Privacy policy

1. Who is the controller

• Data controller: Enrique Rodríguez Marty
• Registered address: Calle Corazón de María 5, esc. 1, planta 2, puerta B, 28002 Madrid, Spain
• Contact email: contact@darcemi.com

Darcemi is an appointment-management platform for businesses with premises (clinics, veterinary practices, hair salons, workshops, studios and similar), available at darcemi.com and on each client company's subdomain.

2. Two distinct roles, depending on whose data it is

This distinction is the key to understanding the rest of the document.

Darcemi is the controller of the data of the businesses that contract the service and of the people who use the administration panel: sign-up, billing, support, account security.

Darcemi is the processor of the data of the end customers (patients, users, the business's customers) that each business enters or generates on the platform. In that case the controller is the client business, which decides what data it collects and why. Darcemi only processes it following their instructions and under the data-processing agreement signed with them.

If you are an end customer of a business that uses Darcemi and want to exercise your rights, contact that business. If you contact us, we will forward your request to the controller.

3. What data we process

Of client businesses and their panel users: first and last name, email address, password (stored hashed, never in plain text), role and permissions, business details (name, address, phone, hours, services, professionals), billing data and activity and access logs.

Of end customers, on behalf of the business: name, phone, email if provided, appointment history, notes the professional records and the content of the conversations held over WhatsApp with the business.

Technical data: IP address, browser type, date and time of access and session identifiers, for security and abuse-prevention purposes.

4. Your Google account data

When you sign in with Google or connect your calendar, Darcemi requests the following permissions and only for what is stated:

Limited Use. Darcemi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We do not sell Google user data to third parties.
• We do not use it for advertising or to build advertising profiles.
• We do not use it to train generalized or third-party artificial-intelligence models.
• We do not transfer it except to the providers strictly necessary to deliver the service (section 7), to comply with the law or with your express consent.
• No human reads it, unless you give us explicit permission for support cases, it is necessary for security or to comply with the law, or the data is aggregated and anonymized.

You can revoke access at any time from myaccount.google.com/permissions. When you revoke it, we stop syncing the calendar and delete the stored tokens; appointments already created in your Google Calendar remain under your control.

5. Why we process the data and on what legal basis

6. How long we keep it

For as long as the contract is in force. When it ends, the client business's data is kept for 30 days for its full export and then deleted, except for what the law requires to be kept (billing: six years under the Commercial Code). If the export has not been delivered within that period, the data is not deleted until it is: a history nobody has taken is not destroyed. Security logs are kept for 12 months.

Requests received through the website form are kept for 12 months from receipt and then deleted.

7. Who we share data with

We do not sell data. We rely on the following providers, all with a data-processing agreement:

We also disclose it to public authorities when there is a legal obligation.

About Groq: the WhatsApp assistant needs a language model to understand messages written in the customer's own words, and today Groq provides it. It cannot be switched off separately: if the client business does not use the assistant, nothing is sent. For each message the assistant has to interpret, we send the end customer's text (up to 500 characters); if the last thing they received was an automated message, that message, cut to 500 characters and without their name —it may include the date, time, service and professional of their appointment—, and never one written by the client business's staff nor a reminder or notice sent as a WhatsApp template; the step the conversation is at, and whether or not they have an upcoming appointment. When a person is already handling the conversation, a message that may describe a symptom is still sent, solely to assess whether it is urgent, with the step the conversation is at and whether they have an upcoming appointment, without any earlier message. When the message is a question and the client business has active FAQs, a second call sends that same text and the questions of those FAQs (up to 25, without their answers) to choose which one answers it; the questions are written by the client business about its business and are not personal data. If the client business uses “Import” in its FAQs, the content it provides —its website, a text or a PDF, up to 12,000 characters— is sent to suggest drafts. Their phone number, record, histories and files are not sent, but since end customers write whatever they want, the text may contain health data, such as an ailment. Groq processes it in the USA as a sub-processor, under the European Commission's standard contractual clauses incorporated in its data processing addendum, and under its terms does not retain request content except for temporary logs of up to 30 days to troubleshoot incidents or investigate abuse.

8. International transfers

Some providers process data outside the European Economic Area. In those cases the transfer relies on the standard contractual clauses approved by the European Commission and, where applicable, on the EU–US Data Privacy Framework.

9. Your rights

You can exercise the rights of access, rectification, erasure, objection, restriction, portability and not to be subject to automated decisions by writing to contact@darcemi.com, proving your identity. We will respond within a maximum of one month.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

10. Security

We encrypt traffic with TLS, store passwords hashed with bcrypt, isolate each client business's data by client identifier in every query, apply role-based access control, limit sign-in attempts and log administrative actions.

No system is invulnerable. If a breach occurs that poses a high risk to your rights, we will notify you and report it to the AEPD within 72 hours of detecting it.

11. Minors

Darcemi is aimed at businesses. We do not create panel accounts for people under 18. If a client business records data of minors as end customers, it is that business that must obtain the consent of the holders of parental authority.

12. Cookies

We only use first-party cookies, technical or preference ones, that the website and the panel need in order to work. They are the following:

None of them is used to track you across other sites. We do not use analytics or advertising cookies today, neither our own nor third-party ones. If we ever did, we would ask for your consent before setting them and say so in this policy.

13. Changes to this policy

If we change this policy, we will publish the new version at this same address and update the date in the header. If the change is substantial, we will notify client businesses by email at least 30 days in advance.