Medilust

Data Deletion Instructions

Last updated: April 23, 2026

1. Introduction

This page describes how end users can request the deletion of their personal data processed by Medilust S.r.l. as part of the "Mami AI" service, with particular reference to data managed through the integration with Meta Platforms, Inc.'s WhatsApp Business API.

This document is drawn up in accordance with Meta's Platform Terms and EU Regulation 2016/679 (GDPR), Art. 17 "Right to erasure (right to be forgotten)".

2. Data controller and roles

Medilust provides Mami AI as a SaaS platform to dental practices. Under the GDPR, the roles are allocated as follows:

  • Dental practice: acts as Data Controller for its patients' data.
  • Medilust S.r.l.: acts as Data Processor on behalf of the dental practice.
  • Meta Platforms, Inc.: acts as a further Processor for transmitting messages via the WhatsApp Business API.

3. Data managed through the WhatsApp Business API

As part of the integration with Meta, we process the following categories of data:

  • Patient phone number
  • Patient first and last name (if provided by the practice)
  • Content of messages exchanged via WhatsApp Business
  • Message delivery and read status
  • Date and time of interactions
  • Technical conversation identifiers (message ID, Meta conversation ID)

4. How to request deletion

There are two main channels for requesting the deletion of your data, depending on your relationship with the Service:

4.1 If you are a patient of a dental practice that is a Medilust client

Since Medilust acts as Data Processor, the request should primarily be addressed to the dental practice that manages your data (the Controller). Alternatively, you can contact us directly using the steps below, and we will forward the request to the relevant practice.

4.2 If you are a dental practice owner or a direct user of the platform

You can address the request directly to Medilust by following the procedure described in section 5.

5. Request procedure

To request the deletion of your data, follow these steps:

  • Step 1 — Send an email to privacy@medilust.com with the subject "Data deletion request – Meta/WhatsApp".
  • Step 2 — Include in the body of the email:
    • First and last name
    • The phone number linked to the WhatsApp account for which you are requesting deletion
    • The name of the dental practice providing the service (if known)
    • An explicit statement requesting the deletion of your personal data
  • Step 3 — Identity verification: for security reasons, we may ask you to provide an identity document or further information to confirm that the request comes from the rightful person.
  • Step 4 — Confirmation: you will receive written confirmation that your request has been received within 5 business days, and a notice of completion once the deletion is done.

6. Processing times

Deletion requests are handled, pursuant to Art. 12 of the GDPR, within 30 days of receipt. In particularly complex cases, this term may be extended by a further 60 days, with a reasoned notice to the data subject.

The deletion will cover:

  • Personal data held in Medilust's production systems
  • WhatsApp messaging logs associated with the indicated number
  • Any backup copies, according to the rotation policy (maximum 90 days)

7. Data retained by legal obligation

Some data may be retained beyond the deletion request, strictly to the extent necessary, to comply with legal obligations, including:

  • Billing and accounting data, retained for 10 years under Italian tax law (Art. 2220 of the Italian Civil Code)
  • Data necessary to establish, exercise or defend a legal claim
  • Security logs, retained for the time strictly necessary to ensure the integrity of the systems

Such data will be blocked from any further processing and deleted upon expiry of the relevant obligations.

8. Data deletion on Meta / WhatsApp

You can at any time revoke the WhatsApp Business authorization from your device and request that Meta directly delete the data stored on its systems, following Meta's official instructions at facebook.com/help/contact/540977946302970 .

9. Right to complain

If you believe that the handling of your request did not comply with the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it).

10. Contact

For any questions about data deletion or to submit a request:

Medilust S.r.l.
Piazzetta Ado Furlan 4, 33170 Pordenone (PN), Italy
VAT: IT01999240938
Email: privacy@medilust.com
Certified email (PEC): medilustsrl@pec.it