Privacy Notice

Last updated: 26 September 2026

This notice explains how we handle personal data across Elventia's products, including Atendaria. It is written to be read, not to defend us from whoever reads it.

1. Who is responsible

2. Two different roles, and the difference matters

Within the same service we handle two sets of data under distinct responsibilities:

• We are the controller of the account data of whoever subscribes: the professional or the practice.
• We are a processor of patient data. The practice decides the purposes and means and is the controller; we only handle that data on its instructions, within what the software does.

In practice: if you are a patient and want to know what happens to your data, or want it erased, the fastest route is to ask the practice that treats you. If they ask us, we execute. You can also write to privacy@elventia.com: we forward the request to the controller and follow it through.

3. What data we handle

Account data (we are the controller)

• Name, email, phone, practice name and professional address.
• Subscription data: plan, payment method and invoice history. Card details are handled directly by the payment provider — they never pass through us and are not stored on our servers.
• Technical access logs: date, time and IP address, kept for security and legal compliance.

Patient data (we are a processor)

• Name and WhatsApp number.
• Appointments booked, moved or cancelled, and the service booked.
• The content of messages exchanged with the assistant, needed to understand the request and reply.

4. What we deliberately do not handle

The assistant handles scheduling and logistics. By product design, not by accident:

• It never asks the reason for the appointment, nor symptoms, nor medical history.
• It never gives clinical advice. Any health topic is handed back to the professional.
• We do not use conversation content for advertising, and we do not sell or licence it to third parties for commercial purposes.

5. Purposes and legal bases

• Delivering the service — answering patients on WhatsApp, managing the calendar, sending confirmations and reminders. Basis: performance of a contract (Art. 6(1)(b) GDPR) for account data; for patient data the basis is determined by the practice as controller.
• Billing and tax obligations — basis: legal obligation (Art. 6(1)(c)).
• Security, fraud prevention and fault diagnosis — basis: legitimate interests (Art. 6(1)(f)), limited to what is necessary.
• Support — answering people who write to us. Basis: contract or legitimate interests, as the case may be.
• Administrative analyses — grouping operational data and presenting suggestions to the practice owner. They do not produce clinical decisions or automated decisions with legal effects.

We also analyse the practice’s operational data and organise administrative groups to present suggestions to its owner. These suggestions require their review; they do not automatically decide care, clinical treatment or individuals’ rights.

6. How long we keep it

• WhatsApp messages: an operational retention period of 365 days, enforced by the automatic retention process.
• Appointments and patient records: for the service duration or until a valid deletion request.
• Account: deleted through the closure process, subject to legal retention duties. Deleting the last practice deletes the account and its acceptance record in the active system.
• Encrypted backups: recovery copies with an operational retention period of 30 days. Removal occurs during rotation; an outage may delay execution until that process resumes. Deleted data are not reused in current operations.
• Invoices and tax records: retained for the applicable statutory period, including after closure.

7. Who we share it with

• Meta Platforms — messages travel through the official WhatsApp Business platform. Without it there is no WhatsApp.
• Payment provider — to charge the subscription and issue invoices. It receives billing data, not patient data.
• Infrastructure — the servers the service runs on.
• Error monitoring — when enabled, a technical fault-reporting service, configured not to collect personal data.

Infrastructure uses OVHcloud; Stripe processes payments; Brevo delivers account emails; Cloudflare provides DNS and public website hosting. Each service receives only the data necessary for its role. Conversations are processed by models on infrastructure under our control in Italy, without sending them to third-party AI APIs or using them for external training.

8. Where the data is

The application and database are hosted in Canada. Language models and local encrypted backup copies operate in Italy; encrypted backups also exist on the Canadian VPS. Meta processes data in locations described in its own terms. Elventia must ensure a valid mechanism for transfers under its responsibility under Article 33 LGPD, and provide information about recipients and applicable safeguards through privacy@elventia.com. Location in the European Union does not automatically extend an adequacy decision to Canada.

9. Security

• Encrypted traffic between the browser and our servers.
• WhatsApp access tokens stored encrypted, never in clear text.
• Strict separation between accounts: no practice sees another's data, and the assistant never discloses one patient's data to another.
• Internal access restricted to what support and maintenance strictly require.

No system is infallible. In the event of a breach likely to result in significant risk, we will notify the affected controllers and the competent authority within the statutory deadlines.

10. Your rights

At any time and free of charge you may request access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interests.

Write to privacy@elventia.com: we reply within 30 days. If the request concerns patient data we need the practice's authorisation, as it is the controller — and we help them comply. See also Data deletion.

You may also lodge a complaint with your supervisory authority — in Italy the Garante per la protezione dei dati personali, in Brazil the ANPD.

11. Cookies

This corporate site uses no tracking cookies and no audience-analytics tools. The product dashboard uses strictly necessary cookies only: the ones that keep you signed in and protect the session. Without them login does not work, and for that reason they do not require consent.

12. Children

The service is subscribed to by professionals and practices, not by minors. Where a patient is a minor, the booking is made by a parent or guardian, and it is for the practice — as controller — to ensure this.

13. Changes

If this notice changes materially we tell customers by email before the change takes effect, and the date at the top is always updated.

14. Contact

Privacy: privacy@elventia.com. Anything else: info@elventia.com.