Privacy policy

The minimum for this to work, and nothing we can do without:

The data is in a database and the files of your reports are in a private storage bucket, both hosted on cloud servers. The reports bucket is not public: there is no address that anyone could guess in order to download one of your results.

When you open a report we give you a signed link that lasts two minutes and then stops working: the real address of the file never leaves our servers, and the one you see in your address bar is of no use to anyone else.

We store them encrypted with AES-256-GCM, using a key that is not in the database. They are decrypted in one place only — the process that signs in to the centre's portal — and only in memory, for as long as the search for results lasts. Every time that happens it is recorded in the audit log.

Nobody on the Saludata team can read your login details, either from the application or by accessing the database. If you disconnect from a centre we delete them straight away and your results stay with you.

You do. The Saludata team does not look at your results.

To keep the system running we look at operational logs — how many searches succeeded, which centre is failing, how many results were saved — and those logs are built so that they cannot carry health data: they carry numbers and codes, never the name of a test, a value, or the name of the file the centre published.

You can upload the PDF of a report, or take a photo of the paper, without having any centre connected. From that we store three things and nothing more: the file exactly as you sent it, what you wrote yourself — the date, the title, the type of test and, if you added it, where you had it done — and the values we can read from the report. We do not draw conclusions from the file name or add data that you did not give us.

The file goes to the same private storage bucket as everything else, encrypted, with no address that anyone could guess, and it is opened with the same signed two-minute link. It is not a separate folder or a less carefully protected place because you uploaded it.

You can correct it and you can delete it, on your own, from the result itself. Correcting means changing its date, title, type or the label saying where you had it done: you entered those details, so you fix them yourself, without writing to anyone. Deleting removes the result, its values and the file, immediately and without the 30 days that account deletion waits; if that result was inside any link you shared, we tell you how many before you confirm.

We read the values here whenever the PDF has the text inside it, and in that case the file does not leave our servers. When it does not — a photo, or a scanned PDF — and you have artificial intelligence switched on, we send the file to Anthropic, in the United States, so that it can read the values: it goes whole, because it is the only thing there is to read. It is exactly what we do with the reports we fetch from a portal, and it is covered in the section below, "When something leaves the country".

And one more thing, which we prefer to say: you chose the file, and we do not verify that it is yours or that it is genuine. We do not check it against any laboratory or any signature. It matters above all if you show it to a professional through a link: what they see on the other side is what you uploaded, and we do not vouch for it.

If your laboratory is not on the list, you can paste the address of its portal and we will try anyway. From that request we store three things: the address of the portal, the name you gave it and the fact that you were the one who asked. None of that is health data, and we keep it even if the attempt does not work out: it is what tells us which laboratories to support first.

To find out what that portal will ask you for and where to get your results from, we send Anthropic the structure of its pages: which fields and buttons it has, how they are laid out, and the text they display replaced by its shape — "a text of 24 letters", "a date", "a number". The text itself does not leave our servers, so a "Welcome" with your name next to it does not travel. Neither do your login details for the portal: those never go in, not even to test whether they work.

A laboratory like that is marked as being in testing and does not appear in the list of centres for other people. It may fail, and we tell you before you try it, not after. If we later support it properly, we let you know in here so that you can try again.

You can create a link to show one or several results to a healthcare professional. While that link is live, anyone who has it can see those results: the file, the values and the report. It does not ask for an account or a password, because the professional does not have one.

That is why you choose how long it lasts: 24 hours, 7 days, 30 days, or no expiry. With a time limit, the link stops working by itself when it runs out. With no expiry, it keeps opening those results until you take it down, and taking it down is the only thing that cuts it off. In all four cases you can take it down whenever you like, and you can protect it with a four-digit passcode that you tell them at the time: the passcode does not travel inside the link.

The link shows only the results you chose. It does not show your name, your email address, the rest of your history, or the explanations written by artificial intelligence. Every time someone opens it, it is recorded in the access log, and we ask search engines not to index it.

There is one thing we cannot do, and we prefer to say so: if the professional downloaded or saved the file while the link was live, that copy is already theirs. Taking the link down cuts off access from that point onwards; it does not delete what someone has already taken.

Always to the same place — Anthropic, in the United States — and always with artificial intelligence switched on. Switched off, nothing leaves. Switched on, there are three different things, and it is worth not confusing them:

The first two are an international transfer of health data (Argentina's Personal Data Protection Act, Law 25.326, art. 12), and the third goes to the same place: that is why artificial intelligence is a separate permission, switched off by default, which we ask you for with the text in front of you. With the permission switched off we do not recognise new portals, just as we do not read scanned reports. Your data is not used to train any model.

You can switch it off whenever you like. The explanations we have already written for you are deleted, and the reports we had not been able to read are left without a list of values: the result and its file stay stored and visible as always.

For as long as you have the account. If you delete it, there are 30 days for you to change your mind or download your results, and after that we delete everything: the account, the results, the values and the files.

After the purge only one thing survives: the audit log, with no health data in it. We keep it because we have to be able to prove who accessed what and when, even years later, and that log is what protects the person whose data was handled.

Regarding your personal data, Argentina's Personal Data Protection Act, Law 25.326, gives you the right to access it, to rectify it, to update it and to ask for it to be erased. Regarding your medical record, Argentina's Patients' Rights Act, Law 26.529, says that it is yours and that you have the right to a copy (art. 14) and to have it handed to you before any deletion (art. 18).

You can exercise them on your own, from Settings, without writing to anyone or waiting for a reply:

Write to us and we will sort it out. And if we do not satisfy you, you can complain to Argentina's Agency for Access to Public Information (AAIP), which is the supervisory authority under Law 25.326. The complaint is free of charge.

We use a single cookie, your session cookie, and without it you could not be signed in to your account. There is no third-party analytics, no advertising pixels and no trackers.