Privacy Policy

1. Identification of the Data Controller

VidaMente SpA operates a digital network of online ambulatory health services in Chile. For the purposes of Law 19.628 and its reform by Law 21.719, VidaMente acts as the data controller for the personal data it collects to manage scheduling, payment, the patient portal, communications, and the operational continuity of care. The treating professionals are responsible for their clinical decisions and for the clinical documentation they issue within the scope of care.

2. Data Collected

We collect only the data necessary to provide telemedicine services:

• •Identification data: Full name, national ID (RUT), date of birth.
• •Contact data: Email, phone, WhatsApp.
• •Health data: Reason for consultation, history, allergies, medications, pre-existing conditions.
• •Payment data: Payment method (processed by Mercado Pago; we do not store card data).
• •Usage data: Audit log of actions on the platform (IP, user-agent, date).

3. Purpose of Processing

Personal and health data are processed exclusively for:

• •Appointment management: scheduling, verification, reminders, and notifications.
• •Provision of remote health services and generation of clinical documentation.
• •Payment processing and issuance of receipts.
• •Compliance with legal obligations (Law 20.584, Sanitary Code).
• •Continuous improvement of the platform (anonymized and aggregated data).

4. Legal Basis for Processing

The processing of personal data is based on:

• •Explicit consent of the data subject, expressed by accepting the terms and checking the informed-consent box during scheduling.
• •Performance of a contract for the provision of health services.
• •Compliance with applicable legal obligations for health providers in Chile.

5. Security Measures

We implement the following technical and organizational measures to protect personal data:

• •Encryption at rest: Sensitive data (RUT, phone, reason for consultation) encrypted with AES-256-GCM.
• •Encryption in transit: All communications over TLS 1.3.
• •Encrypted clinical notes with additional encryption and HMAC-SHA256 digital signature.
• •OTP authentication for patient access to their data.
• •Audit log of all actions on sensitive data.
• •Role-based access control (admin, professional, assistant, patient).
• •File validation via magic bytes to prevent malicious uploads.
• •Rate limiting on critical endpoints (login, OTP, appointment creation, payments).

6. Data Subject ARCO-P Rights and Blocking

Under Law 21.719, the data subject has the right to exercise the following actions:

• •Access: Request information about which personal data are being processed.
• •Rectification: Request correction of inaccurate or outdated data.
• •Cancellation/Erasure: Request deletion of data when no longer necessary for the processing purpose, subject to legal retention periods.
• •Objection: Object to the processing of your data for specific purposes.
• •Portability: Request and receive a structured copy of your personal data to transfer it to another controller. Available as a direct export from the Patient Portal.
• •Temporary blocking: Request the temporary suspension of processing of your data while a rectification, erasure, or objection request is being resolved.

Where processing is based on your consent, you may withdraw it at any time, without retroactive effect, through the same means used to grant it.

To exercise these rights, send a request to vidamente4@gmail.com indicating the right you wish to exercise and the data needed to identify your account (folio or registered email). The Platform also provides a request form accessible from the patient portal. We will respond within 30 calendar days (extendable once by another 30 days), except for temporary blocking, which we will answer within 2 business days.

If we reject your request or fail to respond within the deadline, you may file a complaint with the Agencia de Protección de Datos Personales, the oversight authority created by Law 21.719.

7. International Patients — HIPAA & UK GDPR

Patients who register from the United States or the United Kingdom consent to the processing of their health data under the following frameworks. This section applies in addition to the Chilean framework above.

7.1 United States — HIPAA

For patients in the United States, VidaMente acts as a telehealth provider and, where applicable, as a Business Associate of covered entities. Protected Health Information (PHI) is handled in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HITECH Act. PHI is encrypted at rest (AES-256-GCM) and in transit (TLS 1.3), access is role-based, and a full audit trail is maintained. Patients may request access to, amendment of, and an accounting of disclosures of their PHI. Where a Business Associate Agreement (BAA) is required, it is executed before any PHI is shared with a subcontractor.

7.2 United Kingdom — UK GDPR

For patients in the United Kingdom, the processing of personal data is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The lawful basis for processing health data is explicit consent and the provision of healthcare. UK residents have the right to access, rectification, erasure, restriction, portability and objection, and may lodge a complaint with the Information Commissioner's Office (ICO). International transfers of personal data are safeguarded by appropriate measures under Chapter V of the UK GDPR.

You can review the applicable privacy notice for your jurisdiction here: HIPAA notice (US) · UK GDPR notice (UK) · Aviso Chile (ES).

8. Data Retention

Data are retained during the relationship with the patient and for the additional period required by Law 20.584 for medical-liability purposes (minimum 5 years from the last consultation). Clinical notes are retained encrypted for the same period. Audit data are retained for 2 years.

9. Transfer to Third Parties

VidaMente does not sell personal data. We share strictly necessary data with the following processors to operate the Platform, each under its own privacy policy:

• •Mercado Pago: Payment processing (name, email, amount).
• •Transactional email provider: OTP, confirmations, and notifications.
• •WhatsApp Business (Meta): Access codes and reminders via WhatsApp.
• •Groq: Consultation audio transcription and medical document summarization via AI, only with consent.
• •Google (Calendar/Meet): Schedule sync and video call, only if the professional enables this integration.
• •Internal Revenue Service (SII), via electronic invoicing provider: Issuance of tax documents.
• •IMED / Fonasa: Coverage and benefit verification, where applicable.
• •Supabase, Cloudflare, Vercel, and Railway: Database hosting, backups, and Platform execution.
• •Sentry: Technical error monitoring in production.
• •Competent authorities: When there is an express judicial or legal request.

Several of these providers process data outside Chile, which constitutes an international data transfer. We are formalizing data-processing agreements with each of them under Law 21.719, before its full entry into force on December 1, 2026.

10. Use of Cookies

We use two types of cookies, distinguished by whether they require your prior consent:

• •Strictly necessary (no consent required): session and authentication cookies (professional/admin login) essential for the Platform to work. They cannot be disabled because there is no technical way to run the service without them.
• •Analytics (require your prior consent): Microsoft Clarity, to understand how the site is browsed (heatmaps, anonymized session recording). It only loads if you explicitly accept it in the cookie notice shown on your first visit.

You can accept or reject analytics cookies at any time by clearing thevidamente_cookie_consent value from your browser (Settings → Privacy → Cookies and site data) or through your browser's third-party cookie blocking controls. Rejecting them does not affect your access to the Platform or to care.

11. Minors' Data

Minor patients (over 14 years old) may be attended with the consent of their legal representative, who must accept the informed consent during scheduling. For minors under 14, care must be requested and accompanied by a responsible adult.

12. Changes to this Policy

This policy may be updated to reflect changes in legislation or our practices. Modifications will be published on this page with the corresponding update date. In the event of material changes, we will notify active users via the registered email.

13. Security Breach Notification

In the event of a security breach affecting personal data, VidaMente has an internal response procedure and will notify the Personal Data Protection Agency within the 72-hour period required by Law 21.719, and directly the affected data subjects when there is a high risk to their rights.

14. Contact

For questions, ARCO rights exercises, or privacy-related requests:

Email: vidamente4@gmail.com
Platform: Patient Portal