Privacy policy
Effective October 18, 2026. Covers the Devalis connection with Google Calendar.
Controller
Devalis. Contact email: contacto@devalis.cl.
Google data accessed
Devalis requests three permissions (scopes). Each professional accepts them on Google's consent screen when connecting their account.
| Scope | What it allows |
|---|---|
https://www.googleapis.com/auth/calendar.calendarlist.readonly | The list of calendars in the account, with their names, so the professional can choose which ones count as busy. |
https://www.googleapis.com/auth/calendar.events.readonly | Start and end time of the events in the calendars the professional marked as "Bloquea" (blocks availability), and change notifications for those calendars. |
https://www.googleapis.com/auth/calendar.app.created | Create the "Devalis · site" calendars and write appointments only in them. It gives no access to the professional's other events. |
Devalis does not read the "Devalis · site" calendars that it creates itself. No other permissions of the Google account are requested.
What it is used for
- To prevent Devalis from offering a patient a time when the professional is busy.
- To show in Google Calendar the professional's appointments that are in Devalis.
Google data is not used for any other purpose.
What is stored
- The account access authorization (token), encrypted.
- The email address of the connected account and the names of the calendars that are read.
- The start and end time of each busy period.
- The identifier of each event that Devalis writes to Google.
Titles, descriptions and guests are never stored: they are discarded when the event is read. The data is kept on Devalis servers in Google Cloud, Santiago region.
What is not done
- Google data is not sold.
- It is not used for advertising.
- It is not used to train or improve any artificial intelligence model.
- No person reads it, except in support and with the professional present.
- It is not transferred to third parties, unless the law requires it.
How long it is kept
Until the professional disconnects the account or the clinic removes the professional. Busy periods that have already passed are deleted daily.
How to revoke access
With the "Desconectar" (Disconnect) button in Ajustes › Profesionales › Agenda externa. Devalis revokes the authorization at Google and deletes the periods it read. The "Devalis · site" calendars stay in the professional's account, which owns them.
Access can also be revoked at https://myaccount.google.com/permissions.
Google API Services User Data Policy
Devalis's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Limited Use requirements:
- Google information is used only for the features described in "What it is used for".
- It is not transferred, except to provide those features, for security, or because the law requires it.
- No person reads it, except with the professional's consent, for security, or because the law requires it.
- It is not used for advertising.
- It is not used to develop, improve or train generalized artificial intelligence or machine learning models.
Patient data
Chilean Law 19.628 (protection of private life) and Law 21.668 (clinical records) apply. Devalis does not send clinical data to Google. The exception is what the professional's "Paciente" (Patient) setting allows, which the professional turns on.