Privacy Policy

1. Scope

This policy covers two contexts:

• Website visitors: data collected while browsing lyna-ai.com or requesting a demo.
• Patients of client clinics: when you interact with the lyna.ai agent via WhatsApp or voice, the clinic is the controller of that data, and Serv Medical acts as the processor, under a specific contract with each clinic. For questions about that processing, your clinic's own privacy policy is the primary reference.

2. Data we collect

• Browsing data and cookies, when you visit the site.
• Name, email, phone, and company, when you request a demo or get in touch.
• Scheduling data and message content (WhatsApp/voice), when you interact with the agent on behalf of a client clinic.

lyna.ai does not collect, process, or store diagnoses, prescriptions, or medical recommendations. The agent is restricted to administrative workflows, with automatic escalation to the clinic's human staff when needed.

Some of the data exchanged during service via WhatsApp or voice may include health-related information about the patient (for example, when reporting a symptom for scheduling or administrative triage purposes), and is treated as sensitive personal data under applicable law. This data receives additional protection: segmented access control, encryption in transit and at rest, and use restricted to the purposes strictly necessary to provide the service contracted by the clinic. lyna.ai does not perform diagnosis, prescription, or any clinical interpretation of this data.

3. Purpose and legal basis

We process personal data to operate the site, respond to contact requests, and provide the automated communication service contracted by client clinics, based on contract performance, legitimate interest, consent (where applicable), and compliance with legal obligations.

4. Use of artificial intelligence

The service provided by the lyna.ai agent uses artificial intelligence to interpret messages, schedule appointments, send reminders, and carry out pre-defined administrative workflows approved by the clinic. Some decisions, such as confirming or rescheduling an appointment, or handing off the conversation to a human attendant, may be made automatically. You can, at any time, request to be attended by a member of the clinic's staff, as well as request human review of any decision the agent made automatically.

5. Sharing

We share data only with the relevant client clinic (in the case of patient data), with infrastructure providers essential to operating the platform, and with public authorities when required by law. We do not sell personal data to third parties.

6. Retention

We keep personal data only for as long as necessary to fulfill the purpose for which it was collected. Once that purpose ends, the data is deleted or anonymized, unless its retention is required by a legal or regulatory obligation.

7. Your rights

You can request confirmation of processing, access, correction, anonymization, deletion, portability, or information about the sharing of your data, as well as withdraw consent where applicable, by contacting us.

8. Security

We adopt technical and organizational measures to protect personal data, including segmented access control and audit trails.

9. Changes

We may update this policy periodically. The date of the last update will always be shown at the top of this page.