Terms and conditions for clinics and professionals

1 · 1. Who we are and what you accept

These terms are an agreement between you (the clinic, practice or health professional that signs up, “the clinic”) and Tsunami Automation Global LLC, which operates Soluciones para Doctores (“we”). Our address is 5900 Balcones Drive STE 100, Austin, TX 78731, United States.

You accept these terms when you create the account or click “I accept”. The person who accepts states that they have authority to bind the clinic.

These terms work together with other documents that are also part of the agreement: the data processing contract (/legal/en/contrato-encargo), the payments and subscriptions page (/legal/en/pagos-suscripciones), the list of subprocessors (/legal/en/subencargados) and the security page (/legal/en/seguridad). For the clinic’s own data as our customer, our privacy notice (/privacidad) applies.

Legal basis: Código de Comercio, arts. 89, 89 bis y 93

2 · 2. The service

Soluciones para Doctores is an online platform for private clinics. Depending on the plan you choose, it includes online scheduling and booking, an AI receptionist on WhatsApp, voice and web, reminders, intake forms, a patient portal and a conversation inbox.

The features you get depend on your plan and on what you switch on in your account. Plans are listed at /precios. We may improve or change features. If a change removes an important feature from your plan, we tell you first (section 15).

3 · 3. What the service is not

Soluciones para Doctores is an administrative tool. It does not provide medical services and it does not replace the judgment of a health professional.

• The AI receptionist books, confirms, reminds, answers questions about the clinic (hours, services, policies) and collects intake data. It does not give medical advice and it does not diagnose.
• If a patient writes something urgent or clinical, the system gives emergency guidance (call 911 or go to an emergency room) and hands the conversation to the clinic’s team. The patient can ask to talk to a person at any time.
• The AI can make mistakes. The system applies safety rules, but they are not perfect. Your team must review the inbox and act on escalation alerts.

The clinic stays responsible for: its clinical decisions; its clinical record (NOM-004-SSA3-2012 requires keeping it at least 5 years from the last medical act); its privacy notice; its patients’ consents; and its advertising. We do not promise that using the platform is enough to meet those rules.

Legal basis: NOM-004-SSA3-2012, numeral 5.4; Ley General de Salud, arts. 300, 305 y 306

4 · 4. Account, users and roles

The account owner can invite the team and assign roles (for example owner, administrator, professional, front desk and billing). Each person uses their own access. Do not share passwords or sign-in links.

• The clinic is responsible for what its users do on the platform and for removing access from people who leave the team.
• You sign in with a link sent to your email (it expires in 20 minutes) or with a password. Two-step verification is available in your account settings. We recommend turning it on, especially for owners and administrators.
• Sessions close when idle (after 7 days) and last at most 30 days.
• You state that you and the professionals in your clinic hold a valid professional degree and licence (cédula) where the law requires one to practise.
• Tell us at once if you think someone entered your account without permission.

5 · 5. Acceptable use

You may not use the service to:

• carry out illegal activity, fraud or pretending to be another person;
• send unsolicited messages or promotions to patients who did not opt in (section 8);
• give medical advice, prescriptions or diagnoses through the automated assistant;
• try to reach other clinics’ data, bypass security controls, run intrusion tests without our written permission or overload the system;
• resell the service or use it to build a competing product;
• publish false or misleading information on your public profile.

If you publish a profile or adverts for health services, you are responsible for making them truthful and for following the health-advertising rules. For example, a professional who advertises must state the institution that issued their degree and their licence (cédula) number.

If there is serious abuse or a security risk, we may suspend access. When possible, we tell you first and give you time to fix it.

Legal basis: Reglamento de la Ley General de Salud en materia de Publicidad, arts. 6, 7 y 19

6 · 6. Prices and payments

Prices, recurring charges, invoicing, cancellations and refunds are explained at /legal/en/pagos-suscripciones. That page is part of these terms.

Legal basis: LFPC, art. 7 Bis; art. 76 Bis fr. VIII y IX

7 · 7. Who is responsible for patient data

For your patients’ data, the clinic is the controller (responsable) and Tsunami Automation Global LLC is the processor (encargada). We process that data only to give you the service and on your instructions. The data processing contract (/legal/en/contrato-encargo) gives the details.

For our own data we are the controller: clinic users, site visitors, prospects, the clinic directory and billing contacts. Our privacy notice (/privacidad) explains them. If your clinic appears in the directory with public contact details, you can ask us to correct or remove them by writing to privacy@tsunamiautomation.com.

To draft replies, the AI receptionist sends the text of the patient’s message (and recent turns of the conversation) to a language-model provider in the United States. That text can include health information the patient chooses to write. Your privacy notice must say so. The list of providers is at /legal/en/subencargados.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 2 fr. XII y XIV; art. 13; art. 53; Reglamento de la LFPDPPP (2011), arts. 49 a 55

8 · 8. Your privacy notice and your patients’ consents

Before collecting a patient’s data, the clinic must give the patient its own privacy notice. If the notice is given by electronic means, it must at least be the short version that states the clinic’s identity, the data processed (marking sensitive data), the purposes (separating those that need consent) and the options to limit use.

Health data is sensitive data. It needs the patient’s express consent, in writing or with an electronic signature or an authentication mechanism. The platform offers this in the intake form: a required checkbox with a fixed text. It records the date, the version of the accepted text, the IP address and the device. The clinic must keep proof of its patients’ consent.

• The checkbox is a tool. The clinic decides whether it is enough for its case. If the clinic collects data outside the platform (at the front desk, by phone or on paper), consent is the clinic’s own task.
• Advertising and promotions may only be sent to people who ticked the marketing checkbox. That checkbox is separate, optional and does not affect care. The platform records it. A person who replies BAJA, ALTO or STOP on WhatsApp stops receiving messages and must not be contacted through that channel.
• For patients who are minors, consent is given by a parent or guardian. The clinic must check this.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 7, art. 8, art. 15, art. 16, art. 26; Reglamento de la LFPDPPP (2011), arts. 19 y 20; Lineamientos del Aviso de Privacidad (2013)

9 · 9. WhatsApp, voice and other channels

The WhatsApp channel runs on Meta’s WhatsApp Business platform (for some clinics, through a telephony provider). The clinic must follow Meta’s business terms and policies. Among other things, it may only write to patients who agreed to receive its messages. Meta may limit or suspend a number. We do not control that decision and we do not guarantee that every message is delivered.

Calls with the voice agent may be recorded and transcribed by our voice provider, which keeps the audio and the transcript until they are deleted. The platform lets you put a recording notice in the call greeting. Turning it on is your responsibility. If you need recordings deleted, write to us.

The platform’s emails (sign-in links, invitations, alerts and reminders) are sent through an email provider.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 15 y art. 35

10 · 10. Third-party services the clinic chooses

Some features use services that you choose and that we do not control. Examples: the link to an image for a photo or a lab result (the image stays in the service you pick), or the connection to your Google calendar.

• If you connect a calendar, the appointment title with the patient’s name, the service, the notes and the time are sent to that calendar.
• The clinic is responsible for choosing services that are suitable for health data and for telling its patients.
• We are not responsible for failures, changes or charges of those services.

11 · 11. Availability and backups

We make reasonable efforts to keep the service available. We do not guarantee an availability percentage. When we can plan maintenance, we announce it first by email or inside the application.

Some parts depend on third parties (WhatsApp, the language-model provider, the voice provider, email). If they fail, the service may fail or respond more slowly.

We back up the database (daily copies kept for 31 days and copies outside the main server every 6 hours). Backups are not a promise that information will never be lost. Always keep the original of the documents you upload.

12 · 12. Your data, export and ending the service

The data the clinic puts on the platform stays the clinic’s. You can export the patient list from the application. If you need other data, ask us.

You can end the service at any time: from your account settings or by writing to support@tsunamiautomation.com or billing@tsunamiautomation.com. Before you end it, export what you need. The duty to keep the clinical record belongs to the clinic.

When the service ends, we deliver an export if you ask for one and we delete the clinic’s data within at most 30 calendar days from your closing request. This is a manual procedure. Backups stop containing the data when they are replaced by newer copies (up to 31 days). We keep only what the law requires us to keep, such as our own invoicing records (5 years).

We may end the service if you seriously breach these terms and do not fix it within 15 calendar days of our notice. If there is a security risk or an authority order, we may act sooner.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 10, art. 12, art. 24; NOM-004-SSA3-2012, numeral 5.4; Código Fiscal de la Federación, art. 30

13 · 13. Liability

We are responsible for damage we cause through our fault or by breaching these terms or the data processing contract. Our total liability to the clinic is limited to the amount the clinic paid us in the 12 months before the event. This limit does not apply to wilful misconduct or fraud, or to anything the law does not allow to be limited.

We are not responsible for clinical decisions, for content the clinic uploads, for decisions of a third party (such as Meta or an email provider), or for indirect losses such as profit you did not make.

The clinic keeps us harmless from third-party claims caused by its own breach: clinical care, lack of a privacy notice or consents, or content that infringes the rights of others. You tell us promptly, let us help with the defence and do not settle without talking to us. This commitment is limited to what that breach caused.

If the clinic is a consumer under the LFPC, its rights that cannot be waived do not change because of these terms. A lawyer must decide how the LFPC applies to professional customers (art. 2 fr. I).

Legal basis: LFPC, art. 2 fr. I; art. 90 fr. I y II; LFPDPPP (DOF 20-mar-2025), art. 53

14 · 14. Governing law and courts

These terms are governed by the laws of Mexico. Before going to court, we try to settle the dispute in writing for 30 days. If it is not settled, the parties submit to the competent courts of Mexico City and waive any other venue they might have, unless the law does not allow that waiver.

Data subjects keep their right to go to the data protection authority, which today is the Secretaría Anticorrupción y Buen Gobierno.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 2 fr. XV; arts. 38 y 39

15 · 15. Changes to these terms

We may change these terms. We tell you at least 30 days ahead, by email to the account owner and inside the application. A change applies going forward.

If you do not agree, you can cancel before the effective date with no penalty. If a change is needed because of a law or an authority order, it may apply sooner and we tell you as soon as we can.

Legal basis: LFPC, art. 90 fr. I

16 · 16. Contact

• Support: support@tsunamiautomation.com
• Privacy and personal data: privacy@tsunamiautomation.com
• Billing and payments: billing@tsunamiautomation.com
• Address: 5900 Balcones Drive STE 100, Austin, TX 78731, United States