Data protection (LOPDP)

Each practice is a separate database tenant and every write happens within its scope. This is not a convention that depends on nobody making a mistake in a query: the scope is imposed by the data layer.

The only point in the system that works outside a practice is the WhatsApp entry point, and only to determine which practice the incoming number belongs to. Once known, everything else happens inside. That exception exists in a single place in the code and is documented there.

Columns with clinical data and credentials are encrypted in the database. A database dump does not yield readable clinical records.

The content of messages from people who are not yet patients is encrypted too: that is exactly where someone types their identity document, their date of birth and sometimes their symptoms, before any record of them exists.

The service that transcribes audio receives an opaque identifier and temporary links. It does not receive the patient’s name, identity document or clinical record identifier. Its input models reject any field that is not declared, so adding one of those is an integration error rather than a silent leak.

That same component persists nothing and computes no voiceprint.

The periods do not depend on someone remembering to delete: scheduled tasks purge. Ninety days for messages from unidentified people. Audio, as soon as a transcript exists, with a sweep at twenty-four hours. Transcript and draft, on completion of the clinical record and in any case after seven days.

Acceptance of data processing and authorisation to transcribe are stored as distinct records, with their type and date. A system that stored “consent: yes” would let an authorisation given for one thing serve for another, silently.

For data processing it is enough that an acceptance exists. For transcription the latest recorded decision governs, because the data subject must be able to withdraw it.

Every assistant answer is associated with the record excerpts that support it and with the outcome of its audit. There are no untraced answers.

The audit fails closed: if the checks do not add up, the answer is not sent and the patient receives a notice that there is not enough information instead.

An incoming message that attempts to rewrite the assistant’s instructions is refused at the door. No attempt is made to clean it up for reuse: it is declined.

The signature of every WhatsApp webhook is verified against the known channel before the message content is read, so the message itself plays no part in its own validation.

Address the practice that treats you, which is the controller of your health data. If you prefer to write to us, use ventas@kintimed.com: we pass the request on and assist the controller as needed.

You may also file a complaint with Ecuador’s Superintendency of Personal Data Protection.