Privacy Policy

FRC Consultores Associados LTDA develops, licenses, and operates Triagemia. This policy describes the processing of personal and sensitive data in compliance with the General Data Protection Law (LGPD – Law 13,709/2018, Brazil's data protection law).

1. Legal Bases for Processing

We process your data based on the following legal bases:

• Health Protection (Art. 7, VIII / Art. 11, II, 'f'): For the processing of clinical and sensitive data by health professionals.
• Contract Performance (Art. 7, V): For managing the professional's account and platform access.
• Compliance with a Legal Obligation (Art. 7, II): For maintaining access records (Brazilian Internet Civil Rights Framework, "Marco Civil da Internet") and tax documents.
• Legitimate Interest (Art. 7, IX): For cybersecurity and technical improvement of the platform (via anonymized data).

2. Personal and Sensitive Data

2.1 Professional Account Data (Controller: FRC Consultores Associados LTDA)

• Name, email, professional registration number (CRM).
• Access logs (IP, date/time).
• Native-store purchase and transaction identifiers used to validate professional access; payment card data is handled by the store and is not collected by Triagemia.

2.2 Patient Data (Processor: FRC Consultores Associados LTDA | Controller: Health Professional)

FRC Consultores Associados LTDA acts as the Processor of health data entered by the professional, who retains responsibility as Controller:

• Patient initials or identifiers.
• Clinical instruments, symptoms, and progression.
• Triage history and longitudinal follow-up.

3. Processing Principles

• • Minimization (Minimum Data): We collect only what is strictly necessary to support clinical reasoning.
• • Purpose: Exclusive use for care-related purposes and diagnostic support.
• • Security by Design: End-to-end encryption in transit and at rest.
• • Transparency: Clear information about the use of generative AI to assist analysis.

4. Data Retention

Retention periods follow specific rules:

• Clinical Data: Minimum of 20 years, in accordance with CFM (Federal Council of Medicine) Resolution 2,218/2018.
• Registration Data: 5 years after the end of the contractual relationship (Civil Code).
• Billing purchase/event evidence: Deleted from Triagemia when the account is deleted; raw store tokens/JWS are never exported. The Apple App Store or Google Play remains the source for any billing history or receipt it retains.
• Deletion safety tombstone: A one-way hash of the technical account identifier, deletion state, and timestamps is retained only to prevent data or trial recreation after deletion. It contains no raw UID, email, clinical data, store token/JWS, or purchase identifier.
• Access Logs: 6 months (Art. 15 of the Marco Civil da Internet).

5. Data Subject Rights

The data subject has the right to confirmation, access, correction, anonymization, or deletion of unnecessary data, subject to the legal retention exceptions mentioned above.

6. Sharing

We do not sell data. We share strictly necessary information with:

• Google Cloud (Vertex AI): AI processing, under a corporate privacy agreement (no training on user data).
• Apple App Store and Google Play: Native purchase validation and localized pricing. Renewal, cancellation, and refund controls remain with the applicable store.

7. Privacy Contact

FRC Consultores Associados LTDA — Brazilian company tax ID (CNPJ) 22.052.463/0001-30

Privacy Channel: contato@frcconsultores.com.br

Account deletion requests: open the dedicated deletion page.