Privacy Policy

1. Who we are

DRChat is a platform by Thynkr AI, the trade name of Pedro Paulo Ramos dos Santos Consultoria e Desenvolvimento Ltda, that automates clinics' customer service on Instagram.

For data of people who talk to a clinic on Instagram, the clinic is the controller and DRChat acts as a processor, handling the data on the clinic's behalf and according to its instructions. For the account data of platform users (clinic staff), DRChat is the controller.

2. Data we process

We only process the data needed to provide the service:

• Platform users: name, email, password (stored only as a hash), clinic, access role and language preference.
• Instagram account connected by the clinic: ID, username, name, profile picture and the access token granted by Meta (stored encrypted).
• People who interact with the clinic's account: Instagram-scoped ID, username, name, profile picture, whether they follow the account, the content of Direct messages and attachments, and comments on posts.
• Information voluntarily shared in the conversation, such as name, phone number, email, procedure of interest and preferred appointment date and time.
• Content published through the platform: images, videos and captions the clinic schedules or publishes.
• Account and post metrics provided by Meta, such as reach, views, profile visits, followers and engagement.
• Technical records: IP address, browser, access date and time, and error logs.

3. How we use the data

We do not sell personal data, we do not use it for advertising and we do not use it to train artificial intelligence models.

• Receiving and answering Direct messages, by the AI agent or by the clinic's team.
• Running the comment and message automations configured by the clinic.
• Identifying whether a person has talked to the clinic before, so that only new contacts are handled by the agent.
• Booking appointments and passing contact details to the systems the clinic chooses (for example, calendar and WhatsApp).
• Publishing and scheduling content and showing performance metrics to the clinic.
• Keeping the platform secure, preventing fraud and meeting legal obligations.

4. Legal bases

We process data based on the performance of our contract with the clinic, the legitimate interest in answering people who contact the clinic, compliance with legal obligations and, where applicable, the data subject's consent (LGPD art. 7).

Conversations may contain health information that a person chooses to share. This sensitive data is processed only for the requested support and booking, with access restricted to the responsible clinic's team (LGPD art. 11).

5. Who we share data with

• Meta Platforms (Instagram): to receive and send messages, comments and posts through the official APIs.
• Artificial intelligence providers (such as OpenAI, Anthropic and Google): receive the part of the conversation needed to generate the agent's reply, under API agreements that prohibit using this data to train their models.
• Infrastructure: server and hosting providers (Hostinger), DNS and file storage (Cloudflare) and error monitoring (Sentry).
• Integrations enabled by the clinic, such as Google Calendar and the clinic's WhatsApp service.
• Public authorities, when required by law or court order.

6. International transfers

Some of these providers process data outside Brazil, mainly in the United States. These transfers follow LGPD art. 33, with providers that adopt contractual safeguards and adequate security standards.

7. How long we keep data

• Raw events received from Instagram (webhooks): 30 days.
• Messages, contacts, comments and appointments: while the clinic's account is active.
• After a clinic cancels its account, all of its data is deleted within 30 days.
• Access logs: 6 months, as required by art. 15 of Brazil's Internet Civil Framework (Law No. 12,965/2014).

8. Security

All traffic uses HTTPS. Access tokens and integration credentials are stored with AES-256-GCM encryption. Each clinic can only access its own data, and internal access follows the principle of least privilege.

9. Your rights

Under the LGPD (art. 18), you may request: confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, withdrawal of consent and deletion of data processed based on consent. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

To exercise your rights, write to thynkrai@gmail.com. If the request concerns data processed on behalf of a clinic, we will forward it to the responsible clinic and support its response.

10. Data deletion

Instructions for requesting the deletion of your data are on the Data deletion page.

11. Cookies

We only use essential cookies to keep platform users signed in and to remember the language preference. We do not use advertising or tracking cookies.

12. Minors

The platform is intended for clinics and their professionals and is not directed at people under 18.

13. Changes to this policy

We may update this policy. The date of the last update is shown at the top of the page, and relevant changes are communicated to clinics.

14. Contact and data protection officer

Data protection officer (DPO): thynkrai@gmail.com.