Privacy policy

Kinti Med, tax ID [RUC pendiente], domiciled in Ecuador, develops and operates the system available at https://kintimed.com and https://killa.kintimed.com.

Two sets of data must be distinguished, because Kinti Med’s role differs in each.

For PATIENT data, the controller is the practice or health professional who records it. Kinti Med acts as processor: it handles that data on the practice’s behalf and instruction, solely to provide the service, and uses it for no purpose of its own. It is not sold, not shared commercially, and not used to train models.

For the data of the PROFESSIONAL who contracts the service — account, email, billing, panel usage — Kinti Med is the controller.

From patients: name, mobile number, identity document, date of birth and the rest of the record; the content of clinical records, prescriptions, lab orders, procedures and consents the physician issues; and the WhatsApp messages exchanged with the assistant.

If the practice enables the voice assistant, additionally: the audio of the visit and its transcript, with the patient’s specific authorisation.

From people who write to WhatsApp without yet being a patient of any practice: their number and the content of their messages, stored encrypted and deleted after ninety days.

From the professional: name, email, access credentials and billing details.

From this website: nothing. kintimed.com is a static site with no forms, no first-party cookies, no analytics and no third-party resources. The fonts are served from this domain precisely so that visiting this page sends a request to no one else.

A clinical record is sensitive personal data and is treated as such. Columns holding clinical information and credentials are encrypted in the database, not only in transit.

The WhatsApp assistant answers only from what appears in that same patient’s records, prescriptions and lab orders at that same practice. It consults no external sources and no other patient’s data, and it cannot write to the clinical record.

Processing of patient data rests on the healthcare relationship and on the consent the data subject gives before the assistant begins any conversation with them. Consent is recorded per purpose and dated.

Authorisation to transcribe a visit is SEPARATE from acceptance of data processing. They are two distinct purposes recorded as two distinct decisions: accepting one does not imply the other. Transcription authorisation can be withdrawn, and the data subject’s latest decision always prevails.

Processing of the professional’s data rests on performance of the service contract and on applicable tax obligations.

Messages from people who are not a patient of any practice: ninety days, purged automatically.

Visit audio: deleted as soon as the transcript is ready, with an additional sweep at twenty-four hours. Transcript and draft are deleted when the clinical record is completed, and in any case after seven days. Only telemetry remains — durations and cryptographic digests — never the text.

Clinical records: kept for as long as the practice needs them to comply with Ecuadorian medical record retention rules. That period is set by law and by the practice, not by Kinti Med.

Account and billing data: for the duration of the contract and thereafter for the applicable tax retention periods.

To provide the service, Kinti Med relies on the following processors. The list is exhaustive and is updated when it changes.

Meta Platforms — transport of WhatsApp messages. Google (Gemini) — answer generation and embeddings. Supabase — database hosting. Google Cloud — service hosting. Expo (EAS Hosting) — web panel hosting. Firebase Hosting — hosting of this website.

Only if the practice enables the voice assistant does Together AI also take part, running the transcription. It is worth underlining how: that service receives an opaque identifier and temporary links to the audio. It does not receive the patient’s name, identity document or clinical record identifier, and it neither computes nor stores any voiceprint. The component that processes the audio persists nothing.

Data subjects may request access, rectification, erasure, objection, portability and suspension of processing, and may withdraw consent at any time.

Because Kinti Med processes patient data on the practice’s behalf, the natural route is to address the practice that treats you: it holds the relationship and can resolve directly from the panel. If you prefer to write to us, use ventas@kintimed.com and we will pass the request to the controller and assist as needed.

If you believe your rights have not been honoured, you may file a complaint with Ecuador’s Superintendency of Personal Data Protection.

If this document changes materially, notice is given from the panel before the change takes effect. The date of the last update is at the top of this page.