Security
Behind every message there is health data.
This page is not a statement of intent. It is what Daria does today, and what is still missing, written plainly.
- Built with a clinic in Madrid
- Data in the EU
- Always says it is an assistant
01Principles
Ley 41/2002
Informed consent
Signed on the clinic's own form, not on generic text. The exact wording and its hash are stored, along with the template version, the date, who signed and which practitioner attended. Signing links are single-use and expire in fifteen minutes. If in three years somebody asks what a patient signed, the answer is a document, not a reconstruction.
GDPR · LOPDGDD
Controller and processor
The clinic is the data controller: it decides what its patients' data is used for. Daria is a processor acting on its instructions, under a signed agreement. The suppliers underneath are sub-processors and are listed one by one.
The minimum
Minimisation and an audit log
Every screen and every alert carries only what it needs: the alert to the practitioner carries first name and initial, treatment, day and the patient's own words, and nothing more. Who does what is recorded, and technical data that is no longer needed is purged on a schedule.
Transparency
It always says it is an assistant
Daria introduces itself as an assistant in the first message of every conversation, without waiting to be asked. It does not diagnose, does not interpret symptoms and does not prioritise care. On any clinical signal the message to the patient is always the same — ring the clinic, and emergency services if it is severe or getting worse — and a person decides.
Data in the EU
Where the data lives
Hosting in the European Union, encryption in transit and at rest, and a processor agreement with every supplier. The exact provider and region are confirmed before the pilot and published here.
Retention
Periods, export and erasure
There is a written retention policy: conversations have a period, technical data goes sooner, and a patient's record can be exported or anonymised from inside the product. The clinical record follows the clinic's own duties — five years minimum in Spain.
This site
No cookies, no analytics
daria.soy sets no analytics or advertising cookies, loads no third-party scripts and does not follow you around the web. If anything is ever measured, the privacy policy will say so before it happens.
WhatsApp
Opt-in and templates
Daria writes first only to patients who have opted in. Outside the twenty-four-hour window it uses templates approved by Meta, and every message the clinic starts carries its way out: the patient writes “STOP” and receives no more.
02Limits
What Daria is not
- It gives no medical advice and interprets no symptoms.
- It does not replace the practitioner or decide who is seen first.
- It is not a medical device.
- It does not advertise prescription medicines: treatment names only, never brands, and no offers on them.
- It does not train models on your patients' data.
03Review
Reviewed by someone who is not us
The compliance assessment is written down in full, row by row, with what is already met and what is missing. A data-protection specialist reviews it before the first pilot with real patients. What you are reading is the real state, not the intended one.
Let's go through it with your questions.
If you have legal advisers or a DPO, bring them. We would rather have the hard questions now than after the first message to a patient.