Privacy Policy

Vanty ABA is a clinical-management platform for child development and therapy centers (ABA, ASD, ADHD and related areas). It enables each center to manage its patients' clinical records and to communicate securely with families.

Each center that uses Vanty ABA acts as the data controller for the information of its patients and families. Vanty ABA acts as the data processor: it processes that information on the center's behalf, following its instructions and solely to provide the service.

We process only the information necessary to provide the service:

• Account data: full name, email address, phone number and, optionally, a profile photo.
• Patient data: name, date of birth, diagnosis, assessments, therapy programs, session records and progress. This is sensitive health data and receives reinforced protection.
• Content you share: forms, messages, audio, images and documents exchanged with the center.
• Technical data: connection and access logs, kept for a limited time for security purposes.

• Clinical care: managing the clinical record and therapeutic follow-up of the patient.
• Reports: preparing progress reports for families and professionals.
• Communication: sending appointment notices, reminders and messages from the center.
• Security and continuity: protecting accounts, preventing misuse and keeping the service running.

Your data is never used for advertising, profiling for commercial purposes, or sold to third parties.

Processing is based on the consent of the data subject or, in the case of minors, of their parent or legal guardian; on the performance of the health service requested from the center; and on compliance with the legal obligations applicable to clinical records.

Information is only accessible to:

• The center's clinical team directly involved in the patient's care, according to their role.
• Technology providers that support the service (database, hosting and file storage) under confidentiality and security obligations.
• The artificial intelligence provider that processes ARIA queries, receiving only the minimum context required for each response.
• Competent authorities, exclusively when required by law or court order.

Some of these providers may host data outside Peru. In such cases, cross-border data flows are carried out with appropriate safeguards, in accordance with applicable regulations.

We apply technical and organizational measures proportional to the sensitivity of the data:

• Encryption at rest with AES-256.
• Encryption in transit through TLS connections on every communication.
• Isolation by center: row-level security policies (Row Level Security) ensure each center only accesses its own records.
• Role-based access (director, administrator, specialist, therapist, secretary, family), following the principle of least privilege.
• Optional two-step verification for every account.

ARIA is the platform's assistant, based on language models. Its use follows these principles:

• Data minimization: only the context strictly necessary for each query is sent.
• No training: clinical information is not used to train artificial intelligence models.
• Human oversight: ARIA is a support tool; it does not issue diagnoses or replace the professional judgment of the therapy team.

Minors' data is processed with the consent of their parent or legal guardian and with the highest level of confidentiality:

• Restricted access: only the responsible parent or guardian and the professionals assigned to the case.
• No commercial use: the minor's data is never used for advertising or marketing profiles.
• Control for the guardian: they may exercise the minor's rights at any time.

Under Peru's Personal Data Protection Law (Law No. 29733) and its regulations, you may exercise free of charge the rights of:

Requests are submitted to the center that provides your care, which is the data controller; the platform assists it in responding within the legal deadlines. If you consider your request was not properly addressed, you may file a claim with the National Authority for Personal Data Protection (Ministry of Justice and Human Rights of Peru).

If you sign in with Google or Microsoft, we only receive your name, email address and profile photo to create and manage your account. We do not access your email, files or other services.

If you link Google Calendar or Outlook Calendar, access is limited to creating and updating the events of your appointments. You may revoke it at any time from My profile → Linked calendars.

Clinical information is kept while care is active and, afterwards, for the minimum period required by applicable health regulations on clinical records. Once that period ends, it is securely deleted or anonymized. Account data is deleted when the account is closed, except where the law requires otherwise.

We may update this policy to reflect improvements to the service or regulatory changes. Relevant changes will be communicated through a notice within the platform, and the date of the last update will always appear at the top of this document.

For questions about the processing of your data, contact the center that provides your care through the channels available in the platform. For matters related to the Vanty ABA platform, you may write to us through the support section.