Meta Tech Provider
Frequently asked questions about security, privacy, and WhatsApp in Wazzy
Inquire how Wazzy protects clinic and patient data, what security measures it applies, how it manages privacy, and how it uses the official WhatsApp Business API.
Does Wazzy comply with the GDPR?
Wazzy is designed to operate within the framework of the General Data Protection Regulation and applicable European regulations.
Generally speaking, the clinic acts as the data controller and Wazzy as the data processor when it processes data on behalf of the clinic.
Effective compliance also depends on how each clinic configures and uses the service and on its own legal obligations.
Does Wazzy inform the patient that they are talking to an AI?
Yes. Wazzy informs the patient from the beginning of the first interaction that they are conversing with an artificial intelligence assistant. This measure complies with the transparency obligations set forth in Article 50 of the European Union Artificial Intelligence Act, applicable as of August 2, 2026.
The information is presented clearly so that the patient knows from the beginning that they are interacting with an AI and can decide how to continue the conversation.
What role does the clinic have regarding its patients' data?
As a general rule, the clinic acts as the data controller.
This means that it determines the purposes and means of the processing of its patients' data and maintains the obligations that correspond to it in accordance with applicable regulations.
What role does Wazzy play regarding patient data?
As a general rule, Wazzy acts as a data processor when processing personal data on behalf of the clinic.
The relationship is articulated through the corresponding conditions and agreements.
Does Wazzy offer a data processing agreement?
Yes.
The relationship between the clinic and Wazzy includes the corresponding contractual documentation to regulate the processing of personal data on behalf of the clinic.
Does the agreement cover health data?
Yes. The contractual documentation covers the processing of health information and sets forth the conditions applicable to this type of data.
Are Wazzy's data hosted in the European Union?
Yes.
The main infrastructure used by Wazzy to store its data is located in the European Union.
Wazzy also relies on third-party services, such as WhatsApp/Meta, which operate under their own terms and infrastructure.
Does Wazzy use clinic or patient data to train public artificial intelligence models?
No.
Wazzy does not use clinic or patient data to train public artificial intelligence models.
Does Wazzy sell patient data?
No.
Wazzy does not commercialize patient data as a product.
Does the clinic maintain control over its data?
Yes.
The clinic maintains control over the information it manages through Wazzy and retains the responsibilities that correspond to it as the data controller.
Can a clinic export its data if it stops using Wazzy?
Yes.
The clinic can export its data if it stops using Wazzy.
What happens to the data when a clinic stops using Wazzy?
Data management at the end of the service is carried out in accordance with contractual conditions, the clinic's instructions, and applicable legal obligations.
The clinic may request the export of its information before the end of the service.
Technical security, access control, and traceability
Does Wazzy make backups?
Yes.
Wazzy performs redundant daily backups as part of its technical operations.
Does Wazzy have monitoring systems?
Yes.
Wazzy has automated 24/7 monitoring that can generate alerts for the technical team when it detects incidents.
This does not mean there is a person manually monitoring the system 24 hours a day.
What is Wazzy's availability?
Wazzy maintains an availability rate of over 99.9 %.
Like any technological service, occasional incidents may occur or dependencies on external services may exist.
Does Wazzy encrypt the information?
Yes. Wazzy uses encryption to protect information, both during transmission and for certain sensitive data stored and in backups.
Who can access the data inside the clinic?
Access depends on the users and permissions configured by the clinic itself.
Wazzy allows setting different access levels according to the functions and responsibilities of each team member.
Can reception have different permissions than healthcare professionals?
Yes.
The clinic can define different access levels according to the role of each user and limit certain functions or clinical information to authorized profiles.
Can Wazzy limit access to the clinical history?
Yes.
The clinic can use permissions to restrict access to clinical information to authorized users.
Does Wazzy record user actions?
Yes.
Wazzy maintains traceability of actions performed by users within the platform and can associate them with the corresponding user.
Can Wazzy employees freely access clinic data?
No. Internal access is limited to operational, technical, or support needs and is subject to controls and confidentiality obligations.
What measures does Wazzy apply to protect health data?
Wazzy applies technical and organizational measures aimed at protecting the personal and clinical information it processes, including access controls, traceability, backups, and monitoring.
These measures are aimed at reducing risks and protecting information, although no technological system can guarantee zero risk.
Does Wazzy guarantee that there will never be a security breach?
No.
No technological system can guarantee zero risk.
Wazzy applies security measures and procedures aimed at reducing risks and managing potential incidents.
What happens if a security incident is detected?
Wazzy has monitoring and technical procedures to detect and manage incidents.
If an incident affects personal data, Wazzy manages it in accordance with applicable legal and contractual obligations.
Does Wazzy's security also depend on how the clinic configures its users and permissions?
Yes. Wazzy provides access controls and permissions, and the clinic manages its users, roles, and internal accesses.
Does Wazzy use clinical data to make medical decisions?
No.
Wazzy does not use clinical data to diagnose, recommend treatments, or replace the judgment of a healthcare professional.
WhatsApp and Meta
Does Wazzy use the official WhatsApp Business API?
Yes.
Wazzy operates through the WhatsApp Business Platform, Meta's official infrastructure for businesses.
Does Wazzy use unofficial WhatsApp solutions?
No.
Wazzy is designed to work on the official WhatsApp Business Platform infrastructure.
Is Wazzy a Meta Tech Provider?
Yes.
Wazzy operates as a Meta Tech Provider.
Does the clinic need to change its WhatsApp number to use Wazzy?
Not necessarily.
Wazzy can work while keeping the number used by the clinic, provided that the necessary technical conditions to connect it to the official WhatsApp infrastructure are met.
Can the clinic continue using WhatsApp Business with the same number?
Yes.
Wazzy can use the WhatsApp Business coexistence mode so that the clinic can maintain the use of the WhatsApp Business application on the same number while using the official infrastructure connected to Wazzy.
Can the team reply from WhatsApp Business?
Yes.
When the coexistence setting is active, the team can continue using WhatsApp Business within the operations supported by the platform.
Can the team also reply from Wazzy?
Yes.
The team can intervene from Wazzy's Inbox whenever they need to take control of a conversation.
What happens if the team intervenes while Wazzy is attending to the patient?
The team can take control of the conversation whenever they need to.
Wazzy is designed to coexist with human intervention and maintain the context of the conversation.
Patient transparency
Does the patient know they are talking to an artificial intelligence?
Yes.
In the first message, the patient is informed that the conversation is being handled by artificial intelligence.
Why is the patient informed that they are speaking with an AI?
Why the patient must know from the beginning that they are interacting with an artificial intelligence system.
Furthermore, the transparency obligations of Article 50 of the European Union Artificial Intelligence Act apply from August 2, 2026, for certain systems that interact directly with individuals.
Does the first message include data protection information?
Yes.
The first message can provide the patient with access to the clinic's data protection information.
Does the AI Act require including a data protection link in the first message?
Not exactly.
The obligation to inform that the patient is interacting with an artificial intelligence system and data protection obligations are related, but distinct, legal issues.
Facilitating access to data protection information in the first message is a practical way to reinforce transparency and patient information.
Are WhatsApp conversations visible to the clinic?
Yes.
Conversations managed through Wazzy can be viewed from the Reception Panel Inbox.
Are the conversations recorded?
Yes.
Conversations can be associated with the patient within Wazzy's operations, in accordance with the configuration and applicable policies.
Can Wazzy identify the patient by their WhatsApp number?
Yes.
The WhatsApp number serves as the primary contact identifier within the operation.
When several people share the same number, the medical CRM can use sub-files to differentiate them.
Meta restrictions, templates, and costs
Can Meta restrict a clinic's WhatsApp number?
Yes.
Meta applies its own policies and control mechanisms on the WhatsApp Business Platform and may impose restrictions when applicable.
Does using Wazzy and the official API completely eliminate the risk of restrictions?
No.
Using the official infrastructure reduces the risks associated with unauthorized solutions, but the clinic remains subject to Meta's policies and decisions.
Wazzy cannot guarantee that a number will never be restricted.
What happens if Meta changes its policies?
Wazzy adapts its operation to the current conditions of the WhatsApp Business Platform.
Meta's rules and requirements may change over time.
Do clinic-initiated messages require WhatsApp templates?
Yes. Certain clinic-initiated communications use WhatsApp Business Platform templates in accordance with Meta's current rules.
Who approves WhatsApp templates?
Meta reviews templates subject to approval and checks that they comply with its policies.
Can Wazzy help set up the templates?
Yes.
Wazzy can help prepare the necessary setup for clinic communications within the WhatsApp Business Platform rules.
Can a patient block the clinic's number?
Yes.
Like any WhatsApp user, the patient maintains the control options offered by the platform, including blocking a contact.
Wazzy cannot prevent that decision.
Can WhatsApp Business Platform generate additional costs?
Yes.
The WhatsApp Business Platform may generate messaging costs according to Meta's current rates and conditions.
Who pays the costs of WhatsApp?
Meta bills the clinic directly for the costs corresponding to the WhatsApp Business Platform.
Incidents and service continuity
What happens if WhatsApp goes down?
When an incident occurs on the WhatsApp Business Platform, certain messaging features may be affected even if Wazzy remains operational.
Wazzy relies on Meta's availability for those features that use WhatsApp.
What happens if Wazzy has an incident?
Automated monitoring can alert the technical team to investigate and handle the incident.
Are appointments lost if WhatsApp temporarily stops working?
Not simply because WhatsApp goes down.
Wazzy's calendar is independent of the WhatsApp channel, so a Meta outage may temporarily affect conversations or messages without implying the disappearance of registered appointments.
Do you want to keep exploring Wazzy?
Check how the AI assistant on WhatsApp, the schedule, the reception panel, the medical CRM, and the rest of the platform's functionalities work.
Spanish 
English