Privacy policy

This policy describes how Hopper Labs, Inc. handles the personal data it receives through the Chivo commercial website and its account and subscription portal: sign-up, sign-in, plan purchase, subscription management, the contact form and, if you accept them, measurement cookies on the public pages.

This website is separate from the Chivo clinical product and does not handle patient data. The processing of information that clinics record inside the clinical product is governed by separate documents [to be confirmed with legal counsel].

The controller of the personal data described in this policy is Hopper Labs, Inc.

Legal name

Hopper Labs, Inc.

Address

[Registered address to be confirmed]

Contact email

info@hopperlabs.io

We collect the data needed for this website's features and, only if you accept measurement cookies, data about your visit to the public pages. Depending on how you use the website, this may include the following.

Account

• Name and email address.
• Password: we store only a hash (an irreversible fingerprint), never the password in readable form.
• If you choose to sign in with Google or Facebook: your account identifier in that service and the basic profile data it shares (name, email and, if available, profile photo).
• Preferred language and time zone.
• Data about each signed-in session, such as IP address and browser type, which we use for security.

Subscription

• Clinic name, contact person's name, phone number, country and city.
• Expected number of users.
• NIT or other tax identifier, if you choose to provide it.
• Chosen plan, subscription status and the version of the purchase terms you accepted.

Payments

• Your card details are entered directly in Recurrente's payment form, embedded in the checkout page. Hopper Labs, Inc. does not receive or store the full card number.
• For your payment method we store only an identifier (token), the last 4 digits, the card network and its expiry date.
• For each charge we store the amount, date, status and the references of the receipt or tax document.

Contact form

• Name, email, message and language.
• A hash of your IP address, which we use to limit repeated submissions and prevent abuse.

Transactional emails

• The emails we send you about your account and subscription (for example, email verification, access recovery, activation and charges) are sent through an email provider (SMTP).
• We keep a record of each email sent: recipient, subject, content and status.

Technical logs

• Server and security logs needed to run and protect the website, such as requests, errors and sign-in attempts.
• A history of your subscription's status changes and of the team's actions on it.

Demos booked on Calendly

When you press “Book a demo” on the public pages, the scheduler of Calendly, an external service, opens in a window inside this website; in the portal and at checkout, or if you open the link in a new tab, it opens on Calendly. The scheduler only loads when you open it. That window shows a Calendly page, which loads Calendly's own analytics and advertising tools under its cookie policy; where it applies, Calendly shows you its own cookie choices inside the window. The data you enter there is received by Calendly under its own privacy policy, and the Chivo team receives the booking details in order to run the demo. This website does not read what you type in the scheduler: it only receives Calendly's notice that a demo was booked.

Measurement cookies (only if you accept them)

If you choose “Accept” in the “Measurement cookies” notice, the website's public pages load the Meta Pixel (from Meta Platforms) and the Google tag (Google Analytics 4, Google Ads or both). The notice says which providers the website uses. If you do not accept, they are not loaded. Through them, Meta and Google receive:

• The address and title of the public pages you visit, and the page you came from.
• If you arrived through a Meta or Google ad, the identifier of that click, which is kept in their cookies.
• Technical data about your browser and device, and your IP address, which Meta and Google receive when their tags load.
• Three actions: booking a demo in the Calendly scheduler inside the website (only the fact that it was booked, without your details), a click on a plan's purchase button (the plan and its price in USD), and sending the contact form (without the message or any other form data).
• Events that Google Analytics records automatically, such as the start of each visit, time on page, scrolling and clicks on links to other websites [Google Analytics enhanced measurement settings to be confirmed].

This website does not send your name, email or phone number to Meta or Google [confirm that Meta automatic advanced matching and Google automatic user-provided data collection are turned off]. The Meta Pixel's automatic configuration and Google Ads enhanced conversions are turned off. These tags never load on sign-in, sign-up, password recovery, email verification, checkout, the account portal or the admin panel, or in the Chivo clinical product with clinic or patient data.

• To create and maintain your account and give you access to the subscription portal.
• To process payments, schedule charges and send you receipts.
• To manually activate your access to the clinical product: the team reviews the subscription details before setting up your clinic.
• To communicate with you about your subscription: activation, charges, renewals, changes and cancellation.
• To answer the messages you send us.
• To protect the website and accounts, and to prevent fraud, abuse and automated submissions.
• To comply with legal, accounting and tax obligations.
• If you accept measurement cookies: to measure visits to the public pages and the results of our ads, and to show Chivo ads to people who visited the website.

Apart from the measurement cookies you accept, we do not use your data for advertising: your account, subscription, payment and message data are not shared with Meta or Google for advertising. Data stored inside Chivo (clinic, patients, records) is never used for advertising. We do not sell personal data.

We process your data because it is necessary to provide what you request (your account, your subscription or a reply to your message), to comply with legal obligations, and to keep the website secure.

Measurement cookies (Meta Pixel and Google tag) are based on your consent: they are only turned on if you choose “Accept”, and you can withdraw it at any time with the “Cookie preferences” button in the footer.

The applicable data protection law and the specific legal basis for each processing activity are [to be confirmed with legal counsel].

We share data only with the providers we need to run the website and, if you accept measurement cookies, with Meta and Google. Each one receives only the data it needs for its role.

Each provider handles data under its own terms and privacy policies; for Meta and Google, this includes the measurement data they receive. [Data processing agreements with each provider and the role of Meta and Google in the processing to be confirmed with legal counsel].

We may also share data when required by law or by a competent authority. We do not sell or rent personal data.

Some of these providers store or process data outside Guatemala or your country of residence. The website's database is on Supabase servers in the United States, and the website runs on Vercel, with servers in the United States and a delivery network in other countries. Meta Platforms and Google may also process outside Guatemala the measurement data they receive if you accept measurement cookies. [Server locations of the other providers and applicable safeguards to be confirmed with legal counsel].

• Account and subscription data: while your account is active and, afterwards, for [period to be confirmed].
• Charge and billing records: for as long as the law requires [period to be confirmed with legal counsel].
• Contact messages: for as long as needed to handle and follow up on your request.
• Technical and security logs: for as long as needed to run and protect the website.
• Sessions: expire no later than 14 days after your last activity, or earlier if you sign out.
• Measurement cookies: they last in your browser as stated in the Cookie policy (up to 2 years). Meta and Google keep the data they receive under their own policies [retention periods configured in Meta and Google to be confirmed].
• Your choice about measurement cookies: 12 months; after that, the notice asks you again.

We apply reasonable technical and organizational measures to protect personal data. For example, portal sessions use secure, http-only cookies, and your card details are entered directly in Recurrente's form.

No system is infallible. If a security incident affects your data, we will inform you as appropriate [procedure to be confirmed with legal counsel].

Please use a unique password and let us know at info@hopperlabs.io if you suspect unauthorized access to your account.

Subject to the applicable law, you may request:

• Access: to know what data we hold about you.
• Rectification: to correct inaccurate or incomplete data.
• Deletion: to have your data erased when it is no longer needed, except data we must keep by law.
• Objection: to object to certain processing.
• Portability: to receive your data in a commonly used format, where applicable.

You can also withdraw your consent to measurement cookies at any time with the “Cookie preferences” button in the footer, without having to write to us.

To exercise these rights, write to info@hopperlabs.io from the email address linked to your account. We may ask for additional information to verify your identity. Response time: [to be confirmed].

If you are not satisfied with our response, you may contact [authority or complaint channel to be confirmed with legal counsel].

This website is intended for clinics and health professionals. It is not directed at minors and we do not knowingly collect their data. If you believe a minor has sent us personal data, write to info@hopperlabs.io so we can delete it.

This website uses essential cookies and local storage to work. In addition, only if you accept the “Measurement cookies” notice, the public pages load the Meta Pixel and the Google tag, which set their own cookies. You can change your choice at any time with the “Cookie preferences” button in the footer. Details are in the Cookie policy.

If we update this policy, we will publish the new version on this page with its update date. If the change is relevant to you, we will notify you by email [criteria to be confirmed].

Controller

Hopper Labs, Inc.

Address

[Registered address to be confirmed]

Email

info@hopperlabs.io

You can also write to us from the contact page. Do not include patient data in your message.