ZorroCare Privacy Notice

1. Who we are

ZorroCare is a provider discovery, booking, and care-coordination platform operated by Auralis, S.A.. For privacy matters, contact hola@zorrocare.com.

This notice covers both our sites: www.zorrocare.com (directory, booking, accounts and information for professionals) and zorro.care, which holds only informational pages for mental-health professionals and never the directory, profiles, booking or any account. It also covers user accounts, and features that clinics or professionals enable in ZorroCare, including the WhatsApp assistant. The clinic or professional is responsible for its services and clinical decisions. When providing services under its instructions, we process data under the applicable agreement with that clinic. ZorroCare determines the relevant purposes for platform accounts, security, and administration. The clinic's notice supplements this document; it does not replace it.

2. Information we process

  • Identity and contact: name, phone number, email, language, and communication preferences.
  • Bookings: professional, service, session format, requested times, appointments, confirmations, changes, cancellations, and requests for an earlier appointment.
  • Messaging: content sent to the connected number, replies, attachments supported by the workflow, message identifiers, delivery and read status, and requests for help.
  • Payments: amounts, invoice status, method, reference, and evidence submitted for review.
  • Professional and integration information: profiles, services, availability, WhatsApp Business account and phone identifiers, permissions, and connection credentials.
  • Technical information needed for authentication, operation, support, and security.

A conversation may contain sensitive health information even if the assistant does not request it. Share only what is necessary to coordinate your appointment. Do not send passwords, access codes, full card numbers, or medical histories through WhatsApp. We do not use the operational chat as a substitute for the clinical record.

3. Purposes and basis for processing

We use information to manage accounts and access, check availability, coordinate bookings and changes, send appointment communications, handle waitlist requests, review payment evidence, provide support, and protect the service. Processing relies on consent and other legally permitted bases appropriate to each purpose, including applicable obligations. Processing sensitive data requires the corresponding legal basis and safeguards.

Consent for operational communications is managed separately from consent for transcription or AI clinical notes. Requesting an appointment does not authorize marketing campaigns or indiscriminate outreach about past treatment.

4. WhatsApp and the automated assistant

When a clinic connects its number, ZorroCare can receive and process messages sent to that number and send replies on its behalf through Meta's WhatsApp Business Platform. The clinic retains administration of its WhatsApp assets. Authorized clinic staff can view operational conversations and take over their handling. Not all features are enabled in every environment.

The assistant uses automation and, when enabled, artificial intelligence to understand requests and draft replies. It can make mistakes. It does not diagnose, prescribe, or replace a professional or emergency service. We do not guarantee immediate human monitoring. You can ask to speak with staff. If there is immediate danger, contact emergency services in your location.

Waitlists and opening offers are subject to availability and confirmation rules; receiving an offer does not guarantee an appointment. A payment image alone does not establish that payment was received: staff verify the amount and reference. Secure access or payment links are sent by email in the current workflow.

You can reply SALIR or STOP to stop receiving operational WhatsApp communications. This does not automatically delete your account, cancel an appointment, or constitute a request to erase existing records. The clinic may need to coordinate with you through another permitted channel to provide the service you requested.

5. Recipients, vendors, and transfers

Access depends on each person's role: client, professional, coordinator, or authorized support staff. Coordinators have operational access according to their assigned clinic and providers, not general access to clinical notes.

Depending on enabled features, we use hosting, database, email, WhatsApp, AI, storage, and other integration vendors. The pilot uses Vercel for hosting, Prisma Postgres for its database, and Resend for email. The WhatsApp integration uses Meta; operational AI may use OpenAI or Vercel AI Gateway depending on configuration. Calendar, video, and payment integrations are described when enabled for the relevant service.

These services may process information outside Panama. Not every vendor receives every category of data. External services also have their own notices and terms. We do not claim zero retention, exclusively local processing, or absence of vendor training without verifying the specific terms and controls of the contracted service.

6. Optional clinical notes and transcripts

If transcription or draft clinical notes are enabled, a specific notice and consent are provided. These features are separate from the receptionist assistant. The relevant documentation must identify recordings the video provider may generate, what text ZorroCare obtains, and who can access it. These features remain disabled in the WhatsApp pilot described here.

7. Retention and deletion

We retain information for as long as necessary for the disclosed purpose and applicable obligations. Deleting an account or disconnecting WhatsApp does not necessarily erase every record: retention obligations, third-party rights, or security investigations may apply. We will explain applicable limitations when handling a request.

8. Your rights and how to request deletion

You may request access, rectification, cancellation (deletion), objection, and portability where applicable, and withdraw consent, through the contact in this notice. Specify the associated email or phone number and your request; do not send your medical history or complete identity documentation in the initial message. We will verify your identity proportionately before granting access or making changes. Withdrawal does not affect prior lawful processing and may limit certain features.

Clinics may request disconnection of their integration and handling of the associated data. Revoking permissions in Meta does not replace a deletion request to ZorroCare. We will handle requests within applicable legal deadlines and limits, coordinating with the clinic when necessary. You may contact ANTAI, Panama's personal data protection authority.

9. Minors, security, and changes

Where care for minors is involved, the clinic must verify the necessary representation and authorizations. The assistant does not independently resolve custody, representation, or consent disputes.

We apply access controls and technical measures to protect information; no system is infallible. Using WhatsApp should not be understood as a guarantee that messages are accessible only on phones: the integration allows the clinic and necessary services to process the conversation.

We will publish changes to this notice with their date. Where a change requires it, we will provide additional information or request renewed consent.

10. Cookies and ad measurement

We use first-party cookies that the site needs to work: your account session, your language, a flag that a session exists (zc-session) and your decision about marketing cookies (zc-consent, 12 months). If you arrive from a campaign link (utm_*, gclid, fbclid or ref parameters), we store those values, the landing page and the referring domain in the zc-attr cookie for 90 days so we can tell which campaigns bring professionals to the platform. This cookie holds neither your name nor your email.

On the informational pages for professionals (home, For providers, About, Contact and the provider sign-up page) we also use the first-party zc-vid cookie (a random identifier, 12 months) to remember which pages of that section you viewed, for example pricing or the demo form, and, if you request a demo, to show that path to our sales team. We store the page, the time and the type of device; never your IP address or any patient page, and never while you are signed in. These records are deleted after 90 days and are not kept if you reject marketing cookies.

Site visit measurement is cookieless (Vercel Web Analytics) and never includes identifiers or the private pages of your account.

Only on our informational pages (home, For providers, About, Contact and the provider sign-up page) may we load, only if you accept in the cookie notice, advertising tags to measure whether our ads for professionals work: the Google Ads tag on both sites and the Meta (Facebook/Instagram) tag only on the For providers page of zorro.care. Those tags set Google and Meta cookies. They never load on the therapist directory, profiles, the matcher, the guides or the booking flow, and we do not build advertising audiences from those visits. If you reject, nothing loads; you can change your mind by clearing the site's cookies.

Each site has its own cookies and its own cookie notice. Because provider sign-up and sign-in live on www.zorrocare.com, moving from zorro.care to sign-up carries in the link the campaign data from zc-attr, the zc-vid identifier (unless you rejected marketing cookies) and, if you rejected them, that rejection; www.zorrocare.com stores them as its own cookies and removes them from the address straight away. Your name, your email and a cookie acceptance are never carried over.

When a professional requests a demo, submits a sign-up application or pays a first membership, we may report that conversion to Google Ads from our server with the email address transformed by an irreversible hash (SHA-256), the ad click identifiers and the landing page. To Meta we report, with the same data, only a demo request sent from zorro.care; nothing that happens on www.zorrocare.com is ever reported to Meta. We do not send your name, phone, provider type, city, interests or any patient data. The companies responsible are Google LLC and Meta Platforms, Inc., which process that data under their own policies.

Professionals can also ask for information through a Meta form inside Facebook or Instagram (lead ads). Meta collects that form and passes us what you entered (email, name, your WhatsApp number if you give it, whether you agree to be contacted on WhatsApp, and your profession) so our sales team can contact you; we only message you on WhatsApp if you agreed, and we handle this data like a demo request made on our site. These forms are for professionals only and are never used for patients.

If you book an appointment after arriving from a Google ad, we may report to Google Ads, from our server, that the click (gclid) ended in a booking, with the date and the deposit amount. That report carries no email, name, chosen professional, session type or any other appointment data, and bookings are never reported to Meta. No advertising tag loads on patient pages.