Privacy Policy

1. Who is responsible

Turnavio.com is independently operated by Diego Bonnin, based in the Republic of Paraguay. For privacy questions or to exercise your rights, write to support@turnavio.com.

This policy distinguishes two roles. For the account data of the people who sign up for Turnavio (our customers: venues, professionals and their staff), we act as the data controller. For the appointment, patient and customer records that our customers enter into Turnavio, our customer is the controller and Turnavio processes the data on their behalf.

2. Data we process

• Account and authentication data: name, email address, telephone number (if provided), credentials managed by our identity provider, and language and date-format preferences.
• Subscription data: plan, status, billing period and invoice history. Card and bank details are collected and stored only by our payment provider; Turnavio never sees or stores them.
• Records entered by customers: venues, offices, professionals, patients or clients (for example name, document number, birth date, contact details), shifts, reservations and consent records.
• Notifications: email and SMS messages sent about shifts and reservations, and delivery metadata.
• Technical and audit data: access logs, IP addresses and an audit trail of access to patient records.

3. Why we use it

To provide and secure the service, authenticate users, manage subscriptions and invoices, send the notifications our customers ask the service to send, answer support requests, prevent abuse, and comply with legal obligations. We do not sell personal data.

4. Service providers

We rely on the following providers, which process data only to provide their service to us:

• Amazon Web Services (hosting, database, authentication through Amazon Cognito, email and SMS delivery, storage and logging; primarily the US East (Ohio) region).
• Lemon Squeezy (payment processing and Merchant of Record for subscription sales, under its own privacy policy).

5. International transfers

Our infrastructure is located in the United States and our operator is in Paraguay, so personal data is transferred across borders. We rely on the safeguards of our providers and on contractual commitments, and handle the data in line with applicable data-protection law, including Paraguay Law 7593/2025.

6. Retention and deletion

• Erased patient records are hidden immediately and irreversibly anonymized after 30 days.
• Unconfirmed sign-ups are deleted after 30 days.
• Application logs are archived for up to 180 days; notification queue entries expire after 7 days.
• Consent and audit records are kept as evidence of consent and access; invoices are kept as required for accounting.

7. Security

Data is encrypted in transit (HTTPS) and the database is encrypted at rest. Access is controlled by role-based permissions, least-privilege credentials and an append-only audit trail. No system is perfectly secure and we cannot guarantee absolute security.

8. Your rights

You may ask to access, correct, delete or restrict your personal data, to withdraw consent, or to object to processing, by writing to support@turnavio.com. If your data was entered by one of our customers (for example a clinic), please also contact that customer, who decides how it is used. You may also complain to the competent data-protection authority.

9. Cookies and local storage

See our Cookies page for the browser storage Turnavio uses.

10. Changes

We will update this policy when our practices change. The effective date and version are shown above.