Let's talk!

PRIVACY POLICY

1. Data controller

The controller of the personal data collected on this website is Light Funnels Services SL (trading as Climadent), tax ID (CIF) B67993725, registered address Calle Navacepedilla, 5, 1ºB, 28044 Madrid, Spain, contact email info@climadent.com.

2. Data we collect and purpose

Through the contact form we collect: clinic name, contact person, phone number and email.

  • Purpose: responding to your enquiry, preparing the free analysis you requested and, where applicable, sending you commercial proposals about our dental marketing services.
  • Legal basis: the consent you give by ticking the acceptance box and submitting the form (art. 6.1.a GDPR), and our legitimate interest in handling your enquiry (art. 6.1.f GDPR).
  • Retention: data is kept for the duration of the commercial relationship or until you request its deletion.

3. Recipients

Data is stored in our customer relationship management system (CRM). We do not transfer data to third parties except where legally required. Our technology providers (hosting and CRM) may act as data processors under art. 28 GDPR.

4. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing toinfo@climadent.com. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

5. Security

We apply appropriate technical and organisational measures to guarantee the confidentiality and integrity of your personal data.

6. Our dual role in data processing

Light Funnels Services SL acts in two distinct capacities, with different roles under the GDPR:

  • As data controller: for the data you provide through this website (contact form and information requests). Sections 1 to 5 of this policy apply to this scenario.
  • As data processor: for the patient data processed through the Wendia management platform and its WhatsApp service, on behalf of the client dental clinics. In this scenario the data controller is the clinic you are communicating with, and we process the data following its instructions. Sections 7 to 11 apply.

7. WhatsApp patient communications service

We provide dental clinics with a patient support service via WhatsApp. If you communicate with your clinic through this channel, we process your data as a data processor under a data processing agreement pursuant to Article 28 GDPR entered into with each clinic. The clinic is the data controller.

  • Data processed: phone number, name, message content and reason for the enquiry.
  • Health data: conversations with a dental clinic may involve data concerning health (special categories of data, Article 9 GDPR). The legal basis for processing such data is provided by the clinic as data controller, not by Light Funnels Services SL.
  • Retention: as data processor, we retain the data for the duration of our contract with the clinic. Upon termination, we delete or return the data following the clinic's instructions, in accordance with Article 28(3)(g) GDPR. The retention period for conversations during the term of the contract is determined by each clinic as data controller, subject to a default maximum of 24 months.
  • Your rights: you may exercise your rights of access, rectification, erasure, objection, restriction and portability before the clinic acting as data controller. You may also write to us at info@climadent.com: we will forward your request to the clinic without undue delay and handle it according to its instructions. See our data deletion page for more information.

Where the clinic also keeps its number active in the WhatsApp Business app on its own phone, the platform receives a copy of the messages the clinic's staff send from that device, for the sole purpose of keeping the conversation history unified.

When the number is first connected, WhatsApp may transmit the clinic's previous conversation history and contact list. This data is kept only in a technical reception log for a maximum of 30 days, is not added to the platform's conversation history and is not accessible from it.

8. Calendar synchronisation with Google Calendar

The Wendia platform lets each clinic connect its own Google Calendar account, if it wishes, to keep its appointments in sync. It is an optional feature that the clinic enables from its own account. Here too we process the data as adata processor, under a data processing agreement pursuant to Article 28 GDPR entered into with each clinic, which is the data controller.

  • What Wendia writes to the calendar: one event per appointment, with the appointment type, the date, the time, a link to the appointment record inside Wendia, the appointment notes and, if the clinic keeps the default level of detail, the patient's name with the surname reduced to its initial or given in full, depending on the level the clinic chooses, and their contact phone number. The clinic can reduce that detail at any time and leave only the appointment type and the time slot in the event.
  • What it never writes: clinical notes, email addresses or identity documents. Events are created without guests unless the clinic adds them to that appointment; if it does, Google emails them the event with its title and notes.
  • What Wendia reads: it queries the connected calendar solely to know which time slots are already busy and avoid overlapping appointments. For events it did not create, it keeps only the title and the time slot, to show in the schedule what occupies each gap; it does not keep the description, the location or the attendees.
  • Calendars in the account: Wendia reads the list of calendars in the connected account so that the clinic can choose which one receives the appointments of each type. If the clinic requests it from the platform, Wendia can also create secondary calendars in that account, rename them or delete them; outside that express action by the clinic it does not create, modify or delete any calendar.
  • Automated assistant and other recipients: the WhatsApp assistant described in section 9 does not access the calendar or the titles of events Wendia did not create; it only receives the free slots of the clinic's schedule, with the slots busy in Google Calendar already removed, in order to offer appointments to the patient. That processing is carried out by Anthropic PBC as a processor and it does not use that data to train its models. When the clinic enables video appointments, the appointment's Google Meet link is sent to the patient over WhatsApp.
  • Deletion and retention: when an appointment is cancelled in Wendia, the corresponding event is deleted from the calendar. Google keeps deleted items in the account's bin for 30 days, under its own policy, before removing them permanently.
  • Disconnection: the clinic can disconnect its Google account from Wendia at any time. When it does, the platform stops accessing the calendar and removes the future events it had created; past events are not modified. The authorisation can also be reviewed and revoked from the security settings of the Google account, at myaccount.google.com/permissions.
  • Rights: you may exercise your rights of access, rectification, erasure, objection, restriction and portability before the clinic acting as data controller. You may also write to us at info@climadent.com: we will forward your request to the clinic without undue delay and handle it according to its instructions. More information on our data deletion page.

Light Funnels Services SL staff do not access the content of the clinics' calendars except for technical incidents expressly authorised by the clinic concerned.

Compliance with the Google API Services User Data Policy: Wendia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, that data is used only for the scheduling features described in this section, which are visible to the clinic in the platform; it is transferred only to the processors needed to provide them; it is not used to serve advertising; no person reads it except in the cases stated in this section; and it is not used, whether raw, aggregated or derived, to develop, improve or train artificial intelligence or machine learning models, whether our own or third parties'. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

9. Use of automated systems

In the WhatsApp communications service, the first reply to your message may come from an automated system based on artificial intelligence, which answers enquiries, provides information about treatments and helps manage appointments. You may request human assistance at any time, and your conversation will be transferred to the clinic's front desk. No clinical decisions are made by automated means: any matter concerning diagnoses or treatments is always assessed by the clinic's staff.

10. Processors and sub-processors

The providers involved vary depending on the service:

climadent.com website

  • Vercel Inc.: website hosting.

Wendia management platform, used by client clinics

  • Lovable: web application hosting.
  • Supabase: database, file storage and server functions.
  • WhatsApp Business Platform (Meta Platforms Ireland Ltd.): messaging channel.
  • Anthropic PBC: natural language processing for the assistant's automated replies. It is the only artificial intelligence provider that processes the content of patient conversations.
  • Google Ireland Ltd. (Google Calendar): only when the clinic enables the calendar synchronisation described in section 8, and limited to the appointment data the clinic itself chooses to publish in its calendar.

Marketing content generation, with no patient data involved

  • Google (Gemini) and OpenAI: generation of texts and images for the clinics' posts and materials. This use is separate from the calendar synchronisation described in section 8 and does not process patient data.

Data obtained through Meta's APIs is not sold, transferred to third parties, or used for advertising purposes or for commercial profiling.

11. International data transfers

Some of the providers listed in the previous section may process data outside the European Economic Area. In that case, transfers are covered by the safeguards of Chapter V GDPR, such as European Commission adequacy decisions or standard contractual clauses.

12. Data protection officer

Light Funnels Services SL has appointed OZONIA Consultores SL as its data protection officer. You may contact the data protection officer about any matter relating to the processing of your personal data by writing to info@climadent.com.