Privacy Policy

AgentePro (operated by Agent Pro, "we", "us", or "our") provides a cloud-based software platform for clinics and healthcare businesses at https://agentepro.tech. Our Service includes a web dashboard for clinic staff and an AI-powered sales agent that communicates with patients and leads through messaging channels such as WhatsApp, helps qualify interest, and supports appointment booking and calendar integration.

This Privacy Policy describes how we collect, use, disclose, and protect personal data when you use the AgentePro website, dashboard, APIs, and related services (collectively, the Service). By using the Service, you agree to this Privacy Policy.

• Clinic customers and their staff — users who create accounts to manage clinics, leads, bookings, settings, and integrations.
• Patients and leads— individuals who contact a clinic through WhatsApp or other channels connected to AgentePro. In those cases, the clinic is typically the data controller for patient data, and AgentePro processes data on the clinic's behalf as a service provider.
• Website visitors — individuals who visit our public website or this privacy page.

Capitalized terms used in this policy have the meanings below. Singular and plural forms have the same meaning.

• Account — a unique account created for clinic staff to access the Service.
• Company — Agent Pro, operator of the AgentePro platform.
• Country — Brazil, where our primary operations are based.
• Personal Data — any information relating to an identified or identifiable individual.
• Service — the AgentePro website, dashboard, APIs, messaging integrations, booking features, and related tools accessible at https://agentepro.tech.
• Service Provider — a third party that processes data on our behalf to deliver the Service.
• You — the individual or organization using the Service.

Clinic staff and account data

• Email address and authentication credentials (via our identity provider)
• Clinic name, role, and tenant configuration
• Settings you enter in the dashboard (services, doctors, schedules, bot personality, business hours)
• Documents uploaded to the knowledge base, if enabled for your clinic

Patient and lead data (via messaging and booking)

• Phone number and WhatsApp identifier
• Message content (text and media metadata where applicable)
• Conversation state, language preference, and lead qualification context
• Appointment details (service, doctor, date and time)
• Satisfaction survey responses, when sent

Calendar and integration data

• Google Calendar connection tokens (stored in encrypted form) and calendar identifiers
• Availability and appointment events created or read through the integration
• WhatsApp / messaging provider configuration (e.g. phone number IDs, display numbers, access tokens)

Technical and usage data

• IP address, browser type, device information, and access times
• Server logs, error logs, and diagnostic data for security and troubleshooting
• Session and cache data used to operate conversations (e.g. short-term chat context)

When a clinic connects WhatsApp through AgentePro (including via Meta WhatsApp Business API or other messaging providers), we receive inbound messages sent to the clinic's connected number and may send automated replies on the clinic's behalf. Message content and phone numbers are stored in our systems to provide conversation history, lead management, booking, and human handoff when needed.

Messaging providers (such as Meta and Twilio) process data according to their own privacy policies and platform terms. We only use these integrations as necessary to deliver the Service to our clinic customers.

• Provide, operate, and maintain the Service
• Authenticate users and manage clinic accounts
• Run the AI conversation agent, qualify leads, and support appointment booking
• Sync availability and create calendar events when a clinic connects Google Calendar
• Send appointment reminders and satisfaction surveys when configured
• Monitor performance, prevent abuse, and resolve technical errors
• Comply with legal obligations and enforce our agreements
• Improve the Service through aggregated or anonymized analytics where appropriate

We use trusted providers to operate AgentePro, including:

• Supabase — authentication and database hosting
• OpenAI — AI-generated conversation responses
• Google — Calendar API for scheduling (when connected by a clinic)
• Meta — WhatsApp Business messaging (when connected by a clinic)
• Twilio — WhatsApp messaging (when configured)
• Cloud hosting and infrastructure — application and API hosting
• Redis / job queue — session cache and background tasks (reminders, follow-ups)

These providers process data only as needed to deliver their component of the Service and are subject to contractual and security obligations.

We may share Personal Data:

• With Service Providers listed above, to operate the Service
• With the clinic whose account is associated with a lead or patient conversation
• For business transfers (merger, acquisition, or asset sale), with notice where required
• When required by law, court order, or valid government request
• To protect rights, safety, and security of users, clinics, or the public
• With your consent or at your direction

We do not sell personal data.

We use cookies and similar technologies to authenticate users, remember preferences (such as language), and keep the Service secure. Essential cookies are required for login and core functionality. You can control cookies through your browser settings; disabling essential cookies may limit your ability to use the dashboard.

We retain Personal Data only as long as necessary for the purposes described in this policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

• Account data — for the duration of the account relationship, plus up to 24 months after closure where needed for support or legal purposes.
• Lead and message data— while the clinic maintains an active relationship with the lead and as configured by the clinic's use of the Service, unless deletion is requested or required by law.
• Server and security logs — typically up to 24 months.

When retention periods expire, we delete or anonymize data where feasible. Residual copies may exist in encrypted backups for a limited period.

Your information may be processed in Brazil and in other countries where our Service Providers operate. Where required by law, we use appropriate safeguards for international transfers.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of your Personal Data, and to withdraw consent where processing is consent-based.

Brazil (LGPD): If you are in Brazil, you may exercise rights under the Lei Geral de Proteção de Dados (LGPD), including confirmation of processing, access, correction, anonymization, portability, and deletion, subject to legal exceptions.

Clinic staff may update account information in the dashboard. For other requests, contact us using the details below. Clinics are responsible for handling patient data requests for their own patients where they act as data controller.

We use commercially reasonable technical and organizational measures to protect Personal Data, including encryption of sensitive integration tokens, tenant isolation in our database, and HTTPS in production. No method of transmission or storage is 100% secure.

The Service is not directed at children under 16, and we do not knowingly collect Personal Data from children under 16. If you believe a child has provided us data, contact us and we will take steps to delete it.

Our Service may link to third-party sites (e.g. Google, Meta). We are not responsible for their privacy practices. Please review their policies separately.

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. Material changes may be communicated by email or notice within the Service where appropriate.