The brand on the WhatsApp is yours, the conversation is yours, and your patients' data never leaves your control

This page exists because the lawyer asks before the operations team gets to say yes. The two questions that arrive first are whose brand the patient sees and who owns the data, and both have the same answer.

The principle is single: Surface operates inside your organization, under your name and on your instructions. What follows is the detail of how that holds up in the contract, in the infrastructure, and against Chilean law.

Whose name does the patient see on the message?

Your organization's. The WhatsApp Business number is created under your organization's own Meta account, and the display name goes through a Meta review that ends in approved or rejected. That name stays tied to that account.

The practical consequence is that the channel belongs to you: the number is yours, the conversation sits in your account, and if you stop working with us tomorrow the channel keeps running. Meta also requires clearly stating the name of the business a person opted in to hear from, so an ambiguous sender breaks the channel's own policy.

The wording is yours too. Tone, greeting, how patients are addressed and what gets offered come from your manuals, get reviewed before going to production, and change like any other dial of the contact policy.

Who owns the conversation and the booked appointment?

Your organization does. The full transcript, the call disposition of each case, the booked appointment and the outcome of every attempt are your records. We hold them on your behalf and return them in machine-readable form whenever you ask, during the contract and at its end.

If we start from a CSV while the real integration is built, you generate the file, with the fields you decide and the frequency you set. That is why you can start without an API: control over what leaves your systems stays on your side of the wall.

The same criterion applies to the numbers. The report you see is the report you own, with the same denominator we use when we talk about results.

Where does the data live, and what deployment options exist?

Three options, ordered by how fast you can start: our infrastructure, with each provider's data isolated; your own cloud account, in whichever region your policy requires; or an on-premise deployment, with the whole platform running inside your perimeter.

On-premise, nothing leaves your network except what the messaging channel needs to deliver the message. When your institutional policy requires it, anonymization happens inside the organization and the agents work on data with no direct identifiers.

In all three, the principle is minimization. Booking needs very little: a patient identifier, a phone number, the order, and the service rules. We do not ask for the full medical record because we do not need it, and what never moves cannot leak.

What does Ley 19.628 require for health data?

Chile's Ley 19.628, on the protection of private life, classifies «los estados de salud físicos o psíquicos» as sensitive data (article 2, letter g). Its article 4 allows processing personal data when the law authorizes it or the data subject expressly consents, and its article 7 imposes secrecy on those who work in the processing of data that does not come from publicly accessible sources.

Article 10 is the one that governs this operation. It bars processing sensitive data «salvo cuando la ley lo autorice, exista consentimiento del titular o sean datos necesarios para la determinación u otorgamiento de beneficios de salud que correspondan a sus titulares». Booking an exam a doctor already ordered falls under that last case, and Surface processes that data for no other purpose. The legal call is your legal team's, and our job is to give it no data for anything else.

On top of that sits Ley 20.584, which regulates people's rights in their own healthcare and states that «toda la información que surja, tanto de la ficha clínica como de los estudios y demás documentos donde se registren procedimientos y tratamientos a los que fueron sometidas las personas, será considerada como dato sensible». The same law makes providers responsible for compliance with Ley 19.628 and requires keeping the record for at least fifteen years.

The practical consequence is that your organization is the party answerable under the law, and we act on your behalf and on your instructions. The data processing agreement says exactly that, fixes the permitted purposes, and lists every subprocessor.

And what changes with Ley 21.719?

Ley 21.719, published on 13 December 2024, regulates the protection and processing of personal data and creates the Agencia de Protección de Datos Personales. Its amendments to Ley 19.628 take effect «el día primero del mes vigésimo cuarto posterior a la publicación», meaning 1 December 2026.

Three things change for a provider. The list of sensitive data now names «los datos relativos a la salud» explicitly. Article 16 bis restricts their processing to «los fines previstos por las leyes especiales en materia sanitaria». And article 14 sexies obliges the controller to report security breaches to the Agencia «por los medios más expeditos posibles y sin dilaciones indebidas», and to communicate them to each affected data subject.

The same law names the role we occupy: «tercero mandatario o encargado: la persona natural o jurídica que trate datos personales, por cuenta del responsable de datos». That is us, and incident notice to you sits in the contract with an internal deadline that leaves you room to meet yours.

Why is WhatsApp Business defensible, and what cannot be done there?

Because the channel demands what a regulator would demand: a business account, an identified sender, prior consent, and honored opt-outs. A channel where the patient blocks with one tap and where the platform punishes abuse leaves more auditable trace than an outbound call with no record.

The limit is written into Meta's policy: «no utilices WhatsApp para ofrecer telemedicina ni para enviar o solicitar información sobre salud si las regulaciones aplicables prohíben la distribución de este tipo de datos» on systems that do not meet stricter requirements. So the messages carry logistics: which exam, where, when, what preparation. No results, no diagnoses, no interpretation.

It is the same reason the agent gives no clinical advice. And if your policy rules WhatsApp out for a segment, that segment is worked by SMS or by call, or left out entirely.

What happens to your data if you stop working with us?

You take it with you. A full export in machine-readable form, with the conversation, the disposition and the outcome of every case. Then deletion within the window the contract sets, and written confirmation that it happened.

If the deployment is on-premise there is nothing to hand back, because nothing ever left your perimeter. The WhatsApp number stays under your Meta account and you keep operating it with whoever you like.

What do we not do with your data?

• We do not train or fine-tune models on your patients' data or their conversations.
• We do not pool one provider's data with another's. Every organization stays isolated.
• We do not sell it, transfer it, or use it to enrich any database.
• We do not use it to publish a benchmark that identifies you.
• We do not use it for any purpose other than the one you instructed in writing.

What we do is count: how many orders came in, how many ended up booked, how many attended, and against which denominator. Those metrics are yours, and they are the same dashboard we look at.

Who answers legally, and what certification do we hold?

Your organization is the data controller and Surface is the processor acting on its behalf. The contract fixes the purposes, forbids any other use, lists subprocessors, defines incident notice, and gives you the right to audit.

On certifications it pays to be exact, because this is where vendors embellish. Surface holds no certification of its own to show you today. What exists is the same team's track record: we run SignatureAPI, electronic signatures for Chilean and LatAm healthcare, under HIPAA and as a federal prime on a CMS/FISMA contract. That is team experience working under health-data regimes, and we lay it out in full in about us.

The standard that runs is yours, written into the contract and executed the same way every day.