Last updated: 2026-09-28
Version: 2.1.3
This is an informational translation. The binding text is the Spanish original — in the event of any discrepancy, the Spanish version prevails.
This is an informational English translation of revision 2.1.3. The binding text is the Spanish original, available at app.toniagent.com/legal/terms-of-services; in the event of any discrepancy, the Spanish version prevails.
These Terms of Service ("Terms") govern access to and use of the ToniAgent service, offered by Productivity Agents SL, with registered address at Carrer Santa Eulalia 5, 08195, Sant Cugat del Vallès (Spain) ("the Company").
By registering on the platform and activating the service, the Client accepts these Terms and confirms having read and accepted the Data Processing Agreement (DPA).
ToniAgent is a virtual voice agent that can:
The service is provided on a SaaS basis.
The Client acknowledges and accepts that ToniAgent acts as virtual administrative staff, following instructions defined by the Client.
The Company does not provide healthcare services and does not take clinical decisions. To manage the Client's schedule it may process health data (the reason for a visit, the notes on an appointment, the management software's database if the Client enables its backup); that processing is carried out on the Client's behalf, for administrative purposes, in accordance with the DPA.
ToniAgent informs the caller, at the start of every call, that they will be attended by an artificial-intelligence assistant and that the call may be recorded, in accordance with Article 50 of Regulation (EU) 2024/1689. This notice is enabled by default. It should be disabled (by the Client from the control panel, or by the Company at the Client's request) only where the Client's own system gives the caller that same information before transferring the call; in that case the Client assumes the duty to inform under clause 13 of the DPA.
Using ToniAgent requires:
The Client is responsible for keeping their credentials confidential.
4.1 Billing model: Monthly fees according to the contracted package. Discount for annual payment. Overage charges for additional call minutes.
4.2 Automatic renewal: Plans renew automatically unless cancelled beforehand.
4.3 Cancellation: Monthly cancellation with no minimum term. For annual plans already paid, no refunds are issued; cancellation affects the renewal only.
4.4 Payment methods and invoicing: Payments are processed through Stripe Payments Europe, Ltd., which acts as a payment service provider under its own terms. The Company does not store full card details; it keeps only the customer and payment identifiers that Stripe returns to it. Invoicing and accounting are managed with Holded Technologies, S.L. These providers process the Client's data (contact and billing details), not patient data, and that processing is governed by the Company's Privacy Policy rather than by the DPA.
The Client undertakes to:
The Client may connect ToniAgent with third-party systems they already use: their clinical management software, calendars and messaging. By activating an integration, the Client instructs the Company to exchange data with that system under the terms of Annex I to these Terms, which describes, for each category of connectable system, the direction of the data flow, the categories of data exchanged, the type of credentials used and how they are safeguarded, the optional functions, and the effect of disconnecting. The list of specific systems supported at any given time is published in the control panel.
The Client authorises the Company to:
The Client expressly acknowledges and authorises that:
6bis. Nature of the connected systems. The provider of a system the Client connects (their clinical management software, their Google account, their WhatsApp Business account) is the Client's provider and not a subprocessor of the Company: the contractual relationship and the terms of use are those the Client already has with that provider. Where the Company needs a provider of its own to operate an integration, that provider will appear in the Subprocessor List.
The Company guarantees 99.9% annual service availability.
Excluded are: failures arising from third parties (AWS, Twilio, ElevenLabs or equivalent providers), scheduled maintenance announced in advance, and failures arising from the Client's own configuration.
Also excluded are interruptions or limitations caused by the clinical management system connected by the Client or by its provider, including the withdrawal or modification of access by that provider.
All ToniAgent software, models, content and documentation are the exclusive property of the Company. The Client retains the rights to their own data and content.
The Client authorises the Company to display their name and logo as a ToniAgent client and to use it in commercial presentations, client listings, case studies, marketing materials and on the website. The Client may revoke this permission in writing at any time by contacting privacy@toniagent.com; the Company will stop using it in new materials and will remove it from its website within a reasonable period.
To the maximum extent permitted by law: the Company will not be liable for indirect damages, loss of Client data or loss of profit. The Company's total aggregate liability is limited to an amount equivalent to one (1) month of the contracted service.
The Client accepts the use of the providers detailed in the Subprocessor List . International transfers are carried out under Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework, always prioritising European Union regions where possible.
The processing of personal data carried out by ToniAgent is governed by the Data Processing Agreement (DPA), which forms an integral part of these Terms.
These Terms remain in force for as long as the Client uses the service. The Client may cancel at any time from the control panel.
The Company may update these Terms and the DPA. It will give notice of changes at least fifteen (15) days before they take effect, by email to the account owners and by publication in the control panel, stating the effective date and a summary of the changes. Before that date the Client may object in writing or terminate the contract without penalty, with a pro-rata refund of any amounts paid in advance. Once the effective date has passed without objection, continued use of the service constitutes acceptance of the new version, which the Company records together with the evidence of notice. The version in force and previous versions are available at all times at app.toniagent.com/legal/terms-of-services.
These Terms are governed by Spanish law. Any dispute will be submitted to the courts of Barcelona, unless the law requires another jurisdiction.
This Annex describes what happens when the Client connects a third-party system, whichever system it is. It applies only to the integrations the Client activates.
The list of systems supported at any given time is published in the control panel, in the Integrations section. That list may be extended without amending these Terms: adding a further system within a category already described does not alter the categories of data, the safeguards or the rights set out in this Annex. A new version of the Terms, in accordance with clause 15, will however be required to add a category of integration other than those described here, or an optional function that processes categories of data not covered by this Annex.
For every integration: synchronised data is stored in AWS eu-west-1, credentials are encrypted with AES-256, and on disconnection the synchronised data and the credentials are deleted in accordance with clause 9 of the DPA.
A. Clinical management software
| Direction | Read and write |
| Data imported | Professionals, services, schedules and working hours, appointments and patient data (name, telephone numbers, email, date of birth, national ID and notes, depending on what the source system holds) |
| Data written | Appointments created, modified or cancelled by the agent |
| Credentials | Depending on the system: username and password, API key, token, or database credentials |
| Notes | Appointment notes are stored exactly as the source system returns them and may contain healthcare identifiers (for example, the CatSalut CIP) |
A.1 Systems installed at the clinic. Where the system is not a cloud service but a program installed on the Client's own premises, the connection is made through an encrypted point-to-point tunnel operated by a provider of the Company that has no access to the content of the traffic (see the Subprocessor List).
A.2 Database backup (optional, disabled by default). This function is available for some systems installed at the clinic; the control panel indicates whether it is available for the Client's system. If the Client enables it, the Company makes a full copy of that system's database every night, including all the clinical and administrative data it contains, and stores it encrypted (AES-256) in AWS eu-west-1 for 30 days, after which it is deleted automatically. Its sole purpose is disaster recovery at the Client's request. The Company does not access the content of the copy except to perform a restoration requested in writing by the Client, which will be delivered as exported files within 5 business days. This function does not replace the Client's own backup obligations and does not constitute a guarantee of recovery; the limitation of liability in clause 11 applies in full. On disabling it or disconnecting the integration, existing copies expire within the stated period and no new copies are made.
A.3 Proxied browser-based integrations. Some systems offer no programming interface for third parties, so the connection is made through an automated browser that operates the Client's own user session, with the credentials the Client provides. Traffic is routed through the network of a provider of the Company (see the Subprocessor List); the connection to the target system is encrypted end to end, so that provider has no access to its content. The operation of this integration depends on the system's provider continuing to allow it and may be interrupted without notice.
B. Google Calendar
| Direction | Read and write |
| Authorisation | OAuth 2.0, `calendar.readonly`, `calendar.events` and `userinfo.email` scopes |
| Data imported | Calendar and event metadata (title, description, location, dates, status, organiser, attendees, recurrence) |
| Data written | Events created, modified or cancelled by the agent, including the patient's name and telephone number |
| Effect of disconnecting | Tokens, metadata and synchronised events are deleted. Events created in the Client's calendar remain there |
C. WhatsApp
| Account | The WhatsApp Business account is the Client's, who accepts Meta's terms when connecting it |
| Sending | Through the WhatsApp integration of the voice agent platform (see the Subprocessor List) |
| Messages to staff | End-of-call notice and a summary of what was handled, which may include the patient's name |
| Messages to patients | Appointment confirmation request, if the Client enables it |
| Client's obligation | Ensure that the staff whose numbers they register have agreed to receive these messages, and that their own terms inform the patient of contact through this channel |
This Privacy Policy describes how Productivity Agents SL ("the Company", "ToniAgent", "we") collects, uses, stores and shares personal information.
It is addressed to two distinct audiences: control panel users (the clinic staff who sign in to ToniAgent), and users of the Google Calendar integration. Patient data is processed on behalf of the clinic and is governed by the DPA, not by this policy.
This section describes what we process about you as a control panel user, with the Company acting as controller.
First name, surname, email address, role, associated clinic, and registration data (IP address and sign-up date, kept as evidence of acceptance of these Terms). Legal basis: performance of the contract. Retained for as long as the account is active.
We do not use advertising, profiling or cross-site tracking cookies.
The panel uses PostHog (EU servers) to:
This information is associated with your internal user identifier, your clinic identifier and your email address. Except as described for surveys, it stores nothing on your device, and it does not affect patient data.
It is carried out on the basis of the Company's legitimate interest in deciding which features to show you and in understanding and improving how the panel is used (Art. 6(1)(f) GDPR), having weighed that content is masked before it leaves your browser, that it is not used for advertising or disclosed to third parties other than the processor, and that it is limited to your activity as a panel user.
You may object at any time to usage measurement, session replay and surveys, without having to give a reason and with no consequence for the service, by writing to privacy@toniagent.com. The check of enabled features is necessary for the panel to work and is kept.
We record panel errors and load times in order to detect and fix faults, together with your IP address, browser type and internal user identifier. The provider is New Relic (EU servers).
This monitoring stores nothing on your device: it uses neither cookies nor local storage. It is carried out on the basis of the Company's legitimate interest in keeping the service stable and secure (Art. 6(1)(f) GDPR), having weighed that it is limited to technical data, is not used for profiling or advertising, and does not affect patient data.
You may object at any time, without having to give a reason and with no consequence for the service, from the Privacy page of the panel. When you do so, the monitoring agent stops loading.
With the providers that operate the panel, acting as processors: AWS (hosting, EU), PostHog (enabled features and panel usage, EU), New Relic (monitoring, EU), and AWS Cognito (authentication, EU). For the clinic's invoicing, with Stripe and Holded in accordance with clause 4.4.
You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacy@toniagent.com . You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
This section applies only if you choose to connect your Google Calendar account to ToniAgent. If you do not connect it, we do not access any data in your Google account.
If you choose to connect it, we access the following Google user data through the Google Calendar API:
1. Google Account Information:
Your Google email address (used to identify and associate your Google Calendar with your ToniAgent account).
2. Calendar Metadata:
Calendar IDs and names, calendar descriptions, time zone settings, calendar colours (background and foreground), primary calendar indicator.
3. Calendar Events:
Event titles (summary), event descriptions, event locations, start and end times (including all-day event indicators), event status (confirmed, tentative, cancelled), organiser email addresses, attendee information (email addresses and response status), recurrence rules (for recurring events), links to events in Google Calendar.
When you interact with the ToniAgent AI assistant for calendar management, the AI agent processes:
This data is processed in order to carry out your calendar management requests and is subject to the same security and privacy protections as other Google Calendar data.
We use your Google Calendar data for the following purposes:
1. Displaying Calendar Events:
Showing your calendar events within the ToniAgent application interface so that you can see your schedule alongside your other tasks and activities.
2. Local Synchronisation:
Synchronising and storing your calendar events locally in our database for faster access and better performance. This lets you view your calendar without repeated calls to the Google API.
3. Event Notifications (Optional):
If enabled, we configure webhook notifications from Google Calendar to receive real-time updates when your events change, keeping your synchronised events up to date.
4. Calendar Management by the AI Agent:
When you interact with the ToniAgent AI assistant, the agent may carry out the following actions in your Google Calendar on your behalf and with your explicit authorisation:
How AI Agent Modifications Work:
Important Safeguards:
Your Google Calendar data is stored in a PostgreSQL database hosted on Amazon Web Services (AWS) in the Ireland region (eu-west-1). We store three types of data:
We use Amazon Web Services (AWS) as our hosting and database provider. Your Google Calendar data is stored on AWS servers located in the Ireland region (eu-west-1) within the European Economic Area (EEA). AWS acts as a data processor under our Data Processing Agreement (DPA) and is subject to AWS's GDPR-compliant terms.
To handle a call, the voice agent needs to know which slots are free and, if the caller asks about their own appointment, whose name it is under. Therefore, while the integration is active:
This derived data is processed by ElevenLabs (the voice agent platform) and by the language models it uses, as well as by Amazon Bedrock in the post-call analysis, with language models AWS runs within the EU. None of these providers uses this data to train their models; see clause 5bis of the DPA.
We do not transfer the full content of your events to those providers: neither the titles, nor the descriptions, nor the attendees, nor the names of your calendars. We do not share your Google Calendar data with advertising networks or marketing platforms, and we do not use it to train artificial intelligence models.
ToniAgent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we only use Google Calendar data to provide and improve ToniAgent's user-facing features; we do not transfer it to third parties except to provide those features (the providers named in this policy), for security purposes, to comply with applicable law, or with your consent; no human reads it except with your consent, for security purposes, to comply with applicable law, or in aggregated and anonymised form; and we do not use it for advertising or to train or develop generalised artificial-intelligence or machine-learning models.
When you authorise ToniAgent to access your Google Calendar, our AI assistant can perform calendar management tasks on your behalf, including:
You have full control over your Google Calendar integration:
Revoke Access at Any Time:
You may disconnect your Google Calendar account from ToniAgent at any time through the Integrations page in your account settings. Disconnecting will immediately delete all OAuth tokens, calendar metadata and synchronised events from our database.
Granular Control:
You may choose which specific calendars to synchronise with ToniAgent. You may disconnect individual calendars while keeping other calendars connected.
Google Account Settings:
You may also revoke ToniAgent's access to your Google Calendar directly through your Google Account settings at myaccount.google.com/permissions . Revoking access through Google will prevent ToniAgent from accessing your calendar data, but you should also disconnect the integration within ToniAgent to delete the locally stored data.
Data Portability:
Your calendar events remain in your Google Calendar at all times. You may export your calendar data directly from Google Calendar using Google Takeout ( takeout.google.com ).
GDPR Rights (EEA Users):
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. We will notify you of any material change by publishing the new policy on this page and updating the "Last updated" date at the top.
If you have questions about this Privacy Policy or about how we handle your data, please contact us at:
Productivity Agents SL Carrer Santa Eulalia 5 08195 Sant Cugat del Vallès, Spain Email: support@toniagent.com · Privacy: privacy@toniagent.com
This Data Processing Agreement ("DPA") forms part of the Terms of Service accepted by the Client when registering on the ToniAgent platform, offered by Productivity Agents SL, with registered address at Carrer Santa Eulalia 5, 08195, Sant Cugat del Vallès (Spain) ("the Processor").
The Client ("the Controller") accepts this DPA on activating the service.
This DPA governs the processing of personal data carried out by the Processor on behalf of the Controller through the use of ToniAgent. Processing takes place for as long as the Controller keeps their account active.
ToniAgent processes personal data for the following purposes:
The processing does not include the provision of healthcare services. Health data is processed exclusively on an administrative basis and under the Controller's instructions, to the extent described in clause 4.
Patient / end-user data: name and contact details, reason for the visit or enquiry, national ID or other identifiers (if provided by the end user or by the connected clinical management system), date of birth, the full content of the conversation (voice and/or text), call transcripts and recordings, information derived from conversational analysis (sentiment, urgency, context), and appointment notes exactly as returned by the connected clinical management system, which may contain healthcare identifiers.
If the Controller enables the database backup (Annex I, A.2), the processing additionally includes the entire content of that database, including any clinical data it contains, for the sole purpose of disaster recovery.
Controller's staff data: name, email, role and availability for scheduling appointments, and the telephone number of the people the Controller registers to receive WhatsApp notifications.
Technical data: usage logs, call metadata, timestamps, access IP addresses.
ToniAgent may process special categories of data, including health data, to the extent necessary to carry out the Controller's administrative instructions: the reason for the enquiry expressed by the patient, the content of the conversation and its transcript, the information derived from its analysis, appointment notes exactly as returned by the connected clinical management system and, if the Controller enables the backup in Annex I (A.2), the entirety of that database. The processing is for exclusively administrative (not clinical) purposes, is carried out only under the Controller's instructions, and relies on Article 9(2)(h) GDPR (management of health care systems and services), within the relationship between the healthcare professional and the patient. The Processor takes no clinical decisions, does not prioritise or classify healthcare, and does not use this data for any purpose of its own.
Important: It is the Controller who must ensure the appropriate legal basis for processing these special categories, including giving patients prior notice about the recording and transcription of the call.
The Processor will process personal data only in accordance with the Controller's documented instructions, for the purposes described in this DPA, and may not use it for its own purposes under any circumstances. If an instruction is contrary to the law, the Processor will notify the Controller immediately.
Connecting a third-party system in accordance with Annex I to the Terms constitutes a documented instruction from the Controller for the purposes of this clause.
5bis.1. The Processor represents and warrants that it does not use, and does not permit its subprocessors to use, the personal data processed under this DPA to train, fine-tune, improve or develop artificial intelligence models, neural networks, machine learning algorithms, or any other automated decision-making system.
5bis.2. This warranty extends expressly to: voice recordings and their content, generated transcripts, the content of text conversations, calendar and appointment data, data synchronised from the clinical management system, and any data derived from conversational analysis.
5bis.3. The Processor contractually requires the same no-training warranty from each subprocessor (see Subprocessor List ). In particular:
5bis.4. Should a subprocessor change its terms of service in a way that may affect this warranty, the Processor will notify the Controller within a maximum of 15 days and, if the warranty cannot be maintained, will replace the subprocessor within a reasonable period.
The Controller grants the Processor general authorisation to use the subprocessors included in the [Subprocessor List](/legal/subprocessors) , which states for each of them its identity, processing location, purpose and safeguards.
6.1. The Processor will inform the Controller of any addition or replacement of a subprocessor at least fifteen (15) days before it takes effect, and will publish the update in the List. The Controller may object in writing, giving reasons, within that period. The parties will endeavour in good faith to resolve the objection. If it is not resolved before the effective date, the Controller may terminate the affected service or the contract without penalty, with a pro-rata refund of any amounts paid in advance.
6.2. Where the replacement of a subprocessor is necessary for security or service continuity reasons, the Processor may carry it out immediately, informing the Controller as soon as reasonably practicable; the right to object under section 6.1 is preserved.
6.3. Third-party systems that the Controller connects to ToniAgent under clause 6 of the Terms (integrations) are not subprocessors of the Processor; their processing is governed by Annex I to the Terms and by the Controller's own relationship with that provider.
6.4. The up-to-date subprocessor list is available at app.toniagent.com/legal/subprocessors .
Technical measures: encryption in transit (TLS 1.2+), encryption at rest (AES-256) of the database (Amazon Aurora), of backups, and of recordings, transcripts, integration credentials and OAuth tokens, logical segmentation per client (multi-tenant isolation), role-based access control with mandatory MFA, audit logs, anomaly detection on the API and on calls, and encrypted backups with limited retention.
Organisational measures: least-privilege access policy, all personnel bound by confidentiality agreements, periodic security reviews (at least every six months), documented deletion and incident management procedures, and mandatory data protection training for all personnel.
ISO 27001 certification: The Processor plans to obtain ISO 27001 certification (Information Security Management System) during the fourth quarter of 2026. This certification will evidence the implementation of an internationally recognised security framework, audited by an independent body.
A detailed technical annex can be provided at the Controller's request.
All of the Processor's personnel are bound by confidentiality obligations, which survive even after the end of their employment or contractual relationship with the Processor.
9.1. Standard policy (default):
| Data type | Standard retention | Configurable options |
| Voice recordings | 12 months | Can be reduced to < 24h (deleted after transcription) / 7/30/90/180/365 days |
| Transcripts | 12 months | Can be reduced to < 24h / 30/90/180/365 days |
| Metadata and logs | 12 months | 6/12/24 months |
| Analytics data | Anonymised at 30 days | Immediate anonymisation / 7/30/90 days |
| Google Calendar (tokens/events) | While the integration is active | Deleted immediately on disconnection |
| Data synchronised from the clinical management system | While the integration is active | Deleted on disconnection |
| Database backup (if enabled) | 30 days | Can be disabled at any time |
9.2. The Controller may request a retention configuration different from the standard one by writing to privacy@toniagent.com . The Processor will implement the requested configuration within a maximum of 10 business days.
9.3. Standard retention for voice recordings and transcripts is 12 months. The Controller may disable call recording from the control panel, in which case recordings are deleted after transcription (< 24 hours). This setting is available from the "Legal i Compliment" section of each agent's panel.
9.4. On termination of the contract, all data will be deleted within a maximum of 30 days, unless there is a legal obligation to retain it. The Controller may request a copy before deletion.
On termination of the contract or at the Controller's request: data will be deleted or returned (at the Controller's choice), the Processor will issue a certificate of destruction if the Controller requests one, and only data strictly necessary under a legal obligation will be retained, duly identified and with restricted access.
The Processor will notify the Controller without undue delay and within a maximum of 36 hours of becoming aware of the incident. The notification will include: the nature of the breach, the categories of data affected, the approximate number of data subjects, the likely consequences and the measures adopted or proposed. The Processor will cooperate with the Controller in managing the incident and in notifying the AEPD where applicable. It is the Controller who must notify the supervisory authority or the affected data subjects where required.
The Controller may: request detailed information about the security measures implemented, carry out reasonable audits (a maximum of one per year, with 30 days' notice), and require cooperation on DPIAs where ToniAgent is used in high-risk processes.
The Processor makes available to the Controller a baseline DPIA template covering the standard use of ToniAgent in medical clinics (available on request at privacy@toniagent.com ). The Controller must adapt it to their specific context.
The Controller warrants: a valid legal basis for the processing (Arts. 6 and 9 GDPR), prior and adequate notice to patients about the recording, transcription and AI processing of their calls and, if WhatsApp confirmations are enabled, about contact through that channel; if the initial notice of AI assistance and possible recording that ToniAgent gives by default is disabled (at the Controller's request or from the control panel), that the Controller's own system gives the caller that information before transferring the call; correct configuration of the service (including the chosen retention policy), that the data provided is accurate and relevant, and the handling of data subjects' rights (access, rectification, erasure, etc.) with the Processor's cooperation where necessary.
The Controller further warrants that the people in its organisation whose telephone numbers it registers to receive WhatsApp notifications have agreed to receive them, and that whoever registers them is authorised to confirm this on their behalf.
The Processor is responsible for complying with its obligations under the GDPR. Financial liability is limited to what is established in the Terms of Service: a maximum limit equivalent to one (1) month of service.
This DPA is in force for as long as the Controller uses ToniAgent. On termination, clauses 9 and 10 apply. Amendments to this DPA are notified and take effect in accordance with clause 15 of the Terms: at least fifteen (15) days' notice, the Controller's right to object or terminate without penalty, and acceptance through continued use once the effective date has passed without objection.
This DPA is governed by Spanish law, the GDPR and the LOPDGDD. Any dispute will be resolved in the courts of Barcelona.
Supplementary documents: