Privacy Policy

Last updated: November 4, 2026

Platform owner: Imeds Group LLC, 9100 S Dadeland Blvd, Suite 1500, Miami, FL 33156, USA · [email protected] · www.imedsgroupusa.com (product: Tavyk).

Two roles — please read carefully: (1) Tavyk platform data: for visitors to our site and for tenants' account users, Imeds Group LLC is the data controller. This policy covers that processing. (2) A tenant's end-customer data (leads/customers): the tenant is the controller; Imeds Group LLC (Tavyk) acts only as a processor and handles that data on the tenant's instructions. The consumer-facing privacy policy is published by each tenant, not by Tavyk.

1. Scope

This policy describes how Imeds Group LLC (Tavyk) collects, uses, shares and protects personal information when you (a) visit our site or use the platform as a tenant's user, (b) contact us, or (c) when we process data on behalf of a tenant (as a processor).

Multi-country. Your rights and the applicable law depend on your country: USA (CCPA/CPRA and state laws), Mexico (LFPDPPP), Colombia (Law 1581 — habeas data), Spain/EU (GDPR/LOPDGDD). See §7 and our policies.

2. Information we collect

• What you give us: name, phone, email, address and preferred language.
• From your interaction: appointment and activity history, call recordings (with notice), messages.
• Automatic: device, IP, cookies and site analytics.

3. How we use it

To handle requests; schedule appointments; send you marketing communications only with your consent; comply with legal obligations; operate, secure and improve the service.

4. How we share it

• Service providers (processors): we use telephony/SMS/voice, email, payments, hosting/CDN and artificial intelligence providers, under data processing agreements (DPAs) that limit their use to providing the service to us.
• Artificial-intelligence processing (knowledge base / RAG): so the tenant's AI agents can work, Tavyk processes the tenant's own business information (documents, materials and data the tenant uploads to train and give context to its agents) with AI providers that generate representations for search and indexing and, where applicable, convert documents to text. This is not about collecting the tenant's end-customer information: it is the content the tenant provides about its business. Where it is processed: on those providers' infrastructure, under contract that prohibits them from using the data to train their models and limits their retention. It is not used for advertising purposes.
• Bot protection (Cloudflare Turnstile): to protect access, forms and the widget against bots and abuse, we use Cloudflare Turnstile. Turnstile processes technical signals ("Signals") such as the IP address, the TLS fingerprint, the User-Agent and the Sitekey and its origin, for the sole purpose of distinguishing humans from bots; according to Cloudflare, it does not allow directly identifying the person. Cloudflare acts as a processor when it processes those signals to protect our site (we are the controller) and as a controller when it uses them to improve its own bot detection. These signals are strictly necessary for security and are not used for advertising purposes. Details in the Cloudflare Turnstile Privacy Addendum.
• Our own anti-bot verification: we evaluate ephemeral, hashed technical signals (e.g. ASN, submission speed, honeypot) to score risk; we do not create a persistent device fingerprint or profile the person.
• As required by law: authorities when required.
• We do not sell your personal information.

5. Retention and security

We keep data for as long as necessary for the purposes described and to comply with the law. Measures: encryption of secrets (AES-256-GCM), per-tenant access control (multi-tenant RLS), audit logging. No system is 100% secure.

Knowledge base (RAG): the material the tenant uploads about its business and its indexed text are kept for as long as needed to operate its agents. The tenant can request its deletion; when a source is deleted, we remove both the stored file and the indexed fragments derived from it. Details of timelines and process are in the Knowledge Base Retention and Deletion Policy.

6. Marketing communications and consent (multi-country)

The business (tenant) contacts you by SMS/call/WhatsApp/email only on the legal basis of your country: USA prior consent (in writing for automated/AI-voice marketing); Mexico consent under the LFPDPPP and respect for the REPEP; Colombia prior, express and informed authorization (Law 1581); Spain LSSI/GDPR consent and checking the Lista Robinson. Consent is not a condition of purchase. You can opt out at any time (STOP/UNSUBSCRIBE, ask during the call, or the unsubscribe link in the email). Country-specific wording and rules are in our policies.

7. Your rights (by country)

Depending on your country you can exercise, at a minimum:

• USA (CCPA/CPRA, CA and other states): to know, access, correct, delete, opt out of "sale/sharing", limit the use of sensitive data, and not be discriminated against.
• Mexico (LFPDPPP): ARCO rights (access, rectification, cancellation, opposition) and withdrawal of consent.
• Colombia (Law 1581): to know, update, rectify, revoke the authorization and request deletion (claim under art. 15).
• Mexico (authority): data protection held by private parties is overseen by the Secretaría Anticorrupción y Buen Gobierno (which assumed the functions of the former INAI; LFPDPPP published March 20, 2025).
• Spain/EU (GDPR): access, rectification, erasure, objection, restriction, portability and to withdraw consent; to lodge a complaint with the AEPD.

To exercise them: [email protected]. We verify your identity before responding. Reference timelines: ~45 days (CCPA), 1 month (GDPR).

EU representative (GDPR art. 27): when offering services to Spain/the EU, Imeds Group LLC designates a representative in the European Union (to be appointed).

8. Cookies

We use necessary and analytics cookies. You can manage them in your browser.

9. Changes and contact

We may update this policy; we will post the date. Questions: [email protected].