Privacy notice

How we handle personal data.

Last updated: October 14, 2026. Prepared under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette of the Federation (DOF) on March 20, 2025.

This English text is an informational translation. The Spanish version is the one that is legally binding: read it in Spanish.

1. Who the data controller is

Ashura Design, S.A. de C.V., with RFC (tax ID) ADE2107126A9 and address at Puerto Rico 77, Col. El Marqués Queretano, C.P. 76085, Querétaro, Qro., is the controller of the personal data collected through https://zaki-ai.com.mx and the Zaki system. For any privacy matter: hola@zaki-ai.com.mx.

2. Two different kinds of processing

This notice covers two situations that should not be confused.

2.1 Data about whoever subscribes to Zaki

Name, email, phone number, legal name, RFC, address, billing details and system usage data. We process this data as controller, to provide the service, invoice it and support you.

2.2 Data about patients and clients

Your patients' information (including sensitive personal health data) and that of your clients and the opposing parties in your matters is processed on behalf of your organization, which is the controller with respect to those people. We act as processor: we store, process and protect that information following your instructions, and we don't use it for any purpose of our own. We don't sell it, we don't use it for advertising and we don't use it to train models.

2.3 When you buy setup

If you buy setup and hand us your databases (for example, your patient or client list, your schedule and your service catalog), we receive and import that personal data, which may include health data, as processor and on behalf of your organization. We use it only to load it into your account, for no other purpose. The working files you give us are deleted as soon as the import is done; from then on the information lives only inside your Zaki account.

3. What data is collected

• Identification and contact details of the subscriber and their authorized staff.
• Tax details for invoicing.
• Patients' health data when your organization runs a practice: medical history, assessments, notes, studies and consents.
• Data on clients, parties and opposing parties when your organization runs a law firm: identification, contact, tax details and the content of the case file.
• Technical records: logins, IP addresses and the log of operations and reads.

4. What it's used for

Necessary purposes: providing the contracted service, identifying each user, safeguarding and auditing the record, sending operational notices (appointments, deadlines, charges), invoicing and meeting legal obligations. There are no secondary purposes: we don't do marketing with your data or with your patients' or clients' data.

5. How it's protected

• Sensitive content is stored encrypted.
• Each organization has its own space inside Zaki: one organization's information is not visible to any other, and within each one, every provider sees only their own.
• Access is granted person by person, and revoking wins over granting.
• The log records reads as well as changes, and it can't be edited from within the system.
• Clinical content and case files are never deleted: there is logical deletion and five-year retention from the last action, as applicable regulations require.

6. Transfers

We don't transfer personal data to third parties for commercial purposes. We use infrastructure and communication providers strictly to run the service: hosting on IONOS servers in the United States, transactional email, WhatsApp (by Meta Platforms, Inc.) when your organization connects its own number to send notices, which receives the recipient’s phone number and the notice text, never clinical or case-file information, Google (Google LLC) when a provider connects their Google Calendar, which receives only the event data described in section 7, and the payment gateway (Stripe) used to charge the subscription. These providers act as processors. We may also transfer data when a competent authority requires it.

7. Google user data

Zaki connects to Google only if you choose to, and only in two ways. This section explains which Google user data we receive, what we use it for, and how we protect and delete it.

7.1 Which permissions we request and why

• Sign in with Google (openid, email and basic profile): we receive your Google account identifier, your email address and your name, only to recognize you when you sign in. It works only with existing Zaki accounts linked from “Mi cuenta” (My account): it doesn't create accounts, and two-step verification is still required.
• Google Calendar (calendar.events and calendar.calendarlist.readonly scopes): when you connect it, you choose which of your existing calendars your appointments are written to (your primary calendar by default) and which ones block your schedule. We read your list of calendars only so you can choose. In the appointments calendar, Zaki creates, updates and cancels the events for the appointments booked in Zaki; anything you create in that calendar blocks that time in Zaki (and you can record it as an appointment), and if you delete or move an appointment's event, the appointment is canceled or rescheduled in Zaki. From the other calendars you choose we only read busy times, without titles or descriptions.
• Each event Zaki writes to your calendar carries only the patient's or client's initials, the reference number, the service, the price, the payment status and the practice or firm. It never carries the reason for the visit, the diagnosis, or any data from the medical record or the legal matter.

7.2 How we use that data

• Only for the two features described above, which you turn on.
• We don't sell it.
• We don't use it for advertising of any kind, including personalized advertising.
• We don't share it with third parties, except the infrastructure providers that run the service (section 6) or when a competent authority requires it.
• We don't use it to develop, train or improve generalized artificial intelligence or machine learning models.
• No one on our staff reads it, except with your express consent to give you support, when needed for security, or to comply with a legal obligation.

7.3 How we store and protect it

The access tokens Google gives us are encrypted at rest and used only by our server: they never reach your browser. All communication with Google and with Zaki is encrypted over HTTPS.

7.4 Retention and deletion

We keep Google data only while the connection is active. You can disconnect Google Calendar at any time from Configuración → Integraciones (Settings → Integrations), your Google sign-in from “Mi cuenta” (My account), or either one from your Google account permissions. When you disconnect, we revoke the permission in Google and delete the tokens and the imported busy times; identifiers and other sync data are deleted within 30 days at most. To request deletion another way, write to hola@zaki-ai.com.mx.

7.5 Compliance

Zaki's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. ARCO rights

You have the right to access, rectify, cancel or object to the processing of your personal data (ARCO rights under Mexican law), and to revoke your consent. Write to hola@zaki-ai.com.mx with your name, the right you want to exercise and a way to reply to you. We answer within twenty business days at most.

If you are a patient or client of an organization that uses Zaki, send your request to that organization, which is the controller of your data. If you write to us, we'll help you route it.

If you believe your request was not handled or your right was infringed, you can turn to the Secretariat of Anti-Corruption and Good Governance (SABG, Secretaría Anticorrupción y Buen Gobierno), the authority for the protection of personal data held by private parties: www.gob.mx/buengobierno.

9. Portability and termination

Your organization can export all its information to CSV and JSON whenever it asks, at no cost. When the service ends, the full export is delivered and the information is kept only for the applicable legal retention period. To delete your account or disconnect your WhatsApp, follow the steps in delete your account.

10. Cookies and local storage

Neither this website nor the Zaki system uses advertising, analytics or tracking cookies, and there is no third-party measurement tool. We only store in your browser what is needed for them to work, so we do not ask for your consent for that.

• Public website: your language and currency choices are remembered in the browser's local storage (localStorage), and the exchange rate looked up is kept temporarily in session storage (sessionStorage), which is cleared when you close the tab. They are not cookies and they never leave your browser.
• Exchange rate: to show prices in another currency, your browser queries the public Frankfurter service (api.frankfurter.dev) for the exchange rate, which, by the nature of the connection, receives your IP address. We send it no other data.
• Zaki system (panel and portal): local storage holds your signed-in session, your language, the inactivity lock and a few screen preferences. Your session is removed when you sign out. Zaki's administration console, used only by our staff, uses a technical session cookie; and when you connect Google, a short-lived security cookie (30 minutes, inaccessible to page scripts) checks that the authorization comes back to the same browser.
• Payment: when you subscribe, we send you to Stripe's payment page, which has its own cookies under its own privacy notice.

You can clear storage and cookies from your browser settings; the site keeps working, but it will forget your language and currency.

11. Changes to this notice

Any change is published at this same address, with its date. If the change affects the purposes of processing, we notify you by email before it takes effect.

12. Governing law

This notice is governed by Mexican law. For any dispute, the parties submit to the courts of the city of Querétaro, Querétaro, waiving any other jurisdiction.