Draft pending review by a lawyer. This text describes what the product does today; it is not legal advice and may change before final publication.
Explains how Tsunami handles the data of people who use the platform, visit the site or contact us, and makes clear that each clinic is responsible for its patients' data.
1 · 1. Who is responsible
Tsunami Automation Global LLC (“Tsunami”) operates Soluciones para Doctores. Address: 5900 Balcones Drive STE 100, Austin, TX 78731, United States. Privacy email: privacy@tsunamiautomation.com. Site: https://solucionesparadoctores.tsunamiautomation.com.
We handle personal data in two different roles:
- As controller (“responsable”), for your data if you are a clinic user on the platform, a site visitor, a prospect or someone who asks for a demo, a billing contact, or a professional listed in the directory.
- As processor (“encargada”), for patients' data. Each clinic is the controller of that data (section 2).
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 15, fr. I; LFPDPPP (DOF 20-mar-2025), art. 2, fr. XII y XIV
2 · 2. If you are a patient: your clinic is the controller
When a clinic uses Soluciones para Doctores, the clinic decides why and how its patients' data is used. So the clinic is the controller. Tsunami Automation Global LLC handles that data only on behalf of the clinic and on its instructions, as processor. The rules are in the data-processing agreement (/legal/contrato-encargo). The providers that receive data are listed at /legal/subencargados.
To exercise your rights over patient data, you have three options:
- Ask your clinic directly. Its name and address are in its confirmation message and on its profile.
- Use your clinic's ARCO page: /arco/<your clinic code>. The code is the last part of the address your clinic gave you.
- Write to us at privacy@tsunamiautomation.com. We send your request to the clinic and help it answer within the legal deadline.
The clinic must have its own privacy notice and must ask for your express authorisation to handle your health data. The platform includes an express-authorisation checkbox in the patient intake form.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 2, fr. XII y XIV; LFPDPPP (DOF 20-mar-2025), art. 8; LFPDPPP (DOF 20-mar-2025), art. 13; Reglamento de la LFPDPPP (2011), arts. 49 a 55
3 · 3. What data we handle
| Person | Data | How we get it | Sensitive? |
|---|---|---|---|
| Clinic users (owners, doctors, front desk) | Name, email, phone, role, password (stored as an irreversible code), two-step verification key (encrypted), access records (date, IP address, browser) and activity in the account. | From you, or from the person who manages your clinic and invited you. | No |
| Site visitors | Your cookie choice. Only if you accept analytics cookies: IP address, browser, cookie identifier and pages visited. | Automatically, from your browser. | No |
| Prospects and demo or contact requests | Name, email, phone, clinic name and the message you write. | From you, in our forms. | No. Do not write health data in these forms. |
| Billing and payment contacts | Payer email, amount, reference, organisation and the details you give us to invoice. We do not receive or store your full card number. | From you or your clinic, and from the payment provider when the clinic turns on online payments. | No |
| Professionals and clinics in the directory | Name of the professional or clinic, phone and office address. | See section 12. | No |
| Patients (through their clinic) | Name, email, phone, appointments, WhatsApp or chat messages, calls with the voice agent, notes and, only if the patient provides them, health data. | From the patient, or from the clinic. | Yes, it may include health data. The clinic handles it as controller. |
For the data we handle as controller, we do not ask for sensitive data. Health data appears only in patient flows, and the clinic handles it. To handle it, the clinic needs your express consent in writing. The law accepts that it can be given with an electronic signature or an authentication mechanism.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 15, fr. II; LFPDPPP (DOF 20-mar-2025), art. 2, fr. VI; LFPDPPP (DOF 20-mar-2025), art. 8
4 · 4. What we use your data for
Necessary purposes. Without them we cannot give you the service:
- Create and manage your account, and check who you are when you sign in.
- Provide the service the clinic signed up for: scheduling, messages, reminders, AI receptionist and voice.
- Give support and send you service notices, security notices and invoices.
- Charge and invoice.
- Protect security, prevent abuse and keep audit logs.
- Answer the contact, demo or information requests you send us.
- Show the directory of professionals (section 12).
- Meet legal duties and answer requests from authorities.
Secondary purposes. They need your consent, or you can refuse them:
- Send you news, promotions or commercial invitations from Tsunami, if you asked for them or accepted them.
- Measure visits to the public pages of the site with Google Analytics, only if you accept analytics cookies.
- Improve the product with usage statistics from clinic accounts. We do not use patients' personal data for this purpose.
To refuse a secondary purpose, write to privacy@tsunamiautomation.com and tell us which one. You can also choose “Solo necesarias” (necessary only) in the cookie banner, or reply BAJA to a commercial message. You can do this when you give us your data or later. Refusing does not affect the service.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 15, fr. III; LFPDPPP (DOF 20-mar-2025), art. 11; Reglamento de la LFPDPPP (2011), art. 14; Reglamento de la LFPDPPP (2011), art. 30
5 · 5. How to limit the use or disclosure of your data
- Ask us by email (privacy@tsunamiautomation.com) to stop using your data for commercial purposes.
- Reply BAJA, STOP or ALTO to a commercial message to stop receiving it.
- Change your cookie choice at any time with the “Preferencias de cookies” (cookie preferences) link at the bottom of every page.
- Exercise your right to object (section 8).
- You can also sign up to PROFECO's public registry to not receive advertising.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 15, fr. IV; LFPDPPP (DOF 20-mar-2025), art. 26; LFPC, arts. 17 y 18 Bis
6 · 6. Who we share your data with, and in which countries
We do not sell or rent personal data. We share data with providers that help us run the platform. Some are outside Mexico: Germany (hosting) and the United States (most of the others). This list shows the recipients. The detail of what data each one receives is at /legal/subencargados.
| Recipient | Purpose | Country |
|---|---|---|
| Cloud infrastructure provider (European Union) | Hosting of the application, the database and backups. | Germany (Nuremberg) |
| AI language-model providers | Language models for the AI receptionist: draft replies and transcribe WhatsApp voice notes. | United States |
| Voice-agent provider | Voice agent (receptionist phone calls), with its language model. | United States |
| Telephony and messaging provider | Alert calls and messages to clinic staff; WhatsApp channel for some clinics. | United States |
| WhatsApp Business platform provider | Sending and receiving WhatsApp messages between clinic and patient. | United States |
| Transactional email provider | Sending transactional email (sign-in links, invitations, notices and reminders). | International provider |
| Google LLC (Google Analytics) | Measuring visits to the public pages of the site. Only active if you accept analytics cookies. | United States |
| Google LLC (Google Calendar) | Optional synchronisation of appointments with the clinic's calendar. Only if the clinic connects its calendar. | United States |
| Stripe, Inc. and Mercado Pago | Payments and subscriptions, when a clinic or plan uses them. Online payments are only active for clinics that enable them. | United States; Mexico and Latin America |
| Cloudflare, Inc. | Domain name service (DNS). | Global |
| Backup storage (European Union) | Database backups. | Germany (exact location to be confirmed) |
The booking engine and the error log run on our own servers in Germany. They are not third parties.
Transfers clause. By giving us your data and using the platform, you accept that we share it with the recipients on this list, and with authorities when the law requires it. If you do not accept a transfer, write to privacy@tsunamiautomation.com before you use the service. We may not be able to offer you the part of the service that depends on it.
For patients: the clinic decides the transfers of its data. The law allows transfers without consent when they are needed for prevention, diagnosis or medical care, or to manage health services.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 35; LFPDPPP (DOF 20-mar-2025), art. 36, fr. II; Reglamento de la LFPDPPP (2011), arts. 74 a 76
7 · 7. Automated decisions and the AI receptionist
The AI receptionist answers WhatsApp messages and voice calls. It can suggest times and book or change appointments within the clinic's rules. It is not built to give diagnoses or medical instructions.
If a message looks like an emergency or a clinical question, the reply is replaced by a notice and clinic staff are alerted so a person can help. To prepare the reply, the text of the message is first sent to the language-model provider (section 6). So do not write detailed health data in the chat. If it is an emergency, call the emergency services.
You have the right to object to decisions about you being made only by automated processing, without human involvement, when they significantly affect you. Ask for a person at the clinic to handle your case, or exercise your right to object as section 8 explains.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 26, fr. II
8 · 8. Your ARCO rights
- Access: know what data of yours we handle and how.
- Rectification: correct inaccurate or incomplete data.
- Cancellation: ask us to delete your data. Some data we must keep by law (section 11).
- Objection: object to a use of your data, including commercial use and solely automated decisions.
For data we handle as controller, write to privacy@tsunamiautomation.com. For patient data, use the options in section 2. The person or area that handles these requests is Tsunami's privacy team, at that email.
Your request must include:
- Your name and a way to answer you (email or address).
- A document that proves your identity or your representative's.
- A clear description of the data and of the right you want to exercise.
- Anything that helps us find your information (for example, the clinic and the date of your appointment).
It is free. We can only charge reproduction or shipping costs. We answer within 20 business days of receiving your request. If it is granted, we carry it out within 15 more days. Both deadlines can be extended once by the same time, if we justify it. The days are business days. If you make the same request more than once in 12 months, the cost cannot exceed 3 UMA.
Legal basis: LFPDPPP (DOF 20-mar-2025), arts. 21 a 26; LFPDPPP (DOF 20-mar-2025), art. 28; LFPDPPP (DOF 20-mar-2025), art. 29; LFPDPPP (DOF 20-mar-2025), art. 31; LFPDPPP (DOF 20-mar-2025), art. 34
9 · 9. How to withdraw your consent
You can withdraw your consent at any time by writing to privacy@tsunamiautomation.com. For cookies, use “Preferencias de cookies”. For commercial messages, reply BAJA. For your health data as a patient, tell your clinic.
Withdrawing consent does not change what was done before you withdrew it. If you withdraw a consent the service needs, we may not be able to keep giving you the service. Some data must be kept by law even if you withdraw your consent.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 7; LFPDPPP (DOF 20-mar-2025), art. 15
11 · 11. How long we keep your data
The periods and the deletion procedure are at /legal/conservacion-eliminacion. In short:
- Data in a clinic account is kept while the account is active. If the clinic ends the service, we delete its data within 30 days of its request. Backups expire by rotation.
- Prospects' contact data is kept while it is useful to answer you, or until you ask us to delete it. Today there is no automatic deletion by age; we do it manually when you ask.
- Some data is kept because the law requires it, for example tax documents (five years).
- Temporary links and sessions expire on their own.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 10; LFPDPPP (DOF 20-mar-2025), art. 12; LFPDPPP (DOF 20-mar-2025), art. 24; Código Fiscal de la Federación, art. 30
12 · 12. Directory of professionals
The platform includes a public directory of clinics and professionals. It shows professional or business contact data: name of the professional or clinic, phone and office address. We use it so patients can find the professional. This purpose does not depend on you being a customer.
If you appear in the directory and want to correct your data or have it removed, write to privacy@tsunamiautomation.com with the name and phone shown in the listing. We handle it as a request for rectification, cancellation or objection, within 20 business days.
If we received your professional data from a source other than you, this section is our notice to you. You can exercise your rights at any time.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 15; LFPDPPP (DOF 20-mar-2025), art. 17; LFPDPPP (DOF 20-mar-2025), arts. 23 a 26
13 · 13. Security and breaches
We apply administrative, technical and physical measures to protect data. They include:
- Patients' personal data and message text are stored with field-level encryption.
- Connections use HTTPS.
- Passwords are stored as an irreversible code. Sessions expire when idle.
- Each clinic's data is kept separate from other clinics' data.
- We keep audit logs and offer two-step verification to clinic accounts.
No system is perfectly secure. If a breach occurs that significantly affects your rights, we will tell you immediately. If it affects patient data, we tell the clinic without delay so it can inform the patients. More detail at /legal/seguridad.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18; LFPDPPP (DOF 20-mar-2025), art. 19; LFPDPPP (DOF 20-mar-2025), art. 20
14 · 14. Changes to this notice
If we change this notice, we publish it here with a new version and date. When the change is important, we tell you by email or inside the platform. If we want to use your data for a new purpose, we ask for your consent again when the law requires it.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 15; LFPDPPP (DOF 20-mar-2025), art. 11
15 · 15. Authority
If you think we did not handle your request properly or that your rights were violated, you can go to the Secretaría Anticorrupción y Buen Gobierno, the authority for personal data protection. The request for protection of rights is filed within 15 business days after our answer, or when the deadline passes without an answer. Please write to us first, so we can try to solve it.
Legal basis: LFPDPPP (DOF 20-mar-2025), arts. 38 y 39; LFPDPPP (DOF 20-mar-2025), arts. 40 a 50
16 · 16. Version and date
Version 2026-10. Planned effective date: 2026-11-01.
Note for the lawyer: this notice also cites the 2011 Regulation of the LFPDPPP and the 2013 Privacy Notice Guidelines. Both refer to article numbers of the earlier law. A lawyer must confirm how they apply after the 2025 law.