Privacy Policy

1. Data controller

Villar JA Data y Tecnología SRL ("FluxyMed", "we", "our") is the controller responsible for the personal data collected through the FluxyMed clinical operations platform.

We operate in accordance with Dominican Republic Law No. 172-13 on Personal Data Protection and other applicable regulations.

2. Data we collect

We collect different categories of data depending on the user role inside the medical center.

• Administrators and clinical staff: name, email, role, and assigned branch.
• Patients: name, date of birth, guardian details, medical history, studies, and clinical notes.
• Billing data: tax information such as RNC and NCF where required for DGII compliance.
• Usage data: access logs, audit trails, and actions performed inside the platform.

3. Purpose of processing

We use personal data only to operate the contracted service and meet legal obligations.

• Run the day-to-day clinical operations workflow.
• Generate and submit DGII electronic tax receipts (e-CF).
• Support patient communication through WhatsApp when enabled by the customer.
• Maintain security, auditing, and regulatory compliance.
• Provide technical support and customer service.

4. Legal basis

Processing is based on the service agreement signed between FluxyMed and the customer medical center.

We also process data to comply with legal obligations, including Dominican tax regulations and DGII requirements.

5. Storage and security

Data is stored using Supabase infrastructure on PostgreSQL in the us-east-1 region.

We apply encryption in transit, encryption at rest, strengthened administrative access, and Row Level Security policies to isolate each clinic data set.

6. Data sharing

We do not sell personal data and only share it with third parties when operationally necessary.

• DGII: for compliant tax receipt submission through the applicable fiscal provider or integration.
• Meta (WhatsApp Business): for patient messaging when the WhatsApp assistant is enabled.
• Supabase and infrastructure providers: for hosting, database, and technical services required to operate the platform.

7. Data subject rights

Under Law 172-13, data subjects may request access, rectification, objection, update, or deletion of their personal data when applicable.

To exercise these rights, contact legal@fluxymed.com.

8. Data retention

We retain data during the life of the service agreement and for up to 5 additional years when required for tax, legal, or audit purposes.

9. Changes to this policy

We will notify material changes at least 30 days in advance using the administrator email registered by the medical center.

10. Contact