Privacy policy
Effective October 19, 2026. Covers the data Devalis processes for the clinics that use it, and the connection with Google Calendar.
Who is responsible for the data
Devalis is a management system for clinics and medical practices: scheduling, conversation with patients over WhatsApp and the web, clinical records and payments.
Patient data belongs to the clinic that treats them. The clinic is the controller of that data and Devalis processes it on the clinic's behalf, only to provide the service. Devalis processes the data of each clinic's staff accounts and of the Google Calendar connection to operate the system.
Contact: contacto@devalis.cl.
What data is processed
| Whose | Data |
|---|---|
| Clinic staff | Name, email, role, site and activity within the system. |
| Patients | Name, phone number, email and national ID (RUT); the messages they exchange with the clinic over WhatsApp or the web chat; their appointments; their clinical record (history, notes, documents, photos, prescriptions and consent forms); and the status of their payments. |
| Payments | Amount, status and receipt. Card details go to the payment provider; Devalis does not see or store them. |
| Practitioners who connect Google Calendar | What is described in the sections about Google, below. |
What it is used for
- Answering patients' questions, offering appointment times and booking them.
- Sending confirmations, reminders, prescriptions and documents the clinic issues.
- Keeping each practitioner's clinical records and schedule.
- Charging for visits with a payment link and recording their status.
- Providing support and keeping the system secure and running.
The replies in the conversation are written by an artificial intelligence model with the clinic's context; exact data (times, amounts, addresses) is written by the system. Devalis does not sell data, does not use it for advertising and does not use it to train artificial intelligence models.
Service providers
To provide the service, Devalis uses these providers. Each one receives only what its function needs.
| Provider | Purpose |
|---|---|
| Google Cloud (Santiago, Chile region) | Servers, database, files and backups. |
| WhatsApp (Meta Platforms), directly or through 360dialog | Sending and receiving the clinic's WhatsApp messages. |
| OpenCode | Artificial intelligence model that writes the replies in the conversation. It receives the conversation and the clinic context needed to answer. |
| TUU (Haulmer) | Payment links and payment notifications. |
| Resend | Sending email: prescriptions, documents and notices. |
How it is protected
- Each clinic's data is separated in the database: one clinic cannot read another's.
- Each staff member sees and does only what their role allows.
- Connections are encrypted, and credentials for external services are stored encrypted.
- Backups are made, and restoring them is tested periodically.
Patients' rights
Chilean Law 19.628 on the protection of private life, Law 20.584 on patients' rights and duties, Law 21.668 on clinical records and, once in force, Law 21.719 on personal data protection apply.
A patient can request access to, correction or deletion of their data, or object to its use, from the clinic that treats them. If they write to Devalis, Devalis forwards the request to the clinic and helps it comply. Clinical records are kept for the period the law requires, even if deletion is requested.
Devalis does not send clinical data to Google. The exception is the patient's name in the appointments written to Google Calendar, and only if the practitioner turns on the "Paciente" (Patient) setting.
Google data accessed
This part applies only to a practitioner who connects their Google account with the "Conectar Google Calendar" (Connect Google Calendar) button. Without that connection, Devalis accesses no Google data.
Devalis requests three permissions (scopes). Each professional accepts them on Google's consent screen when connecting their account.
| Scope | What it allows |
|---|---|
https://www.googleapis.com/auth/calendar.calendarlist.readonly | The list of calendars in the account, with their names, so the professional can choose which ones count as busy. |
https://www.googleapis.com/auth/calendar.events.readonly | Start and end time of the events in the calendars the professional marked as "Bloquea" (blocks availability), and change notifications for those calendars. |
https://www.googleapis.com/auth/calendar.app.created | Create the "Devalis · site" calendars and write appointments only in them. It gives no access to the professional's other events. |
Devalis does not read the "Devalis · site" calendars that it creates itself. No other permissions of the Google account are requested.
How Google data is used
- To prevent Devalis from offering a patient a time when the professional is busy.
- To show in Google Calendar the professional's appointments that are in Devalis.
Google data is not used for any other purpose.
What is stored from Google
- The account access authorization (token), encrypted.
- The email address of the connected account and the names of the calendars that are read.
- The start and end time of each busy period.
- The identifier of each event that Devalis writes to Google.
Titles, descriptions and guests are never stored: they are discarded when the event is read. The data is kept on Devalis servers in Google Cloud, Santiago region.
What is never done with Google data
- Google data is not sold.
- It is not used for advertising.
- It is not used to train or improve any artificial intelligence model.
- No person reads it, except in support and with the professional present.
- It is not transferred to third parties, unless the law requires it.
How long Google data is kept
Until the professional disconnects the account or the clinic removes the professional. Busy periods that have already passed are deleted daily.
How to revoke Google access
With the "Desconectar" (Disconnect) button in Ajustes › Profesionales › Agenda externa. Devalis revokes the authorization at Google and deletes the periods it read. The "Devalis · site" calendars stay in the professional's account, which owns them.
Access can also be revoked at https://myaccount.google.com/permissions.
Google API Services User Data Policy
Devalis's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Limited Use requirements:
- Google information is used only for the features described in "How Google data is used".
- It is not transferred, except to provide those features, for security, or because the law requires it.
- No person reads it, except with the professional's consent, for security, or because the law requires it.
- It is not used for advertising.
- It is not used to develop, improve or train generalized artificial intelligence or machine learning models.
Changes to this policy
If this policy changes, the new version is published here with its effective date. A change that broadens the use of Google data is asked of the practitioner first, on Google's consent screen.