Privacy Policy for CitaMente

Effective Date: August 6, 2025 Last Updated: July 26, 2026

1. Introduction

CitaMente (“we,” “our,” or “us”) is committed to protecting your privacy and processing your personal data in compliance with Colombia’s data protection framework (Ley 1581 de 2012 and Decreto 1377 de 2013). By using our Service, you confirm that you have read, understood, and agreed to this Privacy Policy.

Your use of the Service is also governed by our Terms of Service, which describe what the Service does, its limitations, and your responsibilities.

1.1 Scope and Applicable Law

This policy governs all personal data processing carried out in Colombia or by entities domiciled in Colombia, under the supervision of the Superintendencia de Industria y Comercio (SIC).

2. Information We Collect

2.1 Personal Information

We collect:

Authentication Information: Email, user ID, tokens.
Medical Appointment Data: Doctor names, specialties, dates/times, locations, instructions, authorization numbers, and related notes. Each appointment also records the timezone of the device that created it, so that reminders are sent at the correct local time.
User-Generated Content: Text, audio, and images you provide to capture appointments. This content is sent to third-party AI services to transcribe audio and extract appointment details (see Section 9).
Family Group Information: The family group you belong to, your display name within it, and which member each appointment is assigned to or accompanied by.
Push Notification Tokens: A device token issued by Firebase Cloud Messaging, used to deliver appointment reminders to your device. Tokens are removed when you sign out or delete your account.
Record of Consent: Which version of our Terms of Service and this Privacy Policy you accepted, and when. We keep this to evidence your authorization and to know when to ask you again after a material change.

2.2 Technical Information

Device Information: Device type, OS version, app version, identifiers.
Usage Analytics: Feature interactions, session duration, error logs. These are associated with your user ID and email address (see Section 9).
Performance Data: Crash reports and performance metrics, associated with your user ID (see Section 9).

2.3 Permissions and Data Access

We request: microphone, camera, storage, and internet access solely for Service functionality.

We process your personal data only with your prior, express, and informed consent (“autorización previa, inequívoca e informada”). You may withdraw consent at any time via the app’s settings.

3.2 Lawful Purposes

All processing adheres to the principles of legality, purpose limitation, freedom (consent), accuracy, transparency, security, and confidentiality.

4. Roles and Responsibilities

Responsable del Tratamiento: The operator of CitaMente, contactable at scarkov.dev@gmail.com. The Responsable decides on the purposes and means of processing and is the party to whom you address the requests described in Section 6.

Encargados del Tratamiento: The service providers listed in Section 9, which process personal data on our behalf and under our instructions.

Data you enter about others: When you record an appointment for another member of your family group, you are responsible for having their authorization to do so, as set out in our Terms of Service. We process that data as Responsable on the basis of the authorization you confirm you hold.

5. Privacy Notice (“Aviso de Privacidad”)

We provide a clear Privacy Notice at first contact and within the app, detailing: identity of the Responsable, purposes, data categories, legal bases, retention periods, and channels to exercise rights.

6. ARCO Rights and Procedures

6.1 Rights of Data Subjects

You may exercise the rights of Access, Rectification, Cancellation, and Opposition (ARCO) regarding your personal data.

6.2 Response Times

Consultas: We will respond within 10 business days of receiving your request.
Reclamos: We will address and respond to complaints within 15 business days.

7. Data Retention

We retain personal data only as long as necessary to fulfill the purposes stated here, or as required by law. Specific retention periods for each data category (e.g., appointment records: account active + 1 year) are documented in our internal retention schedule.

8. Data Security and Breach Notification

All data is encrypted in transit (SSL/TLS).
Authentication sessions and tokens are stored in the device’s secure storage (Keychain on iOS, encrypted storage on Android). Data held by our backend providers is stored using their encryption-at-rest mechanisms.
We implement technical and organizational measures to safeguard data.
In the event of a security incident affecting your personal data, we will notify affected data subjects without undue delay and will report to the competent data protection authority (the Superintendencia de Industria y Comercio, SIC) where required by applicable law.

9. International Data Transfers and AI Processing

To provide the Service, we transfer certain personal data — including the audio recordings, images, and text you submit, and the medical appointment data extracted from them — to service providers located outside Colombia:

OpenAI (United States): processes your audio recordings, images, and text to transcribe speech and extract structured appointment information.
Supabase (United States): hosts our database, authentication, and backend functions.
Google Firebase Cloud Messaging (United States): delivers appointment reminders to your device. Receives your device push token and the content of the reminder, which includes appointment details such as the specialty, doctor’s name, time, and location.
Mixpanel (United States): product analytics. Receives your user ID and email address, together with records of which features you use. It does not receive the content of your appointments.
Sentry (United States): error and crash reporting. Receives your user ID along with diagnostic information about failures in the app.

These providers may process and store your data on servers outside Colombia. Under Article 26, literal (a), of Ley 1581 de 2012, we carry out these international transfers on the basis of your express and unequivocal authorization, which you provide by accepting this Privacy Policy and using the Service. The appointment-capture features cannot function without these transfers; if you do not consent to them, please do not use those features.

You may withdraw your consent at any time by discontinuing use of the affected features, deleting your account, or contacting us as described in Sections 3 and 6.

10. Children and Adolescents

The Service is intended for adults. You must be at least 18 years old to create an account. A person aged 14 to 17 may use the Service only with the authorization of a parent or legal guardian, who accepts our Terms of Service on their behalf and is responsible for the data entered.

We do not knowingly create accounts for children under 14. Where a parent or guardian records appointments for a minor as part of a family group, they do so as the person authorized to provide that consent. If you believe a minor has created an account without the required authorization, contact us at the address in Section 13 and we will delete it.

11. Internal Policy Manual

We maintain a Manual Interno de Políticas y Procedimientos detailing every aspect of data processing, security protocols, and authorized personnel, per article 18 (f) of Ley 1581.

12. Changes to This Policy

We may update this policy. Material changes will be notified via the app and by updating the “Last Updated” date. We record which version you accepted, so that we can ask you to review and accept a materially changed version.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: scarkov.dev@gmail.com

Note for Google Play Console: This privacy policy addresses the collection and use of personal data, including sensitive medical information, audio recordings, and images. The app uses AI services for data processing and stores information using cloud-based services. All required disclosures for app store compliance are included above.