Privacy Policy

v1 · 04/11/2026

Last updated: 04/11/2026

1. Who we are

The Vem Prevenir platform is operated by [COMPANY NAME], registered under CNPJ no. [REGISTRATION NUMBER], with its registered office at [ADDRESS] ("Vem Prevenir", "we", "us"), which is the controller of your personal data under Law no. 13,709/2018 (Brazilian General Data Protection Law, LGPD). This Policy explains, in plain language, which data we process, why, who we share it with and how you can exercise your rights. It supplements the Terms of Use.

Data Protection Officer (encarregado): [DATA PROTECTION E-MAIL]. General contact: [CONTACT E-MAIL].

2. Who this Policy applies to

• Patients who contract the platform directly (individuals);
• Employees of client companies who register through their company's link;
• Credentialed health professionals (doctors, psychologists and other professionals);
• HR and Occupational Safety and Health (OSH) users of client companies;
• Website visitors.

3. What data we process

• Identification and contact: name, e-mail, phone number, date of birth, gender, marital status, address and CPF (Brazilian taxpayer number).
• Account data: login, password (stored in encrypted form), access profile and preferences.
• Job data (employees): company, job role, sector, unit and work shifts.
• Health data (sensitive data): appointments, teleconsultations, medical records kept by the professionals who see you, exam requests and results, prescriptions, documents sent to you or by you, and questionnaire answers (psychosocial risk, well-being and mental-health scales).
• Payments: purchase and payment details. Payments are processed by our payment partners; the platform does not store full card numbers.
• Conversations with Zélia: the text of your conversations with the AI assistant, as described in the AI Terms.
• Health professionals: professional council registration, specialty and the digital certificate used to sign documents.
• Technical data: application access logs (date, time and IP address), kept for 6 months as required by article 15 of the Brazilian Civil Rights Framework for the Internet (Law no. 12,965/2014), and the session cookie. The platform's access statistics do not store your IP address or browser: each anonymous visitor is represented by an irreversible code that changes every day.

4. Why we use the data and on what legal basis

• Providing the services you contracted (scheduling, teleconsultation, medical records, documents, benefit packages): performance of a contract and, for health data, health protection in procedures carried out by health professionals or health services (art. 11, II, "f", LGPD).
• Identifying you and securing your account: performance of a contract and legitimate interest.
• Billing and payments: performance of a contract and compliance with a legal (tax) obligation.
• Occupational health obligations of client companies: compliance with a legal or regulatory obligation.
• Collective indicators for companies: aggregated data only; where questionnaire answers are involved, with your specific consent.
• Service communications (confirmations, reminders, notices): performance of a contract and legitimate interest.
• Marketing e-mails: only with your consent, which you may withdraw at any time.
• Improving the service: legitimate interest, using non-sensitive data or non-identifying statistics.
• Complying with legal obligations (such as keeping medical records and access logs): compliance with a legal or regulatory obligation.
• Defending rights in judicial, administrative or arbitration proceedings: regular exercise of rights.
• AI features: specific consent, as described in the AI Terms.

Legitimate interest is never used as a basis for processing health data.

5. What your company sees (employees)

If you registered through your company's link, the company can see your registration and job data (name, job role, sector and unit) and collective indicators, calculated only for groups above a minimum number of people. The company does not see your medical record or the content of your consultations. Occupational documents (such as the occupational health certificate) reach the company only when the law requires it or when the document is addressed to it. Questionnaire results reach the company only in aggregated form, never individually.

6. Who we share data with

• Health professionals who see you.
• Your company, within the limits of section 5.
• Processors that handle data on our behalf: Google Cloud (hosting, database and file storage in São Paulo, Brazil; BigQuery analytics database and AI services in the United States), Google Workspace (e-mail sending), Mercado Pago (payments) and Contabo (rented infrastructure on which the platform runs its own video-call server).
• Authorities, when required by law or court order.

We do not sell personal data.

7. Teleconsultations

Teleconsultation audio and video are not recorded. Transcription only takes place if you accept it on the consultation screen, and the transcribed text is a draft for the professional, who decides what to enter in the medical record. In the Chrome browser, speech recognition may use Google's service.

8. International transfers

Data is processed in Brazil and the United States and, for the video-call server, on infrastructure rented from third parties. International transfers follow articles 33 et seq. of the LGPD, with the required contractual safeguards.

9. How long we keep data

• Account data: while the account is active and afterwards for the statutory limitation periods.
• Medical records: for the period required by health regulations, at least 20 years from the last entry (Law no. 13,787/2018).
• Application access logs: 6 months (Civil Rights Framework for the Internet).
• Conversations with Zélia: until you delete them or close your account.
• Questionnaire answers: as stated in each questionnaire or in the contract with the company.
• Marketing consent: until you withdraw it.

10. Security

We apply technical and organisational measures to protect data, including encryption in transit (HTTPS), profile-based access control, records of actions taken on the platform and signing of clinical documents with digital certificates. No system is completely immune to incidents; if a relevant incident occurs, we will notify you and the ANPD as required by law.

11. Your rights

Under article 18 of the LGPD, you may request: confirmation that processing takes place; access to your data; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data or data processed unlawfully; portability; deletion of data processed on the basis of consent; information about who we share data with; information about the possibility of refusing consent and its consequences; withdrawal of consent; and review of decisions made solely on the basis of automated processing.

In the "Privacy and Data" area of your account you can download a copy of your data in JSON format, withdraw consents and submit requests such as rectification, erasure or access to your medical record. You can also write to [DATA PROTECTION E-MAIL]. We reply within the deadlines set by the LGPD and ANPD regulations. Some data, such as medical records, may have to be kept even after an erasure request, because of a legal obligation.

You may also lodge a complaint with the National Data Protection Authority (ANPD).

12. Children and adolescents

Persons under 18 may only use the platform through their legal guardian, who gives consent where required.

13. Artificial intelligence and cookies

The use of data in the artificial intelligence features is described in the AI Terms. The cookies and local storage used by the platform are described in the Cookie Policy.

14. Changes

We may update this Policy. Each version is numbered and dated, and relevant changes will be communicated to you through the platform or by e-mail.