Privacy policy

Last updated: November 9, 2026

This policy explains how ITX Support ("we") collects, uses, stores and protects information in Xpedi (https://expediente.itxsupport.com), a clinical record and scheduling application for clinics and health professionals.

1. Who is responsible

Each clinic that uses Xpedi decides what patient information it records and is responsible for it (data controller). ITX Support processes that information only on the clinic's behalf and to provide the service (data processor). For the accounts of the people who use the application (administrators, professionals and staff), ITX Support is responsible. Contact: dsoto@itxsupport.com.

2. Information we process

• User accounts: name, e-mail address, role, password (stored only as a secure hash) and, if they sign in with Google or Microsoft, the identity data those providers return.
• Patient information entered by the clinic or by the patient through the clinic's QR form: identification and contact data, health history, visits, diagnoses, prescriptions, dental and body charts, images and, where the clinic enables it, session recordings made with the patient's consent. This is sensitive health information.
• Appointments and the e-mails sent to patients (confirmations, reminders, welcome messages).
• Technical data: an audit log of actions (who did what and when, IP address) and a session cookie needed to keep you signed in. We do not use advertising or tracking cookies.

3. Google user data

Google is used in two places, both optional: (a) each professional may connect their own Google account to sync the clinic's appointments with Google Calendar and to send e-mails to their patients from their Gmail address; and (b) the platform administrator (ITX Support) connects one Google account of its own, the "system mailbox", used only to send account e-mails (the welcome letter and the link to create a password) to clinic administrators. Signing in with Google is also optional; anyone can sign in with an e-mail and password instead.

3.1 What Google data we access

Xpedi never reads, lists, searches or deletes Gmail messages and does not request permission to do so: patients answer appointment confirmations through a link in the e-mail. We do not create aggregated or anonymized data sets from Google user data.

3.2 How we share it

Google user data is not sold, rented or transferred to third parties, is not used for advertising, credit or lending decisions, and is not transferred to data brokers. It is shared only as follows, and only to provide the features above: busy blocks (without details) are shown to the other users of the same clinic; the e-mails the user sends reach the recipients they are addressed to; and our hosting provider, Microsoft Azure, stores our database and runs our servers under Microsoft's data protection terms. Authorized ITX Support staff may access it only when strictly necessary for security, for support the user requests, or to comply with the law. We may disclose it when a law or a competent authority requires it.

3.3 Artificial intelligence

Google user data, raw or derived, is not used to develop, improve or train artificial intelligence or machine learning models, and is not sent to third-party AI services.

3.4 How we protect it

• The Google refresh token is stored encrypted (Fernet: AES-128 with HMAC-SHA256) with a key that is not kept in the database. Short-lived access tokens are kept only in the server's memory.
• All traffic uses HTTPS (TLS), both between the browser and our server and between our server and Google.
• Each clinic's data is separated in the database by row-level security; inside the clinic, access follows the user's role, and the details of a calendar event are shown only to its owner.
• Actions are recorded in an audit log, and access to the production servers and database is limited to authorized ITX Support staff.

3.5 How long we keep it and how it is deleted

• Calendar events read from Google are not saved in our database: they are kept only in the server's memory for up to 30 minutes to avoid asking Google again on every page, and then discarded. The calendar list is kept in memory for up to 10 minutes.
• Events the application creates: we keep their Google event ID with the clinic's appointment, so we can update or delete it, for as long as the appointment exists. If the user turns one of their own Google events into a clinic appointment, that appointment is kept like any other clinic record.
• E-mails sent through Gmail: we keep only a log with recipient, subject, date and delivery status, as part of the clinic's records; we do not keep a copy of the message.
• Connection (refresh token, connected e-mail address and Google account ID): kept while the account stays connected. It is deleted immediately when the user presses "Disconnect" in «Email & Calendar» (or the administrator disconnects the system mailbox), when the user is deleted, or when the clinic's account is deleted (within 90 days of cancellation, see section 8). The user can also revoke access at any time at myaccount.google.com/permissions; the application then stops working with Google until it is connected again.
• To have all data associated with a Google account deleted, write to dsoto@itxsupport.com; we do it within 30 days.

3.6 Limited Use

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Xpedi's use and transfer to any other app of information received from Google APIs will adhere to the same policy.

4. Microsoft accounts

If a professional connects Outlook / Microsoft 365, we use it under the same rules as Google: sign-in, their calendar for the clinic's appointments and sending patient e-mails. With Microsoft we also read only the patients' replies to the confirmation e-mails the application sent (searched by the appointment reference in the subject) to mark the appointment as confirmed or cancelled.

5. How we use information

Only to provide and secure the service: keeping records and schedules, sending the communications the clinic configures, giving each person access according to their role, support, preventing abuse and meeting legal obligations. We do not sell personal information and do not use it for advertising.

6. Service providers

The application and its database are hosted on Microsoft Azure. E-mails are sent through the account each professional connects (Google or Microsoft). These providers process data only to provide their service to us. We may disclose information when required by law or a competent authority.

7. Security

Encrypted connections (HTTPS), encrypted storage of access tokens, passwords stored as hashes, separation of each clinic's data at the database level, role-based permissions, an audit log and backups.

8. Retention

We keep information while the clinic's account is active. When a clinic cancels, it can request an export; we then delete its data within 90 days, except what the law requires us to keep. Backups are deleted in their normal cycle.

Within the application, consultations are voided (not deleted) and clinical images are archived, so the record stays complete. The clinic, as the party responsible for its patients' records, must keep them for the period the law sets: in dentistry, at least 5 years after the last appointment (Code of Ethics of the Colegio de Cirujanos Dentistas de Costa Rica, art. 65). Before cancelling, it should export and keep them.

9. Your rights

Under Costa Rica's Law 8968 on the Protection of Personal Data and other applicable laws, you may request access, correction or deletion of your data. Patients should contact their clinic, which manages their record; we will help the clinic respond. Users of the application can write to dsoto@itxsupport.com.

10. Children

The application is used by clinics and professionals, not by children. Clinics may record information about minor patients with the authorization of their parents or guardians.

11. Changes

If we change this policy we will publish the new version on this page with its date, and we will notify administrators of significant changes.