Privacy policy

This policy describes which personal data Amedi collects, what it uses it for, who accesses it, where it is stored and what you can do about it. It applies to everyone who uses the platform: visitors, patients, health professionals and their teams.

1. Data controller

The controller of your data is Altiora Tech, C.A., RIF J-50791948-0, domiciled at Calle 23 Sur Bis, entre Avenida Jesús Subero y Carrera 17 Sur, Casa Nro. 110, Sector Pueblo Nuevo Sur, El Tigre, Anzoátegui, ZP 6050, El Tigre, Anzoátegui, Venezuela, operator of the Amedi platform on the domains amedisalud.com, consultorio.amedisalud.com, admin.amedisalud.com and api.amedisalud.com.

For any matter related to your personal data, write to us at soporte@amedisalud.com.

2. Legal framework

We process your data in accordance with articles 28 and 60 of the Constitution of the Bolivarian Republic of Venezuela — which recognise every person's right to access the information held about them in records, to know its use and purpose and to request its update, rectification or destruction, as well as the right to the protection of their honour, private life and intimacy — and with the principles developed by the Constitutional Chamber of the Supreme Court of Justice in judgment 1318 of 4 August 2011: autonomy of will, legality, purpose and quality, temporality, accuracy, security, accountability and protection.

Processing rests on your consent, which you give when you register and accept this policy; on the performance of the service you request (booking an appointment, receiving a consultation, communicating with a practice); on the professional's legal obligations regarding the medical record, under the Law on the Practice of Medicine and its Code of Ethics; and on any other legal obligations that apply to us.

3. Which data we collect

Registration data (patients and professionals): first and last name, email address, phone number, date of birth, gender and national identity card number.

Health professional data: MPPS registration number and professional college number, specialties, identity documents and professional credentials, profile photo, practice information (address, hours, fees, configured payment methods) and the electronic signature of the professional agreement.

Health data: the clinical information the professional records during the consultation (reason, background, notes, diagnoses, prescriptions and instructions), the medical documents you or your professional upload to the medical folder and the appointment history.

Usage data: IP address, device type, browser, pages visited and timestamps of interactions with the platform. We also log who accesses each medical folder and when, so that it can be audited.

Communication data: the messages you exchange with the practice through the platform's chat and the notifications we send you.

Payment data: the reference and the receipt you record when paying for a consultation, so that the practice can confirm receipt. Amedi does not process card payments and does not store card data: payment methods (Zelle, Pago Móvil, bank transfer or others) are configured by each professional and payment is made directly between you and the professional.

Verification data (professionals only): the images of your identity document and of your face captured by the identity verification process, processed by our provider MetaMap, and the result of the lookup of your license in official records.

4. What we use your data for

• Managing your account and authenticating your access.
• Connecting patients with professionals and managing appointment booking.
• Keeping each patient's medical folder and showing it to the professional who treats them.
• Enabling video consultations and the chat with the practice.
• Recording and confirming consultation payments.
• Sending appointment confirmations, reminders and cancellation notices.
• Verifying the identity and credentials of professionals.
• Handling support requests and content reports.
• Measuring the use of the platform to improve it (§10), only with your consent.
• Complying with the legal obligations that apply to us.

Health data is never used for marketing or advertising purposes and is never sold to third parties under any circumstances.

5. Who accesses your data

The professional who treats you accesses your medical folder and the record of your consultations with them. Sharing your history with a different professional requires your express authorisation, which you grant or revoke appointment by appointment.

The professional's team: the secretaries and assistants the professional invites to their practice access the schedule, the medical folder and the consultation record to the extent the professional configures it and their work requires it. They act under the professional's responsibility and with the same confidentiality obligations.

Amedi: staff of Altiora Tech, C.A. do not access users' health data, except when strictly necessary to resolve a technical support case and with your prior permission. Every access to a medical folder is logged, and you can read that log under Profile → My data: who opened your history, when, what they looked at and from which address.

Authorities: we share data when required by Venezuelan law or by a court order.

Amedi does not sell, rent or trade its users' personal data.

6. Data processors

To operate the platform we rely on providers that process data on our behalf and under our instructions:

7. Where your data is stored

Your data is stored on servers located in the United States of America, on the infrastructure of the providers listed in §6. By using the platform you accept this international transfer. The providers are contractually bound to process the data solely according to our instructions and to maintain adequate security measures.

8. Communications and reminders

We send you confirmations, reminders and notices about your appointments to the email address and the number you registered. These are service communications, not advertising.

WhatsApp requires your prior permission for reminders and updates. We do not write to you on WhatsApp until you turn that channel on: you can do so with the checkbox at sign-up or when booking, by telling the practice that registers your number, or from Profile → Notifications. Until then those notices go by email.

There is a single exception, and it exists to protect you. When someone books an appointment in your name, we send the record of that appointment by WhatsApp to the number on file, even if you have not turned the channel on. That message carries a button to disown it: if you were not the one who booked it, tapping the button flags the appointment, alerts the practice and stops us writing to you about it. Without that notice, an appointment booked with a mistyped number would never reach the person it names.

You decide which notices you receive and through which channel under Profile → Notifications, turning each channel on and off for each type of notice, whenever you want and without asking anyone. You can also unsubscribe from WhatsApp by replying "baja" to any of our messages.

Please note that, if you turn off a channel, you will stop receiving notices of changes or cancellations of your appointments through that channel. The emails that are indispensable for governing your account — password recovery, email verification — cannot be turned off, because they are how you regain access if you lose it.

9. Security

We protect your data with the platform's encryption: TLS in transit and the infrastructure provider's encryption at rest. In addition:

• Access to information is limited by role: each person sees only what their function requires.
• Access to medical folders is logged and can be audited.
• Sessions are managed with verified authentication and expire automatically.
• The identity and license of professionals are verified before they can see patients.
• We review security periodically and have incident response procedures in place.

No system is infallible. If we detect an incident affecting your data, we will notify you through the channels you have registered.

10. Measurement and cookies

We use strictly necessary cookies so that the platform works (session, active role, preferences). Only with your consent do we use measurement tools (PostHog and Google Analytics) to understand how the platform is used and improve it. We do not record sessions, we do not show advertising and we do not use third-party pixels.

Which cookies we use, how long they last and how to change your decision at any time is set out in the cookie policy and in the preferences link in the footer.

11. Retention and deletion

Your data is retained for as long as your account remains active.

You can delete your account yourself under Profile → Security, with no intermediary. When you do:

• Your contact and identification data (name, email, phone, identity card) is anonymised, so that it is no longer associated with you.
• Your medical history is retained, because the professional who treated you is required by law to keep it; it remains linked to the anonymised record and accessible only to that professional.
• Payment records and any other data the law requires us to keep are retained for the corresponding legal period.

Anonymised data may be retained for statistical and service improvement purposes.

12. Your rights

At any time you may:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request the deletion of your account and your personal data, with the effects described in §11.
• Request the portability of your data in a readable format.
• Withdraw your consent to measurement (§10) or to communications through a channel (§8).
• Lodge a complaint with the competent authority.

Four of these rights are exercised from your own account, with no request and no wait:

• Access: under Profile → My data is the log of every read of your medical history — who, when, what and from which address.
• Portability: on that same screen, the download button hands you a file with your profile, your patient record, your appointments, the documents from your consultations, the legal texts you accepted and your notification preferences. The file also states what it does not include, and why.
• Deletion: under Profile → Security you can delete your account, with the effects described in §11.
• Communication channels: under Profile → Notifications you turn each channel on and off for each type of notice (§8). Your decision about measurement is changed from the preferences link in the footer (§10).

To rectify data you cannot correct yourself in your profile, or for any other request about your personal data, write to us at soporte@amedisalud.com from the email address associated with your account, stating which right you wish to exercise. We may ask you for additional information to verify your identity before handling the request. We will respond within a maximum of 15 business days.

13. Minors

The platform is intended for people over 18. Minors may only be seen through the account of their father, mother or legal representative, who is responsible for the data recorded on their behalf. We do not knowingly collect data from minors without their representative's consent; if we detect that this has happened, we delete it.

14. Changes to this policy

Each version of this policy carries a version number and an effective date, visible in the header of this page. When a change is substantial, we will inform you within the platform and by email. Minor changes are published without further notice.

15. Contact

For questions about privacy or data protection, write to us at soporte@amedisalud.com. Our support hours are Monday to Friday, 8:00 a.m. to 6:00 p.m. (GMT-4). The full details of the controller are in the legal notice.