Privacy Policy

1. Who we are and our role

Cita2 SpA, based in Santiago, Chile, operates Cita2 (cita2.cl). Depending on the data, we play two different roles:

• Controller of the account data of the businesses and professionals who use Cita2 (sign-up, subscription billing, platform usage).
• Processor of the end-customer data each business keeps in Cita2 (bookings, records, payments to their business). The controller of that data is the business you booked with, which decides how it is used. Each business publishes its own notice at cita2.cl/p/<business>/privacidad.

2. Data we process

• Businesses and professionals: name, email, phone, country, business details, tax data, plan, usage logs, IP address and browser.
• End customers (on behalf of the business): name, email, phone, ID number if the business asks for it, date of birth (optional), booking and payment history, contact preferences.
• Health data (clinical records, dental charts, prescriptions, a pet owner’s veterinary history, etc.) only when the business enables clinical modules and records them. This is sensitive data: it requires your explicit consent, recorded separately.
• Payments: processed by Stripe, PayPal or MercadoPago; Cita2 does not store card numbers.

3. Purposes and legal bases

• Providing the service you asked for (booking, reminders, payments): performance of a contract.
• Legal obligations: tax documents and retention of clinical records.
• Consent (withdrawable at any time) for health data, promotional emails and WhatsApp messages.
• Legitimate interests (security, fraud prevention, improving the service with aggregated data), where your rights do not override them.

We do not use your data for automated decisions with legal effects or for profiling.

4. Who we share it with (sub-processors)

Only with providers that help us operate, under confidentiality and data-processing contracts:

We may also disclose data if a competent authority requires it by law.

5. International transfers

Our providers may process data outside your country (for example, in the United States). Where the law requires it, we use standard contractual clauses or other valid mechanisms so that data keeps an equivalent level of protection.

6. How long we keep it

• Business account: while active and up to 6 years afterwards for tax obligations.
• Clinical records: the period set by each country’s law (e.g. 15 years in Chile, 5 in Spain, 20 in Brazil); the business may extend it.
• Tax documents: 6 years.
• Marketing: until you withdraw consent.
• Consent log: kept as legal proof (with the IP address masked).

If you request erasure but the law requires us to keep something (clinical records, tax documents), that data is restricted: it is only stored, not used for anything else, and is deleted automatically when the period ends.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, portability, objection, to withdraw consent, and to ask us not to sell or share your data (we do not). We will not discriminate against you for exercising them.

How: use the form at cita2.cl/privacidad/solicitud or write to privacidad@cita2.cl. We verify your identity by email before releasing or deleting data.

Deadline: we respond within 15 calendar days (one extension of up to 15 days, justified and notified). If your data sits in a business’s account, your request is forwarded to that business, which is the controller.

Complaints: if you are not satisfied, you may complain to the data-protection authority of your country (see section 11).

8. Security

We apply reasonable technical and organizational measures:

• Encrypted connections (HTTPS/TLS).
• Passwords stored as hashes (bcrypt).
• Data isolation between businesses: every query is limited to the account making it.
• Role-based access with distinct permissions (owner, administrator, professional, front desk).
• Encryption at rest and backups handled by our infrastructure providers.
• A tamper-proof log of consents and privacy actions.

Incidents: if a security breach affects personal data, we will notify affected businesses without delay and the competent authorities within 72 hours of detecting it; if the risk to individuals is high, we will notify them as well.

No system is infallible: we cannot guarantee absolute security.

9. Minors

Cita2 is not aimed at minors. Whoever books for a minor must be their parent or legal guardian. If you believe a minor registered without authorization, write to us and we will delete the data.

10. Cookies and similar technologies

We use only strictly necessary storage (keeping you signed in and remembering your time-zone and language preferences). We use no advertising or tracking cookies. Fonts, charts and maps are served from our own domain, except CARTO/OpenStreetMap map tiles, which receive the visitor’s IP address when a map is shown.

11. Supervisory authorities by country

If your country is not listed, you can contact the data-protection authority that applies to you.

12. Changes and contact

If we make material changes to this policy we will let you know and bump the document version. Privacy contact: privacidad@cita2.cl. Cita2 SpA, Santiago, Chile.

Health data in the US: Cita2 is not a HIPAA-certified platform and does not sign BAAs; businesses subject to HIPAA must assess whether they may use the clinical module.

Exercise my rights

Base document: it must be reviewed by legal counsel in each jurisdiction.