Privacy Policy

1. Who we are

FlowTrack is a SaaS electronic case management application. It operates as a data processor under Chile's Law 21.719 on Personal Data Protection. The institution contracting the service (hospital, municipality, company) acts as the data controller.

2. Personal data we process

As part of the service, FlowTrack processes the following data of the system users (institution employees):

• Full name and email address
• Job title and organizational area
• Contact phone number (optional)
• Log of system actions (who did what and when)
• IP address and user-agent of sessions

Cases may contain additional data depending on what the institution records in the system.

3. Purpose of processing

Data is processed exclusively to:

• Authenticate and authorize access to the system
• Record case traceability
• Send internal notifications about process status
• Comply with applicable legal obligations

It is not used for advertising, nor shared with third parties except where legally required.

4. Legal basis for processing

Data processing is carried out under the following legal bases per Law 21.719:

• Contract performance: necessary to provide the service contracted by the institution
• Legitimate interest: audit records and system integrity
• Legal obligation: when sector-specific regulations apply

5. Retention periods

Data is retained for the duration of the contract with the institution, plus up to 24 months afterward for backup and audit purposes. After that period, it is permanently deleted or anonymized.

6. Third-party integrations

FlowTrack integrates with the public API of Mercado Público (Chile Compra) solely to look up tender and purchase order data. This is a read-only query and no user data is sent to the API.

El sitio público de FlowTrack (esta página y flowtrack.cl) utiliza Google Analytics (Google LLC) para registrar visitas y medir tráfico y comportamiento de navegación de visitantes — páginas vistas, clics, origen de la visita, tipo de dispositivo — con fines estadísticos y de campañas de marketing. Son datos agregados de navegación, no se cruzan con información de usuarios del sistema. Google Analytics is not present inside the case management platform (una vez que inicias sesión) — solo en las páginas públicas, antes de acceder al sistema. Puedes revisar la política de privacidad de Google en policies.google.com/privacy.

Este tratamiento se basa en nuestro interés legítimo en conocer y mejorar el uso del sitio público (art. 4 y 8, Ley 21.719). Por eso Google Analytics se activa automáticamente al abrir el sitio, sin esperar una aceptación previa. Si no deseas que se registren tus datos de navegación, puedes excluirte en cualquier momento con el botón "No quiero que registren mis datos" del aviso que aparece en pantalla, o escribiendo a privacidad@flowtrack.cl — tu decisión queda guardada en tu propio navegador y se respeta desde ese momento.

7. Security

• Role- and permission-based access (principle of least privilege)
• Immutable log of all actions (audit trail)
• Passwords stored with bcrypt hashing
• Encrypted communications via HTTPS (TLS)
• Data isolation between institutions (multi-tenancy)

8. Data subject rights

Under Law 21.719, you have the right to:

• Access: know what data we hold about you
• Rectification: correct inaccurate data
• Cancellation/Deletion: request the deletion of your data
• Objection: object to processing in certain cases
• Portability: receive your data in a structured format

To exercise these rights, contact your institution's administrator or write to us at privacidad@flowtrack.cl.

9. Contact

For questions about privacy and data protection:
Email: privacidad@flowtrack.cl
Web: flowtrack.cl

10. Updates to this policy

We may update this policy to reflect legal or service changes. The current version will always be available on this page. Users will be notified of material changes and asked to re-accept when necessary.