Deleting Your Data

Facebook’s window gives us a one-time code, which our server exchanges with Meta for an access token. That token works only on the WhatsApp Business account you chose in the window. We do not receive your Facebook password, your profile, your friends or your contacts.

We keep:

• the access token, encrypted and never shown to anyone;
• the identifiers of your business portfolio, your WhatsApp Business account and your phone number;
• the number as WhatsApp displays it, its display name, what Meta reports about it (quality, messaging limit, review status), and the status of the clinic’s message templates;
• the two-step verification PIN we set when we register the number, encrypted;
• and, while WhatsApp is connected, a record of each message sent from your number — its text, Meta’s identifier for it and its status (sent, delivered, read or failed) — and your patients’ replies, encrypted.

1. In 3yadtk (the clinic’s owner): Settings → Notifications → WhatsApp → “Disconnect WhatsApp”, then enter your password (and your two-factor code, if it is on) and press “Yes, disconnect”. We delete the access token and the PIN at once, tell Meta to stop sending us your account’s updates, and release the number from the WhatsApp Cloud API (unless it is also in the WhatsApp Business app). Automatic WhatsApp messages stop, and every owner of the clinic and the clinic’s address are emailed. If you connected with the guided setup instead, the same button deletes the access token, the app secret and the verify token, and changes nothing in your own Meta app.

2. At Meta: In Meta Business Suite (business.facebook.com): Settings → Accounts → WhatsApp accounts → your account → Partners, and remove 3yadtk (Limitless Royalty LLC); or Settings → Integrations → Connected apps → 3yadtk → Remove app. Meta renames its menus from time to time. Our token stops working at once, and the WhatsApp page in 3yadtk shows that our access was removed. To have us delete what we still hold, press “Disconnect WhatsApp” as in point 1, or write to us.

3. By email: Write to privacy@3yadtk.com from the clinic owner’s address, naming the clinic. We answer within 30 days and delete the WhatsApp connection’s data within 90 days of the request, as our privacy policy sets out, and tell you when it is done.

Disconnecting deletes the credentials, not the clinic’s records. These stay with the clinic’s data: the identifiers of the account and the number, the number as displayed and its name, the templates’ status, a one-way fingerprint of the access token from which the token cannot be recovered (so the activity log can tell one connection from another), the record of each message sent and its status, patients’ replies, each patient’s agreement to WhatsApp messages, and the activity log of who connected and disconnected, and when. They are the clinic’s records, which we keep on its behalf.

They follow our privacy policy’s rule: kept while the clinic’s account exists, and deleted when the clinic asks in writing, within 90 days of the request, except what the law requires us to keep. The activity log is not deleted. The access token is never put in a backup.

If you are a patient of a clinic that uses 3yadtk, the clinic decides what happens to your records: send your request to the clinic. Replying STOP to the clinic’s WhatsApp number stops its WhatsApp messages.