Privacy Policy · Ayurvedese®

Ayurvedese^® — This Privacy Policy describes how Ayurvedese®, headquartered in SQN Asa Norte, Brasília/DF, Brazil, with contact channel at [email protected], processes personal data in the context of its Platform.

This Policy applies to clients, legal guardians, Ayurvedic therapists, partner professionals, website visitors, application users, and any other persons who interact with Ayurvedese®.

1. Roles of Ayurvedese® in Data Processing

1.1. As controller

Ayurvedese® may act as data controller in the following activities:

account creation and management;
authentication and security;
customer support;
billing, invoicing, and fraud prevention;
operational communications;
marketing, when authorized or permitted by law;
metrics, analytics, and product improvement;
compliance with legal and regulatory obligations and defense of rights.

1.2. As processor

Ayurvedese® may act as data processor when processing personal data on behalf of and under the instructions of the Ayurvedic Therapist, Partner Professional, clinic, or another responsible controller, especially in functionalities related to storage, organization, and technical processing of Consultation Content.

2. What Data We Process

2.1. Registration and identification data

Name, email, phone number, CPF (Brazilian tax ID), date of birth, address, photo, login credentials, and encrypted password.

2.2. Professional data

Professional registration, specialty, education, curriculum, validation documents, schedule, pricing, and practice location.

2.3. Usage and browsing data

IP address, access date and time, technical logs, device identifiers, operating system, browser, preferences, and cookie data.

2.4. Transactional data

Information related to contracting, payment, billing, refunds, subscriptions, plans, and operational financial history.

2.5. Communication data

Messages, support tickets, support requests, reminders, and notifications.

2.6. Sensitive personal data and consultation data

When functionality allows, data related to health, consultation history, symptoms, examinations, documents, observations, and other information entered in the context of consultations may be processed. This includes follow-up diary records entered by the patient themselves in the portal (such as bowel habits, mood, sleep, energy, and adherence to the therapeutic plan).

3. Purposes of Data Processing

register and authenticate Users;
provide, operate, and protect the Platform;
connect clients and service providers;
enable scheduling, rescheduling, and operational communications;
facilitate consultation records and contracted features;
process payments and prevent fraud;
provide support and respond to requests;
send automated reminders and notifications (by email, WhatsApp, or in-app), including about the follow-up diary and patient inactivity;
operate the Ayurdrops newsletter and send it to users who confirm their subscription (opt-in), with the option to unsubscribe at any time;
personalize the experience and improve functionalities;
generate reports, metrics, and product intelligence;
comply with legal, regulatory, and contractual obligations;
provide AI tools and support automations.

4. Legal Bases

Ayurvedese® uses legal bases compatible with each processing operation, including:

performance of a contract and preliminary procedures;
compliance with legal or regulatory obligations;
regular exercise of rights;
protection of life or physical safety;
fraud prevention and data subject security;
legitimate interest, where applicable;
consent, when required or adopted for a specific purpose.

5. Health-Related Data

Health-related data requires enhanced protection. When a service provider uses the Platform for consultations, they may act as the controller of the Consultation Content. Ayurvedese® will not use Consultation Content for purposes incompatible with the provision of services.

6. AI Tools

When AI functionalities are enabled:

Ayurvedese® will process only the data strictly necessary to generate summaries, insights, or automations;
whenever possible, minimization and pseudonymization techniques will be adopted;
AI-generated output must be reviewed by a human before any use;
the use of data for model training will only occur with a valid legal basis and adequate transparency.

7. With Whom We Share Data

We may share data, to the extent necessary, with:

therapists and professionals involved in consultations;
hosting, cloud, infrastructure, authentication, analytics, payment, and security service providers;
administrative, regulatory, or judicial authorities, when legally required;
third parties in corporate transactions, with appropriate safeguards.

8. International Data Transfers

Part of the processing occurs outside Brazil — for example, with hosting, cloud, analytics, email, and AI-tool providers. In such cases, Ayurvedese® adopts appropriate international transfer mechanisms, such as standard contractual clauses and technical and organizational safeguards, in accordance with applicable legislation.

9. Retention and Deletion

Data will be retained for the time necessary to fulfill the purposes of this Policy, respecting contractual deadlines, legal obligations, audit needs, and regular exercise of rights. When you close your account (Account → Close account), credentials and data with no legal retention obligation are deleted within 30 days; during that window you can reopen the account or download your data. Medical records (kept for up to 20 years) and financial records (up to 5 years) remain retained and blocked by legal obligation, and are then deleted or anonymized.

10. Security

Ayurvedese® adopts technical, administrative, and organizational measures to protect personal data, including:

role-based access control;
authentication and credential management;
encryption;
event logging and monitoring;
backup and continuity;
permission reviews;
training and internal governance.

11. Data Subject Rights

Under the LGPD (Brazilian General Data Protection Law), data subjects may exercise rights such as:

confirmation of the existence of processing;
access to data;
correction of incomplete, inaccurate, or outdated data;
anonymization, blocking, or deletion of unnecessary data;
data portability — available instantly under Account → Download my data;
deletion of data processed with consent — available under Account → Close account, subject to the legal retention of medical records;
information about data sharing;
withdrawal of consent;
objection to processing, in legally applicable cases.

12. How to Exercise Your Rights

There are three paths. (1) Access and portability: download a full copy of your data instantly, under Account → Download my data. (2) Deletion: close your account under Account → Close account (with 30 days to reopen and subject to medical-record retention). (3) Other rights (correction, objection, information, withdrawal of consent) and questions: write to [email protected] — we respond within 15 days, per Article 19 of the LGPD.

13. Children and Adolescents

When processing data of children and adolescents, Ayurvedese® will comply with applicable legislation. Use must be performed by the legal guardian or with their valid authorization.

14. Cookies and Similar Technologies

Ayurvedese® may use cookies, pixels, and similar technologies for Platform operation, authentication, security, performance analysis, and personalization. Users may manage preferences through the available settings.

15. Security Incidents

In the event of a security incident that may pose risks to data subjects, Ayurvedese® will take appropriate measures, including containment, analysis, remediation, and legally required notifications.

16. Data Subject Channel and Data Protection Officer

Ayurvedese® is a small-scale processing agent and, under ANPD Resolution CD/ANPD No. 2/2022, provides a communication channel with the data subject instead of appointing a named Data Protection Officer: [email protected]. Use this channel to exercise your rights and ask privacy questions; we respond within 15 days (Article 19 of the LGPD). If you are not satisfied, you may contact the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.

17. Changes to This Policy

Ayurvedese® may update this Privacy Policy to reflect legal, regulatory, technical, or operational changes. The current version will be made available on the Platform with the update date indicated.