Privacy Policy

1. Identification of the Data Controller

VidaMente SpA operates a digital network of online ambulatory health services in Chile. Under the legislation currently in force, and in preparation for Law 21.719, VidaMente acts as the data controller for the personal data it collects to manage scheduling, payment, the patient portal, communications, and the operational continuity of care. The treating professionals are responsible for their clinical decisions and for the clinical documentation they issue within the scope of care.

2. Data Collected

We collect only the data necessary to provide telemedicine services:

• •Identification data: Full name, national ID (RUT), date of birth.
• •Contact data: Email, phone, WhatsApp.
• •Health data: Reason for consultation, history, allergies, medications, pre-existing conditions.
• •Payment data: Payment method (processed by Mercado Pago; we do not store card data).
• •Usage data: Audit log of actions on the platform (IP, user-agent, date).

3. Purpose of Processing

Personal and health data are processed exclusively for:

• •Appointment management: scheduling, verification, reminders, and notifications.
• •Provision of remote health services and generation of clinical documentation.
• •Payment processing and issuance of receipts.
• •Compliance with legal obligations (Law 20.584, Sanitary Code).
• •Continuous improvement of the platform (anonymized and aggregated data).

4. Legal Basis for Processing

The processing of personal data is based on:

• •Explicit consent of the data subject, expressed by accepting the terms and checking the informed-consent box during scheduling.
• •Performance of a contract for the provision of health services.
• •Compliance with applicable legal obligations for health providers in Chile.

5. Security Measures

We implement the following technical and organizational measures to protect personal data:

• •Encryption at rest: We apply encryption to certain sensitive stored data, alongside access controls.
• •Secure connections: Website access uses HTTPS; the TLS version depends on the service and connection configuration.
• •Encrypted clinical notes with additional encryption and HMAC-SHA256 digital signature.
• •OTP authentication for patient access to their data.
• •Audit log of all actions on sensitive data.
• •Role-based access control (admin, professional, assistant, patient).
• •File validation via magic bytes to prevent malicious uploads.
• •Rate limiting on critical endpoints (login, OTP, appointment creation, payments).

6. Privacy requests

You may submit requests to access, correct, erase, or block data through the channels below. We will review each request in light of current law, the processing purpose, and clinical-record retention duties. The portal also offers a technical download of available data associated with the account.

• •Access: Request information about which personal data are being processed.
• •Rectification: Request correction of inaccurate or outdated data.
• •Cancellation/Erasure: Request deletion of data when no longer necessary for the processing purpose, subject to legal retention periods.

Where processing is based on your consent, you may withdraw it at any time, without retroactive effect, through the same means used to grant it.

To exercise these rights, send a request to vidamente4@gmail.com indicating the right you wish to exercise and the data needed to identify your account (folio or registered email). The Platform also provides a request form accessible from the patient portal. Our target response time is 30 calendar days and, for blocking requests, 2 business days. These are internal response targets and do not replace any statutory deadline that applies to a request.

Law 21.719 and the Personal Data Protection Agency will enter into force on December 1, 2026. Until then, requests and complaints are governed by the legislation currently in force.

7. Service availability outside Chile

Patient registration and care through VidaMente are currently available in Chile. Access to this website from another country does not mean that services are offered there or that VidaMente is certified or covered under a foreign health-data regime. VidaMente does not currently represent that it is a HIPAA covered entity or Business Associate, or that it has appointed a UK representative. Do not submit regulated health information from another jurisdiction through this service.

8. Data Retention

Data are retained during the relationship with the patient and for the additional period required by Law 20.584 for medical-liability purposes (at least 15 years from the last information entry). Clinical notes are retained for the same period. Audit data are retained for 2 years.

9. Transfer to Third Parties

VidaMente does not sell personal data. We share strictly necessary data with the following processors to operate the Platform, each under its own privacy policy:

• •Mercado Pago: Payment processing (name, email, amount).
• •Transactional email provider: OTP, confirmations, and notifications.
• •WhatsApp Business (Meta): Access codes and reminders via WhatsApp.
• •Groq: Consultation audio transcription and medical document summarization via AI, only with consent.
• •Google (Calendar/Meet): Schedule sync and video call, only if the professional enables this integration.
• •Internal Revenue Service (SII), via electronic invoicing provider: Issuance of tax documents.
• •IMED / Fonasa: Coverage and benefit verification, where applicable.
• •Supabase, Cloudflare, and Railway: Database hosting, backups, and Platform execution.
• •Sentry: Technical error monitoring in production.
• •Competent authorities: When there is an express judicial or legal request.

Several of these providers process data outside Chile, which constitutes an international data transfer. We are formalizing data-processing agreements with each of them under Law 21.719, before its full entry into force on December 1, 2026.

10. Use of Cookies

We use two types of cookies, distinguished by whether they require your prior consent:

• •Strictly necessary (no consent required): session and authentication cookies (professional/admin login) essential for the Platform to work. They cannot be disabled because there is no technical way to run the service without them.
• •Analytics (require your prior consent): Microsoft Clarity, to understand how the site is browsed (heatmaps, anonymized session recording). It only loads if you explicitly accept it in the cookie notice shown on your first visit.

You can accept or reject analytics cookies at any time by clearing thevidamente_cookie_consent value from your browser (Settings → Privacy → Cookies and site data) or through your browser's third-party cookie blocking controls. Rejecting them does not affect your access to the Platform or to care.

11. Minors' Data

Minor patients (over 14 years old) may be attended with the consent of their legal representative, who must accept the informed consent during scheduling. For minors under 14, care must be requested and accompanied by a responsible adult.

12. Changes to this Policy

This policy may be updated to reflect changes in legislation or our practices. Modifications will be published on this page with the corresponding update date. In the event of material changes, we will notify active users via the registered email.

13. Security Breach Notification

VidaMente will manage security incidents and make communications required by the legislation in force. From December 1, 2026, Law 21.719 will require notification to the Agency by the most expeditious means possible and without undue delay; that law does not set a general 72-hour deadline. VidaMente uses 72 hours as an internal operational reference, which does not permit delaying a notification required sooner. Separate sector-specific duties may also apply, with their own recipients and deadlines.

14. Contact

For questions or privacy-related requests:

Email: vidamente4@gmail.com
Platform: Patient Portal