Corialto
Back to website

Privacy Policy / Comprehensive Privacy Notice

Effective October 1, 2026

Responsible party: Raúl Cortez, operating Corialto in Mexico ("Corialto," "we," "us").

Business/legal address: Celeste 17, Fracc. Real del Sol, Tecámac, Estado de México, C.P. 55770, Mexico.

Privacy and ARCO contact: hello@corialto.com.

This notice explains how Corialto collects, uses, stores, discloses, and otherwise processes personal data through corialto.com and our managed front-office services.

Do not submit medical records, diagnoses, symptoms, medications, X-rays, payment-card data, government identifiers, passwords, or other sensitive information through Corialto's public website forms. Sensitive or regulated information may be handled only through a client-approved data path and configuration.

1. Personal data we may process

Sensitive personal data. Depending on a client's approved service configuration, a communication could contain health or other sensitive personal data. For dental and healthcare workflows, Corialto keeps its current HubSpot STANDARD CRM in non-clinical mode. Clinical or sensitive health detail must use a separately approved destination and may not be placed in HubSpot STANDARD.

2. Primary purposes

We process personal data as reasonably necessary to:

3. Secondary or optional purposes

Where permitted, Corialto may use business contact information to send optional service updates or promotional communications about Corialto. You may opt out of these optional communications at any time by using the unsubscribe mechanism provided or by writing to hello@corialto.com. Opting out of optional marketing does not prevent operational, security, billing, or service communications that are necessary for an active relationship.

4. AI-assisted processing, calls, and recordings

Corialto may use artificial intelligence and automation to understand inquiries, generate responses, classify requests, create summaries, route interactions, and trigger approved workflows. AI can make mistakes. Corialto's service is not intended to make clinical diagnoses, emergency decisions, or other regulated professional judgments.

Calls may be recorded, transcribed, or monitored only where enabled for the client configuration and subject to the required notice, consent, and jurisdictional rules. Customer-specific recording and transcription settings are defined during implementation.

Corialto does not use customer call content to train a Corialto foundation model. Infrastructure providers may process information under their applicable agreements and settings to provide the service.

5. Sensitive and regulated data; healthcare

Corialto does not assume that U.S. HIPAA applies merely because a patient or caller is from the United States. Each client and workflow is evaluated according to the actual entity, systems, transactions, contracts, jurisdictions, and data path involved.

If a workflow is actually subject to HIPAA, the affected workflow must not go live until the required agreements, provider configuration, approved data destination, minimum-necessary design, and other applicable safeguards are complete. A HIPAA-capable setting alone does not authorize processing of Protected Health Information.

For healthcare clients, health information remains sensitive personal data and must be handled through the approved client workflow with appropriate purpose limitation, access controls, minimization, and retention.

6. Service providers, transfers, and international processing

We may disclose or transfer data to service providers and customer-selected integrations only as reasonably necessary to operate, secure, support, and deliver the configured service, or as otherwise permitted by applicable law. Categories may include hosting, AI/automation, telecommunications, messaging, CRM, email, calendars, forms, payments, analytics/security, and professional advisers. Current core providers are described in our Subprocessor & Service Provider Register.

Corialto operates from Mexico. Depending on provider infrastructure and client integrations, data may be processed in Mexico, the United States, or other countries. Where required, Corialto will use appropriate contractual, consent, notice, or other legal mechanisms for the relevant processing or transfer.

We do not sell personal data or disclose it for third-party cross-context behavioral advertising.

7. Options to limit use or disclosure

You may request that Corialto limit optional uses or disclosures by emailing hello@corialto.com with the subject "Privacy — Limit Use". For SMS or email automation, supported opt-out mechanisms and suppression controls may also apply. Some processing cannot be stopped while it remains necessary to provide an active service, comply with law, protect security, maintain accounting records, or establish or defend legal claims.

8. ARCO rights

Subject to applicable law, you may exercise rights of Access, Rectification, Cancellation, and Opposition (ARCO).

Send an ARCO request to hello@corialto.com with the subject "ARCO Request". Your request should include:

We may request additional information reasonably necessary to verify identity, locate the data, or process the request. We will respond and, where applicable, implement the request within the timeframes required by applicable law. ARCO rights may be subject to legal exceptions, preservation duties, or circumstances in which cancellation or opposition is not legally available.

9. Revocation of consent

Where processing relies on consent, you may request revocation by emailing hello@corialto.com with the subject "Consent Revocation" and sufficient information to identify the relevant processing. Revocation does not retroactively invalidate prior lawful processing and may not apply where another legal or contractual basis requires continued processing or retention.

10. Security and confidentiality

Corialto uses reasonable administrative, technical, and physical safeguards appropriate to the nature of the service and the risks involved, including access controls, provider restrictions, data minimization, environment separation, and incident procedures. No system can guarantee absolute security.

Where required by applicable law, material security incidents affecting personal data will be handled and communicated in accordance with the applicable incident-response requirements.

11. Retention and deletion

We retain personal data only for as long as reasonably necessary for the purposes described in this notice, the applicable Service Order, operational requirements, security, accounting, dispute resolution, and legal obligations. Sensitive data should be retained for the minimum period reasonably necessary for the approved purpose. When data is no longer required, it may be deleted, anonymized, or blocked before deletion as appropriate to the applicable system and legal requirements.

12. Customer-controlled data and connected systems

For client services, the business customer determines many of the approved business facts, communications, routing, scheduling, integrations, and data destinations. Corialto may act as a service provider or processor for that customer. Customer-specific processing may also be governed by the Data Processing Addendum, Service Order, Communications Compliance Addendum, or other written agreement.

13. Minors

Corialto's website is a business-to-business service and is not directed to children. Do not submit a child's personal or health information through Corialto's public website forms. If a client's approved front-office workflow may involve minors, the client must identify that use case during implementation so applicable consent, representation, and data-handling requirements can be addressed before activation.

14. Changes to this notice

We may update this notice prospectively. The current version and effective date will be published at corialto.com/privacy.html. Material changes may also be communicated through reasonable additional means where appropriate.

15. Contact

Privacy questions, ARCO requests, consent revocation, or requests to limit optional use or disclosure may be sent to:

Corialto — Attn: Privacy
Raúl Cortez
Celeste 17, Fracc. Real del Sol
Tecámac, Estado de México, C.P. 55770
Mexico
hello@corialto.com

Related documents: Terms · DPA · Communications · Subprocessors · Cookies.