Privacy Policy

Agentlyx AI LLC ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share your information when you use our services, including AI-powered booking assistants, automated scheduling, and customer interaction tools.

1. Information We Collect

We may collect the following categories of information:

a) Personal Information

• •Name
• •Email address
• •Phone number
• •Appointment / booking details

b) Business Information

• •Business name
• •Location
• •Service offerings
• •Schedules and availability

c) Usage and Operational Data

• •Interaction logs
• •Chatbot and/or voice assistant transcripts
• •Device/browser metadata
• •Platform usage events and technical logs

2. How We Use Your Information

We use your information to:

• •Provide, operate, and improve our AI-powered services
• •Process appointments and manage business calendars
• •Send service-related communications and updates
• •Analyze usage patterns to improve our platform
• •Ensure security and prevent fraud/abuse
• •Comply with legal and regulatory obligations

3. Our Roles in Data Processing (Controller / Processor)

Agentlyx AI LLC may act in different roles depending on the context in which personal data is processed:

• •As a Data Controller (or equivalent role under applicable law), for data necessary to operate our business and platform, such as commercial account administration, billing, support, security, and compliance.
• •As a Data Processor (or equivalent role under applicable law), when we process personal data on behalf of our business customers (for example, clinics, dental practices, or other businesses) in connection with automated customer interactions, scheduling, messaging, and related services.

When we act as a Data Processor, we process personal data in accordance with our customer's instructions and the applicable contract, including a Data Processing Agreement (DPA), where applicable.

4. Information Sharing

We may share your information in limited circumstances:

• •With your explicit consent
• •To comply with legal obligations, regulatory requests, or court orders
• •With trusted service providers that support our operations (for example, infrastructure, messaging, communications, and support services), subject to contractual safeguards and appropriate security measures
• •In connection with a merger, acquisition, reorganization, or transfer of business, with notice when legally required or reasonably possible

5. Data Security

We implement reasonable technical and organizational security measures consistent with industry practices, which may include:

• •Encryption in transit and, where applicable, at rest
• •Access controls and authentication mechanisms
• •Security monitoring and audits
• •Secure data storage, backups, and recovery measures
• •Internal security and confidentiality policies

No system is completely secure. While we use reasonable safeguards, we cannot guarantee absolute security.

6. Your Rights

Depending on applicable law, you may have the right to:

• •Access your personal information
• •Request correction or updates
• •Request deletion of your personal information
• •Object to or restrict certain processing
• •Request data portability
• •Opt out of marketing communications
• •File a complaint with a relevant data protection authority

If your data was collected or processed through one of our business customers (for example, a clinic or dental practice), we may need to coordinate your request with that customer, who may act as the data controller.

7. Data Retention

We retain information for as long as reasonably necessary to:

• •Provide the Services
• •Comply with legal, accounting, or regulatory obligations
• •Resolve disputes
• •Enforce agreements
• •Protect the security and integrity of our platform

8. Contact Us

For privacy-related questions or requests, contact us at:

9. Updates to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes via email or through our platform when appropriate. Continued use of our services after the effective date of an updated policy constitutes acceptance of the revised policy.

10. Annex — Argentina-specific Provisions

The following provisions apply to users and customers located in the Argentine Republic, complementing the global policy above. They reflect the registration of our databases with the National Registry of Personal Databases (RNBD) under the Agency for Access to Public Information (AAIP).

10.1 Responsible Party in Argentina

For users and customers located in Argentina, the local Responsible Party (Responsable del Tratamiento) for data processing is:

• •Gonzalo Javier Mattar (natural person)
• •CUIT: 20-31251106-2
• •Domicile: Olazábal 3650, Floor 12, Belgrano, Ciudad Autónoma de Buenos Aires (Comuna 13), Argentina
• •Phone: +54 11 4534-4565
• •Email: info@agentlyx.ai

10.2 Sensitive Health Data

When the Services are provided to clinics, we may process sensitive health data including allergies, clinical history, dental odontogram, digital prescriptions, and diagnoses (Article 7, Law No. 25.326). These data are subject to reinforced security measures and to a minimum retention period of 10 years counted from the last clinical interaction (Article 18, Law No. 26.529).

10.3 Disclosed Processors and Recipients

We share personal data with the following processors and recipients under contracts that include data protection clauses:

• •Meta Platforms Ireland Ltd. (Ireland) — WhatsApp Business API for operational communications (appointment reminders, digital prescriptions, signing OTP).
• •Amazon Web Services Inc. (United States) — secure storage of clinical files and signed prescription PDFs in S3, plus transactional email delivery via SES.
• •Mercado Pago S.R.L. (Argentina) — processing of payments for clinical services.
• •Validating platform registered with ReNaPDiS (Argentina) — registration and verification of digital prescriptions for dispensing at authorized pharmacies.

10.4 International Transfers

Some processors operate outside Argentina (United States, Ireland). These transfers are protected by contracts with standard data protection clauses pursuant to Article 12, Section 2 of Law No. 25.326.

10.5 Specific Retention Periods (Argentina)

• •Patient data and digital prescriptions: minimum 10 years counted from the last clinical interaction (Article 18, Law No. 26.529).
• •Healthcare professional data: throughout the contractual relationship + 10 years following termination.
• •System user data (administrators, staff): while the account is active + 5 years following deactivation for audit purposes.
• •Commercial / billing data: 10 years pursuant to the applicable accounting regime.

10.6 Argentine Legal Framework

In the Argentine Republic our activities are governed by: Law No. 25.326 (Protection of Personal Data), Law No. 26.529 (Patient Rights), Law No. 25.649 (prescription by generic name / active ingredient), Law No. 27.553 and Decrees No. 98/2023 and No. 345/2024 (electronic and digital prescriptions). The competent supervisory authority is the Agency for Access to Public Information (AAIP).

10.7 Registration with the National Database Registry

Our databases (Patients, Digital Prescriptions, Healthcare Professionals, System Users) are registered, or in the process of registration, with the National Registry of Personal Databases (RNBD). The corresponding registration numbers will be published in this section as soon as the certificates issued by AAIP are received.

10.8 Digital Prescriptions (Receta Digital)

Digital prescriptions are issued in accordance with Law No. 27.553 and Decree No. 345/2024. The healthcare professional's electronic signature is performed via a one-time code (OTP) delivered through WhatsApp. The prescription is registered with a validating platform inscribed in ReNaPDiS to enable dispensing at any authorized pharmacy. Pursuant to Decree No. 345/2024, any pharmacy authorized in the country may access the prescription, irrespective of whether it belongs to the financier's network.

10.9 Exercising ARCO Rights in Argentina

To exercise your rights of access, rectification, cancellation, or opposition (ARCO), you may contact us by email at info@agentlyx.ai, in writing at our domicile, or in person at the clinic that provides you services. Identity verification by DNI is required; if a copy is requested, only the front of the document will be processed, with the procedure number and barcode anonymized. Response times: 10 calendar days for access (Article 14, Law No. 25.326) and 5 business days for rectification, cancellation, or opposition (Article 16). The exercise of these rights is free of charge.

11. Google API Services Disclosure

Scope of this Section. This Section 11 governs the data Agentlyx receives from Google APIs (referred to as "Google user data") and supersedes any conflicting provision elsewhere in this Privacy Policy with respect to Google user data only.

Agentlyx integrates with Google Calendar to allow professionals to synchronize their Agentlyx appointment bookings with their personal Google Calendar. The integration is opt-in and is initiated by the professional from the Agentlyx admin panel. When a user connects their Google account through OAuth, we request the following scopes:

• •https://www.googleapis.com/auth/calendar.events — to create, update, and delete calendar events in the user's selected Google Calendar that correspond to appointments booked through Agentlyx.
• •https://www.googleapis.com/auth/calendar.readonly — used solely to retrieve the list of calendars the user has write access to, so they can choose which calendar Agentlyx should write events into. We do not read, store, or process event data, attendees, descriptions, or any other event content from any calendar.
• •https://www.googleapis.com/auth/userinfo.email — to identify which Google account is connected to which Agentlyx professional account.

Limited Use of Google User Data

Agentlyx's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google user data:

• •is used only to provide or improve the Google Calendar synchronization feature that is prominently visible within the Agentlyx user interface;
• •is never used or transferred for advertising, including personalized, retargeted, or contextual advertising;
• •is never sold to third parties or data brokers;
• •is never transferred to any third party, except (a) to subprocessors strictly necessary to operate the Calendar synchronization feature (currently our infrastructure provider hosting the encrypted database), under contractual confidentiality and security obligations, (b) to comply with applicable law, regulation, legal process, or enforceable governmental request, or (c) as part of a merger, acquisition, or sale of assets, with prior notice to affected users and continued protection of their data;
• •is never used to develop, improve, train, or fine-tune generalized or non-personalized artificial intelligence or machine learning models;
• •is never read by humans, except (a) with the user's explicit, opt-in consent for a specific support request initiated by the user, (b) as strictly necessary to investigate a security incident or abuse, or (c) to comply with applicable law.

Data Storage and Retention

We store the OAuth refresh token and access token encrypted at rest (AES-256-GCM) in our PostgreSQL database, along with the user's connected Google account email address and the calendar ID the user chose for synchronization. We do not store event content, attendee information, calendar metadata beyond the chosen calendar ID, or any other Google user data. These tokens and identifiers are retained only as long as the user keeps the integration connected.

Revoking Access

Users can revoke Agentlyx's access to their Google account at any time by:

• •Clicking "Disconnect Google Calendar" in the professional settings within the Agentlyx admin panel, or
• •Visiting https://myaccount.google.com/permissions and removing Agentlyx from the list of connected apps.

When access is revoked through either method, the corresponding OAuth tokens, the connected email address, and the stored calendar ID are deleted from our systems within 30 days. We also stop creating, updating, or deleting events in the user's Google Calendar immediately upon revocation.