Legal information

Privacy notice

How website, professional account and practice-managed clinical information is processed.

Updated September 16, 2026

Operation and contact

Endora is operated from Culiacán, Sinaloa, Mexico. Contact endoracloud@gmail.com about privacy.
Endora determines the purposes of account, purchasing and commercial inquiry processing. The practice determines the purposes of clinical record processing, and Endora processes those records on its behalf. This notice does not replace the notice each practice must give its patients.

Data needed for each feature

Registration uses a name, email address and account credentials. Practice setup adds professional and regional information.
Commercial inquiries require a name, email and message; phone number and practice name are optional. Do not include medical records, diagnoses, government identification or patient information in commercial inquiries.
When practices use clinical features, they process patient details, history, appointments, diagnoses, treatments, radiographs, images and reports. Health information is sensitive personal data.
Subscriptions involve plan details, transactions and payment references. Enter card information with the payment provider; do not send it through support email or forms.
Technical browser, request, IP address and access-event information is also processed to deliver and protect the service.

Purposes and optional choices

Account information is used to authenticate users, provide requested features, answer inquiries, manage payments and service communications, and prevent abuse.
Practices must have the authorization or legal basis required to process health information and share it through Endora. Do not upload information unrelated to authorized care or management.
Meta advertising measurement is optional and requires an affirmative choice. Declining does not prevent registration or service use. Clinical records are not used for advertising, and registration fields, passwords and clinical content are not sent as pixel event parameters.
A commercial inquiry is not treated as permission to enroll you in email marketing.

Providers and recipients

The service uses hosting, file storage, email and payment providers. Their involvement depends on the features used and the contracted configuration.
Stripe processes payments and subscription management when you use those features. Meta receives visit and registration events, browser identifiers and technical information when the pixel is enabled with your permission.
Practices may enable messaging or share reports with recipients they choose. They must check patient authorization, the recipient and access permissions first.
Following WhatsApp, social network or payment links, or authorizing an external video, takes you into an interaction governed by that provider’s privacy notice. Providers may process data outside Mexico. Ask about providers and processing locations before uploading information subject to territorial requirements.

Google Calendar integration

Connecting Google Calendar is optional. Only a professional can turn it on, from Endora and with their own Google account, and they can disconnect it at any time. The practice must have the applicable authorization for the patient's name to appear in the professional's calendar.
Endora uses this Google data: the email of the connected account, to show which account is linked; the events Endora creates in that calendar for each appointment, with the patient's name, appointment type, status and time, and no phone numbers, notes or clinical information; and changes made in Google to those same events, such as a new time or a deletion, to keep the practice's schedule up to date.
When an appointment is booked or rescheduled, Endora checks the busy and free intervals of the professional's calendar to warn about a possible conflict. It does not read titles, attendees or details of their events, and those intervals are not stored.
Endora receives changes to the connected calendar from Google but only processes the events it created. Every other event in the calendar is discarded: it is neither stored nor shown to anyone.
Endora stores the access credential Google grants in encrypted form, together with the identifiers of the events it created and their sync status.
Data received from Google is used only to sync appointments and warn about schedule conflicts. It is not sold, not used for advertising, not transferred to third parties except as needed to provide this feature or comply with the law, and not used to train artificial intelligence models. No one at Endora reads it except with your permission, to investigate a security issue, or when required by law.
To withdraw access, use Disconnect account in Endora, which revokes the permission with Google and erases the stored credential, or remove it at https://myaccount.google.com/permissions. Events already created remain in your calendar and you can delete them in Google Calendar. To delete the remaining integration data, email endoracloud@gmail.com.
Endora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Retention and account closure

Data is retained while providing the service and for periods required by legal obligations, security and claims. Retention varies by data category and applicable country.
Canceling a subscription does not delete clinical records. Clinical retention may be mandatory and must be coordinated with the responsible practice. Deletion requests also consider backups and retention obligations.
Instant deletion of every copy and unlimited retention are not promised. Coordinate return of your information and closure arrangements before ending the service.

Access, correction, deletion, objection and withdrawal

Email endoracloud@gmail.com with the subject Privacy, the right you wish to exercise, the related data or account and a reply address. In Mexico these are known as ARCO rights.
Your identity or authority will be proportionately verified before information is disclosed or changed. Do not send passwords or complete identity documents with your initial request; an appropriate method will be provided if needed.
Patient-record requests should be directed to the responsible practice. Endora can assist that practice without disclosing information to unauthorized parties.
Withdraw advertising permission on the cookies page or through Ad preferences. Withdrawal does not invalidate earlier processing. Applicable mandatory deadlines and rights, including additional rights available in your country, will be respected.

Changes

This page displays its update date. Consent will be requested before introducing new purposes that require it. See the cookies policy for browser technologies.