Sofía privacy policy

1. Who is who

The dental clinic being called or messaged is the data controller: it decides to use Sofía to attend to its patients and what their data is used for.

GOTASE LLC provides the Sofía service to the clinic and processes that data on the clinic’s behalf and under its instructions, as a data processor (Article 28 of the General Data Protection Regulation, GDPR). GOTASE LLC is a Florida (United States) limited liability company, registration number L26000476760, with its address, according to the Florida company registry, at 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States. Contact: tati@grupogotase.com.

The Meta app through which Sofía connects to WhatsApp, "Sofia by Gotase", belongs to GOTASE LLC.

2. What Sofía does

Sofía answers the clinic’s calls and WhatsApp messages when the clinic has set it up to, takes down the reason for the contact and the details needed to get back to the person, and leaves the clinic a message so that a person can reply. Sofía does not book appointments, does not give medical advice and has no access to medical records.

At the start of a call, Sofía says that it is an AI assistant; on WhatsApp it is instructed to introduce itself the same way.

If someone describes something that should not wait (severe pain, swelling, bleeding, an injury, a broken tooth), Sofía flags it as urgent so that the clinic sees it first. If there is immediate danger, such as difficulty swallowing or breathing, it tells them to call 112.

3. What data Sofía processes, and what it does not

By phone, Sofía keeps for the clinic the caller’s name, if given; the contact phone number the person dictates for a call back; the reason for the call; whether it is urgent; and the date.

The number the call comes from is used during the call to recognise whether that person has called the same clinic before, and it is not stored in the call record. As with any phone call, it does appear in the technical logs of the phone carrier, of the service that carries the audio and of Sofía’s own server.

The audio of the call is processed in real time to understand what is said and to reply. Sofía keeps no recordings or transcripts of calls. Until 28 September 2026 a diagnostics feature of LiveKit, the provider that carries the audio, was switched on and stored the audio and transcript of calls in its service in the United States; it was switched off that day, and LiveKit deletes that data automatically 30 days after each call.

On WhatsApp, Sofía keeps the WhatsApp number of the person writing and the text of the messages in the conversation, both the person’s and Sofía’s, so that the conversation can continue and the clinic can read it. As on a call, it also records, in the same record used for calls, the name if given, a contact number if given, the reason and whether it is urgent; that record appears alongside the call records in the list the clinic sees.

Photos, voice notes, videos, documents, stickers and locations sent on WhatsApp are not downloaded and not stored: Sofía replies with a fixed sentence asking for it in writing or offering a call from the clinic’s team.

Sofía is instructed not to repeat symptoms, diagnoses or treatments in writing. That is an instruction to the language model, not a technical barrier, and it is stated as such.

When someone at the clinic replies by hand from its WhatsApp Business app, Sofía stops replying in that conversation.

4. What the data is used for

Only to handle that call or conversation on the clinic’s behalf and to pass the message on to it. Gotase does not use this data for advertising, does not sell it and does not use it to train its own AI models.

5. Providers involved

To work, Sofía uses these providers, which process the data to deliver their part of the service:

OVHcloud: the server Sofía runs on, in Frankfurt (Germany).

Neon: the database where what section 3 describes is stored, in Frankfurt (Germany).

Telnyx (United States): the phone line and the connection to WhatsApp.

Meta: the WhatsApp Business platform the messages travel through.

LiveKit (United States): carries the audio of calls; its service data is stored in the United States.

Anthropic (United States): writes the WhatsApp replies.

On calls, each clinic uses one of two voice set-ups. With OpenAI voices (United States), OpenAI processes the call audio to understand it and reply. With the other set-up, Deepgram (European Union) turns speech into text, Anthropic (United States) writes the reply and ElevenLabs (United States) turns it into speech.

Google (United States): only if its Gemini model is configured instead of Anthropic’s.

Several of these providers, and GOTASE LLC itself, are in the United States, so part of the processing takes place outside the European Union. Anyone who wants more information about these transfers can ask at tati@grupogotase.com.

6. How long it is kept

There is currently no automatic deletion period: what section 3 describes is kept while the clinic uses Sofía, unless the person concerned or the clinic asks for its erasure sooner. When a clinic leaves the service, Gotase commits to deleting its data or returning it, as the clinic chooses (Article 28(3)(g) GDPR).

The database can be restored to its state at any point in the previous six hours; after that, deleted data can no longer be recovered, because no scheduled backups are made.

7. How to ask for the data to be deleted

By email to tati@grupogotase.com or through the clinic. The full instructions are on the page linked at the top of this policy, grupogotase.com/en/sofia/borrar-datos.

8. Rights

Anyone who calls or writes can exercise their rights of access, rectification, erasure, restriction, portability and objection with the clinic, which is the controller. If the request reaches Gotase, Gotase passes it to the clinic and carries it out on the clinic’s behalf.

They can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Security

Each clinic’s data is kept separate from every other clinic’s in the database, the connections between Sofía’s server and its providers are encrypted, and incoming WhatsApp messages are verified by their signature before they are read.

10. Changes

If this policy changes, the new version is published at this same address, with its date.