---
title: "Privacy and data"
description: "How Arbol looks after your organization's and your patients' data, who answers for it and where the governing policies are, in plain words."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.getarbol.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy and data

Arbol works with your patients' data: their conversations, their appointments, their records. This section explains, in plain words, what data each application keeps, who sees it, what the AI does with it, how long it's kept and what to do when a patient asks about theirs.

> **This section informs; it isn't legal advice**
>
> It summarizes what the applications do and what Arbol's public pages say. What governs is the [Privacy Policy](https://www.getarbol.com/privacy/), the [Terms of Service](https://www.getarbol.com/terms/) and your organization's contract with Arbol. For a legal question, read the privacy policy and ask the team at your institution that handles data protection.

## Who answers for the data

Arbol's privacy policy for Colombia (in Spanish) follows Ley 1581 de 2012, Colombia's data protection law, and splits the roles like this:

| Who | Their role | What it means |
| --- | --- | --- |
| **Your institution** | Controller (*responsable*) of its patients' data | Decides what its patients' data is used for and collects their authorization. |
| **Arbol** | Processor (*encargado*) of that data | Handles it on your institution's behalf, under its instructions and under a signed data transmission agreement. |
| **The patient** | Owner (*titular*) of their data | Can know it, update it, correct it and ask for it to be deleted, as the policy explains. |

For your own account's data, such as your name and email, Arbol is the controller.

## The essentials

The privacy policy sums it up in four sentences, its "short version":

> We collect what we need to run the service. We don't sell data. Your patients' data belongs to you and your patients. Everything can be exported or deleted.

And in the applications it looks like this:

- **Each organization sees only its own.** Everything you do in Arbol is for the organization you chose when you signed in; another organization doesn't see your data, and you don't see theirs.
- **Your role decides what you see.** Within your organization, each person sees what their role allows. See [Who sees the data](/en/get-started/privacy/who-sees-data/).
- **What your team does is recorded** with the name of whoever did it, such as who booked an appointment or who corrected a piece of data.
- **The AI doesn't decide for your team**, and the policy says Arbol doesn't use your patients' data to train third-party models. See [AI and your patients' data](/en/get-started/privacy/ai-and-data/).

## In this section

- **What data Arbol keeps** — Conversations, recordings, appointments, records, notes and files, application by application.
- **Who sees the data** — Your organization, your team's roles, Arbol's team and the connected systems.
- **AI and your patients' data** — What the AI does with data, what it doesn't and what your team controls.
- **Keep, export and delete** — How long data is kept, what you can download and what happens when you delete.
- **When a patient asks about their data** — Knowing, correcting or deleting their data, or not being contacted again: what to do and who to ask.

## Arbol's public pages

| Page | What you'll find |
| --- | --- |
| [Privacy Policy, Colombia](https://www.getarbol.com/privacy/) (in Spanish) | What data Arbol collects, what for, who it shares it with, how long it keeps it and the rights of the people it belongs to. |
| [Trust Center](https://www.getarbol.com/legal/trust-global/) | How Arbol protects data, for your institution's IT team and whoever handles data protection. The Colombian version is at [Centro de confianza](https://www.getarbol.com/legal/trust/), in Spanish. |
| [Security](https://www.getarbol.com/en/security/) | How to report a security flaw and how to recognize the sites and messages that really come from Arbol. |
| [Terms of Service, Colombia](https://www.getarbol.com/terms/) (in Spanish) | What the platform does, what it doesn't and what happens to your data. |

If your organization's relationship with Arbol is governed by U.S. law, read the [U.S. version of the privacy policy](https://www.getarbol.com/en/privacy/). For questions about your data, write to [support@getarbol.com](mailto:support@getarbol.com).

> **If a patient's data reached the wrong person**
>
> Tell whoever administers Arbol at your organization and Arbol's team right away, and follow your institution's procedure. The steps are in [Safe use and patients' data](/en/get-started/safe-use/).

Source: https://docs.getarbol.com/en/get-started/privacy/index.mdx