← Go back
How we protect data
Virexo processes the data of the clients of the businesses that use it: for many practices this is health data. Here we explain, in plain words, where it is stored, who can see it, how it is protected and how long it is kept. The binding text is the Data Processing Agreement (DPA), which this page summarises.
Where the data is
- The database and the service run in the European Union (Amsterdam); files such as documents, quotes and attachments are kept in a storage space under EU jurisdiction.
- Virexo is offered only to businesses in the European Union and the European Economic Area; healthcare businesses use it only if based in Italy.
Who can see it
- A business's data can be seen only by that business: the owner and the collaborators the owner chooses, each with their own permissions.
- The client record (Clinical record, Case file, Client files or Treatment record) can be opened only by the owner and the collaborators the owner authorises; every writing, correction and deletion is kept in a log, together with the openings (at most one line every 10 minutes per person and client).
- Virexo staff access the data only when needed to provide the service or when the business asks, and are bound by confidentiality and by the business's professional secrecy.
- For support, Virexo staff see when the owner and the collaborators sign in to and out of Virexo; this is kept for 30 days.
- Virexo does not sell the data, does not use it for advertising and does not use it to train artificial intelligence.
How it is protected
- All connections are encrypted (HTTPS, TLS 1.2 or higher).
- The client record notes and their attachments are encrypted by Virexo before being stored: whoever hosts the database or the files sees only their encrypted version and does not have the key. The WhatsApp access keys and guests' identity document numbers are encrypted in the same way.
- Access requires personal credentials and, optionally, two-step verification; passwords are stored only in a non-reversible form and attempts are limited.
- The links sent to clients to sign or read a document are unique and expire.
- The database is not reachable from the internet, only from the provider's internal network.
- The service's technical logs do not contain the text of clients' messages or their full phone numbers.
- The service is monitored continuously from outside: if it does not respond we know at once, and its status is public on status.virexo.chat.
- The AI assistant does not read the client record.
Signatures
- Notices, consents, questionnaires, documents and quotes are signed from the phone, from a unique link sent on WhatsApp or by email.
- They are simple electronic signatures (EU eIDAS Regulation). For each signature Virexo keeps the evidence (unique code, IP address, date and time, document fingerprint) and provides it to the business on request.
How long
- Conversations and the client record stay while the account is active: the business decides what to delete. A client is deleted together with their conversation and files, and spends 30 days in the trash; a client with a folder (record notes, attachments, signed questionnaires) stays in the trash until the business deletes them.
- At the end of the contract the data stays for 60 days, to reactivate the account or download it: the business receives notices 30, 7 and 2 days before and downloads everything with “Download your data”. Clinical records are kept by the business for the periods required by law.
- Backups are encrypted and stay in the EU; the automatic ones rotate within 90 days. Every night an external encrypted copy is also made, in a separate space where it cannot be deleted early. They are used only to restore the service, never to recover deleted data.
- Technical logs are deleted after 12 months, closed support tickets after 24.
If something goes wrong
- In the event of a data breach Virexo informs the business without delay and in any case within 48 hours, with the information it needs to notify the authority in turn within the 72 hours set by the GDPR.
- Virexo helps the business answer its clients' requests (access, rectification, erasure) and carry out its own impact assessment.
Sub-processors
To run Virexo we rely on these providers. Each one is bound by a data processing agreement with obligations equivalent to those of our DPA; when a provider changes, we say so in advance.
| Provider | What for | Where |
|---|---|---|
| Railway Corp. | Hosting of the service and the database | EU (Amsterdam); technical logs in the USA with SCC and DPF |
| Cloudflare, Inc. | Website protection; storage of files and of the encrypted external copies (R2) | R2: EU (EU jurisdiction); network: USA with SCC and DPF |
| Meta Platforms Ireland Ltd. | Sending and receiving WhatsApp messages | EU / USA with SCC and DPF |
| Anthropic Ireland, Limited | The assistant's artificial intelligence (plans that include it and the free trial) | EU / USA with SCC |
| Amazon Web Services EMEA SARL | Sending emails (Amazon SES) | EU (Frankfurt) |
| SendinBlue SAS (Brevo) | Inbound booking emails; sending emails as an alternative | EU (France) |
| Stripe, Inc. and PayPal (Europe) S.à r.l. | Subscription payments | EU / USA with SCC and DPF |
| iubenda srl | Privacy policy, cookie banner, consent log | EU (Italy) |
SCC = Standard Contractual Clauses of the European Commission; DPF = EU-US Data Privacy Framework. The services a business connects on its own (for example its own company on Fatture in Cloud) are the business's providers, not Virexo's.
Documents
The DPA (Data Processing Agreement, Article 28 GDPR) is part of the Terms and Conditions. On request we also give a practice or its consultant the sheet supporting the data protection impact assessment (DPIA).
For any question about data protection: support@virexo.chat
Page updated together with DPA version 1.4.