PULSO Privacy Policy

1. Controller and processor

Agencia de Desarrollo y Publicidad Integral SpA (RUT 78.416.593-0), with its address at General Jofre 369, Chile, is the controller of PULSO user-account data and of requests received through getpulso.link.

With respect to each clinic's patient, conversation, appointment and payment data, the clinic is the controller and PULSO acts as a processor, following the clinic's instructions and solely to provide it with the service.

2. Data we process

Depending on the modules and integrations each clinic enables:

• Accounts and users: name, email address, role, password stored as a hash (never in readable form) and access and activity logs.
• WhatsApp conversations: messages are read from the messaging provider when viewed; PULSO records metadata (identifiers, dates, statuses, a cryptographic digest of the text) and stores the text of questions and replies handled by the AI assistant for the clinic's supervision and service improvement. The contact's phone number is stored encrypted and as a hash.
• Patients and appointments: identifiers of patient files, appointments, visits and payments, statuses, dates and amounts synchronized from the clinic's practice management software (for example, Dentalink). When the clinic enables patient registration, the identity document is stored as a hash and in masked form, and registration data is stored encrypted.
• Meta Ads data (Meta Marketing API): identifiers and names of ad accounts, campaigns, ad sets, ads and creatives (texts, headlines, calls to action and links to the thumbnails and images the clinic published on Meta), and aggregated metrics (spend, impressions, clicks, reach, conversations started, video plays). These are aggregated advertising data and contain no clinical data.
• Attribution and analytics: the identifier of the originating ad that WhatsApp reports when a conversation starts from an ad (Click-to-WhatsApp) and its relationship with the clinic's appointments and payments.
• Business inquiries submitted on getpulso.link: name, contact details and message.

3. Distinction between Meta data and clinical data

Data obtained through the Meta Marketing API are advertising metrics of the accounts the clinic authorized and are read in read-only mode.

Clinical and patient data come from the clinic's practice management software (Dentalink) and from WhatsApp conversations.

PULSO does not send clinical data, identity documents or health information to Meta through the Marketing API.

4. Use of artificial intelligence

To generate replies, PULSO sends to a large-language-model provider (through OpenRouter) the conversation text needed to reply and the information the clinic publishes (prices, opening hours, services). The conversation text may contain data that the patient writes.

Replies can be reviewed by the clinic, which may turn the assistant off at any time.

5. Purposes

• Providing the service subscribed to by the clinic: WhatsApp engagement, scheduling, analytics and attribution.
• Managing accounts, access and security.
• Measuring the advertising performance of the accounts the clinic authorized.
• Responding to business and support requests.
• Complying with applicable legal obligations.

6. Providers and data sharing

PULSO uses the following providers, which process data on behalf of PULSO or the clinic to the extent necessary:

• Cloudflare: runtime infrastructure, database and real-time communications.
• A messaging provider connected to WhatsApp Business, and Meta Platforms (WhatsApp Business and the Meta Marketing API).
• Dentalink or another practice management system used by the clinic.
• OpenRouter and the artificial-intelligence model providers it gives access to.
• Brevo: transactional email delivery (invitations, access notices).

PULSO does not sell personal data. A clinic's data is not shared with other clinics.

7. Security

• Communications encrypted in transit (HTTPS).
• Integration credentials (for example, Dentalink and messaging-provider keys) encrypted with AES-GCM before being stored; platform credentials, such as Meta Marketing API access, are kept as runtime environment secrets and are never sent to the browser.
• Passwords stored with PBKDF2; sessions with identifiers stored as hashes.
• Per-clinic isolation: every data query is limited to the user's clinic and to the permissions of their role.
• Audit logs of administrative actions.

No measure is infallible. PULSO does not claim certifications or end-to-end encryption.

8. Retention and deletion

Each clinic's data is retained while PULSO provides service to that clinic and according to its instructions. Some technical records are deleted automatically (for example, expired sessions and security counters).

When the service ends, or upon a valid request, data is deleted, unless there is a legal obligation to retain it. Metrics obtained from Meta stop synchronizing when the authorization is withdrawn; history already obtained is kept for as long as the clinic authorizes it.

To request data deletion, see the Data Deletion page.

9. Data subject rights

Individuals may request access to, rectification, deletion of or objection to the processing of their data, under the applicable law.

If the data was processed on behalf of a clinic (for example, as a patient), the request should be addressed to that clinic; PULSO will assist the clinic in handling it.

10. Privacy contact

Privacy requests and inquiries: contacto@getpulso.link.

11. Updates

This policy may be updated to reflect changes in the service or in the law. The effective date appears at the top of this document.