Privacy Policy

v1 · 04/11/2026

Last updated: 04/11/2026

1. Who we are

The Vem Prevenir platform is operated by [COMPANY NAME], NIPC [REGISTRATION NUMBER], with its registered office at [ADDRESS] ("Vem Prevenir", "we", "us"), which is the controller of your personal data under Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Portuguese Law no. 58/2019 of 8 August. This Policy explains, in plain language, which data we process, for what purposes, who we share it with and how you can exercise your rights. It supplements the Terms of Use.

Data Protection Officer: [DATA PROTECTION E-MAIL]. General contact: atendimento@vemprevenir.com.br.

2. Who this Policy applies to

• Users who contract the platform directly;
• Employees of client companies who register through their company's link;
• Participating health professionals (doctors, psychologists and other professionals);
• Human resources and Occupational Safety and Health (OSH) users of client companies;
• Website visitors.

3. What data we process

• Identification and contact: name, e-mail, mobile phone number, date of birth, gender, marital status, address and NIF (tax identification number).
• Account data: login credentials, password (stored in encrypted form), access profile and preferences.
• Job data (employees): company, job role, sector, site and work shifts.
• Health data (special category of data): appointments, teleconsultations, clinical records kept by the professionals who see you, exam requests and results, prescriptions, documents sent to you or by you, and questionnaire answers (psychosocial risk, well-being and mental-health scales).
• Payments: purchase and payment details. Payments are processed by payment service providers; the platform does not store full card numbers.
• Conversations with Zélia: the text of your conversations with the AI assistant, as described in the AI Terms.
• Health professionals: registration with the professional order, specialty and the digital certificate used to sign documents.
• Technical data: access logs (date, time and IP address), kept for a limited period for security purposes, and the session cookie. The platform's access statistics do not store your IP address or browser: each anonymous visitor is represented by an irreversible code that changes every day.

4. Why we use the data and on what legal basis

• Providing the services you contracted (appointments, teleconsultation, clinical records, documents, benefit packages): performance of a contract (Article 6(1)(b) GDPR) and, for health data, the provision of health care by professionals bound by secrecy (Article 9(2)(h) and 9(3) GDPR) and the explicit consent you give at registration (Article 9(2)(a)).
• Identifying you and securing your account: performance of a contract and legitimate interest.
• Invoicing and payments: performance of a contract and compliance with a legal (tax) obligation.
• Occupational health obligations of client companies: compliance with a legal obligation.
• Collective indicators for companies: aggregated data only; where questionnaire answers are involved, with your explicit consent.
• Service communications (confirmations, reminders, notices): performance of a contract and legitimate interest.
• Marketing e-mails: only with your consent, which you may withdraw at any time.
• Improving the service: legitimate interest, using non-health data or non-identifying statistics.
• Complying with legal obligations (such as keeping clinical records): compliance with a legal obligation.
• Defending rights in judicial or out-of-court proceedings: legitimate interest and, for health data, Article 9(2)(f) GDPR.
• AI features: explicit consent, as described in the AI Terms.

Legitimate interest is never used as a basis for processing health data. Where processing is based on legitimate interest, you may object to it.

5. What your company sees (employees)

If you registered through your company's link, the company can see your identification and job data (name, job role, sector and site) and collective indicators, calculated only for groups above a minimum number of people. The company does not see your clinical record or the content of your consultations. Occupational health documents (such as the fitness-for-work record) reach the company only when the law requires it or when the document is addressed to it. Questionnaire results reach the company only in aggregated form, never individually.

6. Who we share data with

• Health professionals who see you.
• Your company, within the limits of section 5.
• Processors that handle data on our behalf: Google Cloud (hosting, database and file storage in São Paulo, Brazil; BigQuery analytics database and AI services in the United States), Google Workspace (e-mail sending), Stripe (payments) and Contabo (rented infrastructure on which the platform runs its own video-call server).
• Authorities, when required by law or court decision.

We do not sell personal data.

7. Teleconsultations

Teleconsultation audio and video are not recorded. Transcription only takes place if you accept it on the consultation screen, and the transcribed text is a draft for the professional, who decides what to enter in the clinical record. In the Chrome browser, speech recognition may use Google's service.

8. International transfers

Data is processed in Brazil and the United States, that is, outside the European Union and the European Economic Area, and, for the video-call server, on infrastructure rented from third parties. These transfers are based on European Commission adequacy decisions, where they exist, or on standard contractual clauses approved by the Commission and other safeguards provided for in Articles 44 et seq. of the GDPR. You can request information about the applicable safeguards at [DATA PROTECTION E-MAIL].

9. How long we keep data

• Account data: while the account is active and afterwards for the statutory limitation periods.
• Clinical records: for the period required by health legislation and the applicable professional codes of conduct.
• Access logs: for the period strictly necessary for security purposes.
• Conversations with Zélia: until you delete them or close your account.
• Questionnaire answers: as stated in each questionnaire or in the contract with the company.
• Marketing consent: until you withdraw it.

10. Security

We apply technical and organisational measures to protect data, including encryption in transit (HTTPS), profile-based access control, records of actions taken on the platform and signing of clinical documents with digital certificates. No system is completely immune to incidents; in the event of a personal data breach, we notify the CNPD and, where required, the data subjects, in accordance with Articles 33 and 34 of the GDPR.

11. Your rights

Under Articles 15 to 22 of the GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability, objection and the right not to be subject to decisions based solely on automated processing. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

In the "Privacy and Data" area of your account you can download a copy of your data in JSON format, withdraw consents and submit requests such as rectification, erasure or access to your clinical record. You can also write to [DATA PROTECTION E-MAIL]. We reply within one month, which may be extended in the cases provided for in the GDPR. Some data, such as clinical records, may have to be kept even after an erasure request, because of a legal obligation.

You may lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, CNPD). In the event of a consumer dispute, you may turn to [DISPUTE RESOLUTION ENTITY].

12. Minors

Persons under 18 may only use the platform through their legal representative, who gives consent where required.

13. Artificial intelligence and cookies

The use of data in the artificial intelligence features is described in the AI Terms. The cookies and local storage used by the platform are described in the Cookie Policy.

14. Changes

We may update this Policy. Each version is numbered and dated, and relevant changes will be communicated to you through the platform or by e-mail.