Privacy Policy
What data we process, what for, who we share it with, how long we keep it and how you exercise your rights. Part of what we handle is health data, which calls for special care that this document spells out.
This English version is provided for reference only. In case of any discrepancy, the Spanish version prevails.
What we do with your data
A summary to help you find your way. It doesn't replace the full text: if anything differs, the articles below prevail.
01 Data controller
Cannis is the controller of the personal data collected through the platform.
There's an important nuance worth making clear from the start: regarding the data of an organization's members and a professional's patients, the one who decides about that data is the organization or the professional —they are the controllers—, and Cannis acts as data processor, providing the tool and following their instructions.
02 Legal framework
- Law 25,326 on Personal Data Protection and its Decree 1558/2001.
- Law 26,529 on Patients' Rights: medical records, confidentiality and informed consent.
- Law 27,350 and its Decree 883/2020, for data related to REPROCANN.
- Law 25,506 on Digital Signature.
- Article 43 of the National Constitution, which establishes the habeas data action.
The supervisory authority is the Agency for Access to Public Information (AAIP).
03 What data we process
First and last name, ID document, date of birth, email, phone number and address.
Diagnoses, medical prescription, route of administration, dosage, treatment progress, answers to follow-ups and supporting documentation. They are sensitive data and are handled as described in section 4.
REPROCANN registration status, card, links with professionals and organizations, and issued credentials.
License number, specialty, digitized signature and stamp, jurisdiction and billing data.
IP address, device and browser type, pages visited and activity logs within the platform. They are used for security, auditing and improving the service.
Cannis does not store full card data. Payment is processed by an external provider; we keep the receipt and the status of the transaction.
04 Sensitive data
Law 25,326 defines as sensitive data data that reveals, among other things, health-related information. The law is strict about it: no one is obliged to provide it, and it may only be collected and processed when there are reasons of general interest authorized by law or with the express consent of the data subject.
In Cannis that consent is given explicitly and separately, when the information is entered or when the informed consent for the corresponding service is signed. You can withdraw it at any time, with no retroactive effect on processing already carried out.
Health facilities and health professionals may process data relating to the physical or mental health of those who come to them or who are or have been under treatment, respecting the principles of professional secrecy.
Summary of article 8 of Law 25,326Cannis staff who access health information because of their role are bound by a duty of confidentiality, which continues even after their relationship with the company ends.
05 What we use the data for
- Creating and managing your account, and authenticating you.
- Handling the REPROCANN application and filing it with the health authority.
- Coordinating appointments, consultations and treatment follow-ups.
- Issuing prescriptions, credentials and dispensing receipts.
- Allowing your organization to manage your membership and your deliveries.
- Maintaining the traceability required by the regulations.
- Processing payments and issuing the corresponding tax documents.
- Sending you operational notices: appointments, expirations, the status of an application.
- Preventing fraud, misuse and unauthorized access.
- Producing aggregated and anonymized statistics, which don't make it possible to identify anyone.
The data is not used for behavioral advertising, is not cross-referenced with third-party databases for commercial purposes and is not transferred to insurers, employers or financial institutions.
06 Who we share it with
Your organization accesses the data of its own members. Your professional accesses that of their own patients. No organization sees another's members, and no professional sees someone else's patients.
The data needed for the application is filed with the National Ministry of Health. Information is also provided when a competent judicial or administrative authority requires it, within its powers.
The platform relies on infrastructure and service providers that, because of their role, may process data on behalf of Cannis and following its instructions. All of them are bound by confidentiality and security obligations.
- Amazon Web Services — hosting of the platform and the data.
- Cloudflare — network security, certificates and traffic protection.
- Twilio — sending WhatsApp messages.
- OpenAI — processing queries to Cannis AI.
- Mercado Pago — payment processing.
- RCTA — issuing electronic prescriptions.
Some of these providers operate servers outside Argentina. When an international transfer is necessary to provide the service, it is carried out with the safeguards required by Law 25,326, through contractual clauses that bind the recipient to an adequate level of protection.
07 Cannis AI and your data
- Queries are processed to answer you at that moment. They are not used to train third-party models.
- The public chat does not access your medical records. Whatever you write there is recorded as a conversation.
- The practice assistant does access data of the patients of the professional using it, and only theirs. It suggests actions; the professional confirms them.
- Conversations are stored so you can pick them up again and for auditing. You can request their deletion.
08 WhatsApp and notifications
Treatment follow-ups and some reminders are sent by WhatsApp to the number you entered. They are operational messages, linked to a service you are using, not advertising.
You can ask us to stop sending them at any time, by replying to the message itself or by writing to us. That doesn't close your account or your treatment: it only stops that channel.
09 How long we keep it
Data is kept for as long as the relationship lasts and, afterwards, for the periods imposed by the applicable legal obligations.
- Clinical records — Law 26,529 sets a minimum retention period for medical records, which is the responsibility of the treating professional or institution.
- Dispensing and traceability receipts — for as long as health regulations require, because they are the evidence that the delivery was legal.
- Accounting and tax documents — for the periods set by tax legislation.
- Access and audit logs — for a limited period, for security purposes.
Once the period ends, the data is deleted or irreversibly anonymized.
10 Security
We apply technical and organizational measures to protect data against unauthorized access, loss and alteration:
- End-to-end encrypted traffic with valid certificates.
- Encryption of the most sensitive fields in the database.
- Role-based access control: each person sees what their role needs.
- Activity logging for critical operations.
- Regular backups of the information.
No system is infallible. In the event of a security incident affecting personal data, Cannis notifies the affected data subjects and the supervisory authority in accordance with current regulations.
11 Your rights
As the data subject you can exercise the rights of access, rectification, updating and deletion. It's free and you don't need to justify the request.
El titular de los datos personales tiene la facultad de ejercer el derecho de acceso al mismo en forma gratuita a intervalos no inferiores a seis meses, salvo que se acredite un interés legítimo al efecto conforme lo establecido en el artículo 14, inciso 3 de la Ley N.º 25.326.
Mandatory notice — Law 25,326- Access — we tell you what data of yours we hold. Response time: ten calendar days.
- Rectification and updating — we correct whatever is inaccurate or incomplete. Time: five business days.
- Deletion — we delete your data, except what we must keep by legal obligation, as set out in section 9.
- Withdrawal of consent — for the processing of sensitive data, at any time.
La Agencia de Acceso a la Información Pública, en su carácter de órgano de control de la Ley N.º 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.
Mandatory notice — AAIP12 Cookies and similar technologies
We use technical cookies, needed for the session to work and to protect forms, and analytics cookies, which tell us in aggregate which sections are used most.
You can block or delete them from your browser settings. If you block the technical ones, some features —such as staying signed in— stop working.
13 Minors
The platform is not aimed at people under 18. When the patient is a minor, the data is provided and managed by their legal representative, who gives consent and is responsible for its accuracy, respecting the progressive autonomy recognized by the Civil and Commercial Code.
14 Changes to this policy
We may update this document when the services, providers or regulations change. The date of the last update is at the top. When the change is substantial —a new purpose, a new provider processing health data— we'll let you know before it takes effect.
15 Contact and complaints
To exercise your rights or ask a privacy question:
- WhatsApp: +54 9 11 2655-5444
If you believe we didn't handle your request properly, you can file a complaint with the Agency for Access to Public Information.
Terms and Conditions
The platform's terms of use: what it does, what it doesn't do, and what each party is responsible for.