Data Deletion

The answer depends on who is asking, and sending it to the wrong place only delays things.

Patient → ask the doctor or clinic treating you. They are the controller of your data: they decided to collect it and they can erase it. Waterfall only operates the system on their behalf and cannot erase patient data on its own initiative.

Zenda user (assistant, secretary) → ask us.

Doctor or clinic wanting to leave and take the data → ask us, through whoever administers the account.

This is a translation provided for convenience. The service is operated from Brazil under Brazilian law; in case of any conflict, the Portuguese version prevails.

Contact the practice that treats you. Any channel works — including replying in the WhatsApp conversation itself: “please delete my data”.

The professional carries out the deletion inside Zenda, covering the messages, the record and the treatment history held by that practice.

If you write to hello@waterfalltech.xyz by mistake, we forward it to the controller and tell you where it went. We do not decide about data that is not ours — but we do not let the request die either.

If you do not know who to contact, or the practice does not reply, write to us anyway. We will help identify the controller.

Email hello@waterfalltech.xyz from the address registered on the account — that is how we confirm the request is yours.

• Subject: “Data deletion”.
• Say whether you want to erase your user account or the whole operation, with its clients and conversations.
• We acknowledge within 2 business days.
• We execute within 15 days, and confirm in writing when it is done.

You are the controller of your patients' data. At any time, free of charge, you may request:

• Export of everything Zenda holds about your practice — conversations, records, appointments — in a machine-readable format.
• Erasure of that data, carried out within 30 days.
• Export followed by erasure, which is the normal path when a relationship ends: you take the history and we delete our copy.
• The request may come from you or from whoever administers your Zenda account. Write to hello@waterfalltech.xyz.

Messages travel through WhatsApp, so part of the data sits in Meta's infrastructure — and that part is not under our control. Deleting from Zenda does not delete from WhatsApp.

For data Meta processes on its own account, the request goes to Meta through its own channels. If you disconnect the number from Zenda we stop sending and receiving on it immediately, but what has already passed through Meta follows Meta's rules.

The doctor's phone also keeps its own copy of the conversations in the WhatsApp Business app. That copy is theirs, on their device, and is deleted there.

Deletion is broad but not absolute — the LGPD itself (art. 16) preserves what the law requires to be kept. The following remain:

• Application access logs, for six months, under the Internet Civil Framework (art. 15). A legal obligation that cannot be waived on request.
• Evidence that the request was fulfilled — date, type of request and confirmation — without the deleted content. It is what lets us demonstrate we complied.
• Data the controller is required to keep under professional council rules, such as medical record retention where applicable.
• Backups may hold the data for up to 30 further days, unused, until normal rotation. They are not consulted for any other purpose.

hello@waterfalltech.xyz — Waterfall, CNPJ 42.804.319/0001-10, Rio de Janeiro, Brazil.

Data protection officer: Marcos Nunes.

You may also petition Brazil's data protection authority, the ANPD (gov.br/anpd), directly — you do not have to come to us first.