Privacy Policy

Sorta is a software layer that helps independent medical and dental clinics automate their paperwork: a patient fills out their information once through a link, and that information is distributed across the forms the clinic already uses (intake, consent, HIPAA-style acknowledgement, insurance, clinical history), producing a locked PDF ready to review and sign. The link reaches the patient by email and by WhatsApp, where an automated assistant also offers a simple menu (schedule, reschedule, talk to the clinic) and routes the conversation to a staff member when needed.

This notice serves three purposes at once, and its structure reflects all three:

• It is Sorta's own privacy policy as a company — for clinic staff who use the platform and for visitors to this site.
• It is the document Meta / the WhatsApp Business Platform requires to be publicly posted and current for a Tech Provider operating on the WhatsApp Business API.
• It is a reference clinics can cite when drafting their own patient-facing privacy notice, since it accurately describes how Sorta processes the data a clinic entrusts to it. No clinic is exempt from maintaining its own notice — see section 18.

1. Who we are

[LEGAL ENTITY NAME], incorporated in [STATE/COUNTRY OF INCORPORATION] ("Sorta," "we," "us"), operates the Sorta platform (app.getsorta.io) and this website. Our address for purposes of this notice is [REGISTERED / CONTACT ADDRESS]. You can reach us about privacy matters at [PRIVACY CONTACT EMAIL].

2. Key definitions

• Personal data: any information that identifies or could identify a person (name, phone number, email, address).
• Sensitive personal data: data whose misuse could cause greater harm — in particular, health data (clinical history, diagnoses, treatment). We handle this category with heightened care throughout this notice.
• Controller: whoever decides why and how data is used, and holds the direct relationship with the person the data is about.
• Processor: whoever handles personal data on a controller's behalf and instructions, without independently deciding why it's used.
• Data subject: the person the personal data is about (the patient, the staff member, the site visitor).

3. Who this applies to — and Sorta's role

Sorta plays a different role depending on whose data is involved. This distinction matters throughout the document:

• Patient data: Sorta acts as a processor. The clinic is the controller — it decides what data is requested, how it's used clinically, and holds the direct relationship with the patient. Sorta processes that data only per the clinic's instructions, expressed through its form configuration.
• Clinic staff data (accounts): Sorta acts as the controller. We decide how this data is used (running the account, support, billing) within what's described here.
• Website visitors: Sorta acts as the controller.

4. Information we collect

4.1 Patient information (collected on the clinic's behalf)

• Full name, date of birth, phone number, email, and home address.
• Insurance details.
• Health and clinical information — reason for visit, history, symptoms, and whatever else a clinic's form requests. This is sensitive personal data.
• Consent acknowledgements and electronic signatures captured within forms.
• Every answer entered into a clinic's forms.
• Immutable snapshots of each form at the moment it's saved, and the final generated PDF — creating a dated record of what was completed at each visit.
• WhatsApp-specific data: the patient's WhatsApp phone number, conversation state with the automated assistant (e.g., which menu option was chosen), and — only for conversations escalated to a human — the message text, retained for [CONFIRM: 90] days and then purged. On first contact, patients receive a one-time notice advising them not to send detailed clinical information over that channel.

4.2 Clinic staff information (accounts)

• Email address and password — stored hashed with bcrypt; we never store or can read it in plain text.
• Role and the workspace (clinic account) they belong to.

4.3 Audit log

Every meaningful action inside the platform (who did what, to which record, and when) is written to an immutable audit log — protecting both the clinic and the patient with a verifiable trail.

4.4 Form access links

Links that let a patient fill out or view their forms require no login: they're a unique token that automatically expires 7 days after it's generated.

4.5 Website visitors

[CONFIRM] exactly what's collected (e.g., IP address and browser type via analytics tools) — see also section 14.

5. Why we use it

• Patient data: used exclusively to prepare, sync, and store the paperwork for a visit per the clinic's instructions. Never used for marketing. Never sold. Legal basis: consent given to the clinic (section 6) and the contractual relationship between Sorta and the clinic to provide the service.
• Clinic staff data: to run the account, provide support, bill, and communicate relevant service changes. Legal basis: the Sorta–clinic contractual relationship.
• Website visitor data: [CONFIRM] — typically, understanding site usage and improving content.

6. How consent is obtained

Because most of this data is health data (sensitive personal data), meaningful, informed consent is required. The clinic collects it — that's the clinic's responsibility as data controller, typically when sharing the intake link or during form completion, per the clinic's own privacy notice. Sorta provides the infrastructure to capture and evidence that consent (in-form confirmations, the immutable snapshots described in 4.1), but does not replace a clinic's own notice to its patients.

7. Use of WhatsApp

Sorta uses Meta's WhatsApp Business API for two purposes: (1) sending the patient their form-completion link, and (2) operating an automated assistant offering a simple menu (schedule, reschedule, talk to the clinic) that routes the conversation to a clinic staff member when requested or needed.

• On first WhatsApp contact, patients receive a notice advising them to avoid sending detailed clinical information over that channel.
• While a conversation is handled by the automated assistant, Sorta retains the conversation state (which menu option was selected), not free-text content the patient might type.
• Once a conversation is escalated to a clinic staff member, that message text is retained — for [CONFIRM: 90] days — so the clinic can follow up, then purged.
• Meta processes message content on its own servers to deliver it; see section 9 on international transfers.

8. Who we share information with

We share personal data only with the vendors needed to run the service (sub-processors), under instructions limited to that purpose. [CONFIRM final list before publishing]:

• Microsoft Azure — application hosting, database (PostgreSQL), and file storage (Blob Storage).
• Meta Platforms / WhatsApp Business Cloud API — transmission and processing of WhatsApp messages. Meta processes message content on its own servers and, as of this document, does not offer a BAA-equivalent processor agreement for this channel — disclosed here because it's relevant to a patient's decision to use that channel.
• Resend — transactional email delivery (e.g., the form-completion link).
• Google (Gemini API) [and CONFIRM: Reducto, Azure Document Intelligence] — used only to analyze blank form templates a clinic uploads while setting up its account, to detect where each field belongs. These tools never see patient-submitted answers.

We do not sell personal data to third parties or share it for advertising purposes.

9. International data transfers

• WhatsApp messages are processed on Meta's servers, located in the United States.
• Azure hosting is located in [CONFIRM region: Canada — Canada Central].

Where applicable law requires it (including for clinics operating under Mexico's LFPDPPP), these transfers rely on contractual and security safeguards with each provider [CONFIRM exact mechanism]. By using Sorta or messaging our WhatsApp number, patients and clinics consent to these transfers as described here.

10. How we protect information

• All data is encrypted in transit (HTTPS/TLS) and encrypted at rest.
• Each clinic operates in an isolated workspace — no clinic can see another clinic's data.
• Staff passwords are stored hashed with bcrypt — never in plain text.
• Patient form-access links expire automatically after 7 days.
• Every action on a record is written to the audit log described in section 4.3.
• [CONFIRM additional controls: authentication scheme, Azure-managed database encryption, access reviews, etc.]

11. How long we keep information

• Clinical data and patient forms: retained while the clinic's account is active and per the clinic's own retention instructions — the medical record and its retention period are the clinic's decision, not Sorta's.
• WhatsApp assistant conversation state: [CONFIRM period].
• Transcripts of conversations escalated to a human: [CONFIRM: 90] days, then purged.
• Audit log: [CONFIRM period].
• Deactivated clinic staff accounts: [CONFIRM period, e.g. 30 days].

12. Your privacy rights

Depending on where you're located, you may have rights to access, correct, delete, or object to the use of your personal data. [CONFIRM which specific rights apply — e.g., CCPA if California residents are in scope, Texas data privacy law given Sorta's HQ, or other applicable state law]. Patients and clinics in Mexico have ARCO rights under the LFPDPPP — see the Spanish version of this notice, section 12.

If you're a patient: your clinic is the controller of your clinical data, so requests about your health information should go directly to your clinic, per its own privacy notice. Sorta supports the clinic in fulfilling those requests within the platform but cannot independently act on data it doesn't control.

If you're clinic staff or a site visitor: you can exercise your rights by writing to [PRIVACY CONTACT EMAIL]. We'll respond within [CONFIRM timeframe].

13. Minors

Some clinics using Sorta are pediatric specialties, so the platform may process data belonging to minors. In those cases, consent is given by a parent or legal guardian, and it's the clinic's responsibility to obtain it per its own privacy notice and applicable law governing minors' data. [CONFIRM whether Sorta requires any additional control for these cases].

14. Cookies and site analytics

This marketing site uses Google Analytics and Microsoft Clarity, both third-party cookies. On your first visit, a banner lets you accept them or continue with necessary cookies only — they only load if you accept. See also the separate Cookie Policy.

15. HIPAA / U.S. health data

[CONFIRM whether any clinics or patients are U.S.-based. If so, this section needs to be expanded to address treatment under HIPAA — including whether Sorta acts as a Business Associate and whether a Business Associate Agreement (BAA) is in place with those clinics — as a distinct regime from the Mexico-focused (LFPDPPP) content in the rest of this document].

16. Changes to this policy

If we make a material change to this notice, we'll update the "effective as of" date at the top of this page. [CONFIRM whether active clinic accounts will also be notified by email, and how far in advance].

17. Contact

Questions about this notice, or to exercise your rights, write to [PRIVACY CONTACT EMAIL]. [CONFIRM whether a specific Privacy Officer/DPO is designated, and their name].

[CONFIRM: governing law and venue for disputes].