Privacy Policy

1. Data controller

The controller of the personal data processed through CRM Fuerza Salud is:

2. Scope

This policy applies to CRM Fuerza Salud, an internal tool of YT Grupo used by the authorized sales advisors of its Fuerza Salud line (sale of SANNA health insurance plans) and by authorized YT Grupo staff. The app is not offered to the general public and is not used by customers. It covers the web app available at crm.ytgrupo.com and its optional integration with Google Calendar.

3. Google user data we access

Connecting Google Calendar is optional. Only if an advisor chooses to connect their Google account, the app requests these permissions (OAuth scopes), and no others:

The app stores only the following Google-related data:

• The email address of the connected Google account.
• The OAuth access and refresh tokens, stored encrypted.
• The ID of the "Fuerza Salud" calendar created by the app.
• The IDs of the events the app created in that calendar (appointments and company events), so it can later update or cancel them.

The app does not read, copy or store any of the user's other calendars or events, nor their contacts, Gmail, Drive or any other Google data. The calendar.app.created permission technically limits access to the calendar created by the app.

4. How we use Google user data

Google user data is used only to create, update and cancel, in the "Fuerza Salud" calendar, the appointments that the advisor schedules in CRM Fuerza Salud or in the Fuerza Salud sales funnel, so that the advisor can see them in their own Google Calendar. Each event contains the appointment type (call, visit or payment), date and time, the contact's name and mobile number, the note entered by the advisor and the reminders.

In addition to appointments, the app adds to the same "Fuerza Salud" calendar the internal company events to which the advisor is invited or which apply to them: Despegue YT meetings, product trainings, workshops and welcome meetings. These events are created, updated and cancelled the same way, contain only information about the company event (title, date and time, meeting link, place and description) and no customer data. The advisor can turn this off at any time with the "Include company events" switch in the app; when it is turned off, the company events already added are cancelled. It uses the same permission described in section 3 and only that calendar.

Synchronization is one-way (CRM / funnel to Google Calendar). Google data is not used for any other purpose.

5. Limited Use disclosure

In particular:

• Google user data is used only to provide the user-facing Google Calendar feature described in this policy.
• Google user data is not sold and is not used for advertising, including personalized, retargeted or interest-based advertising.
• Google user data is not shared with third parties, except as necessary to provide or improve the feature described above, for security purposes (for example, investigating abuse), to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to the user.
• No person reads Google user data, unless the user has given affirmative consent for specific data, it is necessary for security purposes (such as investigating abuse) or for support at the user's request, it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations.
• Google user data is not used to develop, improve or train generalized artificial intelligence or machine learning models, and it is not sent to any AI service.

6. Other data processed by the CRM (not from Google)

To operate as a sales tool, CRM Fuerza Salud also processes data that does not come from Google:

• Advisor account data: national ID number (DNI) used as username, and name.
• WhatsApp conversations between advisors and prospective customers, including the messages and files exchanged.
• Prospect data: name, mobile number, sales stage, scheduled appointments, notes and quotes.

We use these service providers to operate the app:

• YCloud (WhatsApp Business API provider): sending and receiving WhatsApp messages.
• Amazon Web Services: servers and file storage.
• Google Gemini: assistant that helps advisors draft replies based on their WhatsApp conversations. Gemini does not receive any Google Calendar data or any other data obtained through the Google permissions described in section 3.

Stored messages are kept encrypted.

7. Security

• All traffic to the app is encrypted with HTTPS.
• Google OAuth tokens and stored messages are encrypted.
• Access to the app and to its data is restricted to authorized YT Grupo personnel, each with their own credentials.

No system is completely secure, but we apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss or alteration.

8. Retention and deletion

• When an advisor disconnects Google Calendar in the CRM, the stored tokens are deleted and the CRM stops synchronizing.
• Events that were already created remain in the user's Google account, because that calendar belongs to the user. The user can delete the "Fuerza Salud" calendar at any time from Google Calendar.
• Access can also be revoked at any time at https://myaccount.google.com/permissions.
• To request the deletion of your data, write to soporte@ytgrupo.pe.

Other CRM data is kept while it is needed for the commercial relationship and to comply with legal obligations, and is then deleted or anonymized.

9. Your rights

Under Peru's Personal Data Protection Law (Law No. 29733) and its regulations, you may exercise your rights of access, rectification, cancellation and objection by writing to soporte@ytgrupo.pe. We will reply within the time limits set by law.

If you believe your rights have not been respected, you may file a claim with the National Authority for Personal Data Protection (Autoridad Nacional de Protección de Datos Personales) of Peru.

10. Changes to this policy

We may update this policy, for example if the app or its Google integration changes. The current version is always published on this page with its effective date; if the changes are significant, we will inform users through the app.

Effective date: October 26, 2026.