Draft pending review by a lawyer. This text describes what the product does today; it is not legal advice and may change before final publication.
The list of providers that receive personal data to run the platform: what for, what data, in which country, and whether they can receive health data.
1 · 1. What this page shows
Tsunami Automation Global LLC uses providers to run Soluciones para Doctores. This page lists them. For patient data, the clinic is the controller and Tsunami Automation Global LLC is the processor. The providers on this list receive data on our behalf.
The list has four groups: active providers, providers used only in certain cases, our own infrastructure, and providers that are not active today.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 2, fr. XII y XIV; Reglamento de la LFPDPPP (2011), arts. 49 a 55
2 · 2. Active providers
| Provider | Purpose | Data it receives | Country | Can it receive health data? |
|---|---|---|---|---|
| Cloud infrastructure provider (European Union) | Hosting of the application, the database and backups. | All platform data. Patient personal data (name, email, phone, notes) and message text are stored with field-level encryption. | Germany (Nuremberg) | Yes, it may receive it |
| AI language-model providers | Language models for the AI receptionist: draft replies and transcribe WhatsApp voice notes. | The patient's message, up to 12 earlier turns of the conversation, the patient's name, clinic data (services, hours, policies) and, for voice notes, the audio. The message may contain health information the patient chooses to write. | United States | Yes, it may receive it |
| Voice-agent provider | Voice agent (receptionist phone calls), with its language model. The provider keeps the audio and transcript until they are deleted. You can ask for their deletion (ARCO section). | Audio and transcript of calls with the voice agent, the patient's phone number and name on outbound calls, and the data the agent collects (name, reason for visit, urgency). | United States | Yes, it may receive it |
| Telephony and messaging provider | Alert calls and messages to clinic staff; WhatsApp channel for some clinics. | Phone number, message text and, in staff alerts, the patient's name and the general reason (urgency, appointment). | United States | Yes, it may receive it |
| WhatsApp Business platform provider | Sending and receiving WhatsApp messages between clinic and patient. | Phone number and message text. | United States | Yes, it may receive it |
| Transactional email provider | Sending transactional email (sign-in links, invitations, notices and reminders). | Email address, subject and message content; in staff alerts, the patient's name and channel. | International provider | No |
| Cloudflare, Inc. | Domain name service (DNS). | DNS queries. It does not receive application content. | Global | No |
| Backup storage (European Union) | Database backups. | Copy of the database (sensitive fields encrypted). | Germany (exact location to be confirmed) | Yes, it may receive it |
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 35
3 · 3. Providers used only in certain cases
| Provider | Purpose | Data it receives | Country | Can it receive health data? |
|---|---|---|---|---|
| Google LLC (Google Analytics) | Measuring visits to the public pages of the site. Only active if you accept analytics cookies. | IP address, browser type, cookie identifier and pages visited (without query strings or long identifiers). It is never loaded in the patient portal, on token links or inside the application. | United States | No |
| Google LLC (Google Calendar) | Optional synchronisation of appointments with the clinic's calendar. Only if the clinic connects its calendar. | Appointment title with the patient's name, service, appointment notes and time. | United States | Yes, it may receive it |
| Stripe, Inc. and Mercado Pago | Payments and subscriptions, when a clinic or plan uses them. Online payments are only active for clinics that enable them. | Payer email, amount, reference and organisation. We neither receive nor store the full card number. | United States; Mexico and Latin America | No |
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 35
4 · 4. Our own infrastructure
These services run on our own servers in Germany. They are not third parties.
| Provider | Purpose | Data it receives | Country | Can it receive health data? |
|---|---|---|---|---|
| Appointment booking engine (our own instance) | Appointment booking engine. Operated by us on our own infrastructure; it is not a third party. | Patient name, email or phone and appointment notes. | Germany (own servers) | Yes, it may receive it |
| Technical error log (our own instance) | Technical error logging. Not a third party. | Technical error information, without personal data by configuration. | Germany (own servers) | No |
5 · 5. Providers that are not active today
We list them so you know what could happen. Today they receive no data. If we switch them on, we update this list first.
| Provider | Purpose | Data it receives | Country | Can it receive health data? |
|---|---|---|---|---|
| Message safety review service | Message classification to detect emergencies and opt-outs. Currently switched off on the platform. If it is switched on, we will update this list first. | Text of the patient's message with identifiers masked, and the last 2 turns. | United States | Yes, it may receive it |
6 · 6. Artificial intelligence
The AI receptionist sends its language-model provider the patient's message, up to 12 earlier turns of the conversation, the patient's name and the clinic's data. For a WhatsApp voice note, it also sends the audio for transcription. The voice agent has its own language model inside its provider.
This happens before the emergency rules check the message. The rules can replace the reply, but the model provider has already received the text. So a patient should not write detailed health data in the chat.
We do not use personal data to train our own models. Each provider applies its own terms on how long it keeps the data it receives and how it uses it.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 26, fr. II
7 · 7. International transfers
Part of the data leaves Mexico. Hosting and backups are in Germany. The other providers handle data mainly in the United States. The email provider is an international provider.
The law says that whoever receives personal data takes on the same duties as whoever hands it over. We formalise this with each provider's terms of service. Transfers needed for prevention, diagnosis or medical care, or to manage health services, do not need consent.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 35; LFPDPPP (DOF 20-mar-2025), art. 36, fr. II; Reglamento de la LFPDPPP (2011), arts. 74 a 76
8 · 8. How we tell you about changes
If we add or change a provider, we update this page and its version. Before we add a provider that receives patient data, we tell the clinics. Patients can see the current list here.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 15
9 · 9. What each clinic decides
Clinics can use services on their own. For example, staff can paste links to images they uploaded to an image-hosting service, and the clinic can connect its own calendar. Those decisions, and the data sent to those services, are the clinic's responsibility, and the clinic must state them in its privacy notice.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 13
10 · 10. Your rights
If you want to know which provider received your data, or ask for its deletion, use the route in your privacy notice (/privacidad) or write to privacy@tsunamiautomation.com. To ask for data held by a provider to be deleted, see /legal/conservacion-eliminacion.
Legal basis: LFPDPPP (DOF 20-mar-2025), arts. 21 a 26
11 · 11. Version
Version 2026-10. Planned effective date: 2026-11-01. Data-processing agreement with clinics: /legal/contrato-encargo.