your request on and, when the business authorizes it or the law requires it, delete your messages and your contact from its account.

We respond within 15 business days at most (see the deadlines under «How to exercise them»).

Security

We apply technical measures to protect the information: encryption in transit, isolation of each business's data through rules of the database engine itself, role-based access control, daily backups with restore testing, and logging of system operations.

No measure eliminates risk entirely. If an incident affecting personal data occurred, we would act in accordance with the applicable regulations and with what was agreed with the controlling business.

Cookies

This website does not use its own or third-party cookies, and includes no analytics or trackers. If that changes, this policy will be updated before they are introduced.

Changes to this policy

If we change this policy, we will update the date at the top. When the change substantially affects how data is processed, we will notify our clients.