Privacy policy

1. Who is the controller

The controller of personal data is [NAME OR COMPANY NAME OF THE OPERATOR, WITH TAX ID], [CITY/STATE].

Contact for questions and to exercise your rights: [CONTACT E-MAIL]. Data protection officer: [NAME AND CONTACT, or a statement that the controller is a small-scale processing agent].

2. What data we process

Visitors. You do not need an account to browse. The text typed in the city search is sent to the server only to suggest cities. Our hosting may log technical access data (such as IP address and browser) for security and operation.

Professionals. When you sign up and build a profile, we process:

• identity and account: name, CRP number, e-mail, mobile phone, password (optional, stored in protected form) and consents;
• profile data: city, office address (postal code, street, number, complement and neighborhood), photo, office photos, biography, approach, education, start year, specialties, audiences, session price and duration, FAQ answers and public contacts.

Your access e-mail is not shown on the profile. The mobile phone given at sign-up is used to set up the account and is not shown on the profile. Only the data of a published profile is public, including the contacts the professional chooses to add to the contact list.

We do not collect patient data and ask professionals not to include it in their profile.

3. Why we use it and on what legal basis

• Creating and maintaining the professional's account, checking the CRP and publishing the profile: preliminary procedures and contract, and consent for publication.
• Sending access, confirmation and password-reset e-mails: performance of the service.
• Sending news and offers: only with your consent, which is optional and can be withdrawn at any time.
• Security, fraud prevention and login rate limiting: legitimate interest.

[Review the legal bases with legal counsel.]

4. Who we share it with

We do not sell personal data. We use providers that process data on our behalf (processors):

• application hosting: Vercel;
• database: [PROVIDER AND REGION OF THE DATABASE];
• transactional e-mail: MailerSend.

We also query the CFP/CRP public registry to check professional registrations. We may share data with authorities where required by law or court order.

These providers may process data on servers outside Brazil. [Confirm countries and safeguards.]

5. Cookies

We use a single essential cookie, psi_session, which keeps a professional signed in (up to 30 days) and cannot be read by scripts. We use no advertising cookies and no audience analytics. [Update this section if that changes.]

6. How long we keep it

We keep a professional's data while the profile exists. Sessions expire automatically, and access and password-reset links are single-use with a short validity.

When you ask for deletion, we remove or anonymize the data, except what we must keep by law. [Define retention periods, including backups.]

7. Your rights

Under article 18 of the LGPD you may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing and withdrawal of consent. Professionals can edit most data in the dashboard.

Write to [CONTACT E-MAIL]. You may also complain to the Brazilian data protection authority (ANPD).

8. Security

We use measures such as encrypted connections, protected password storage, keeping only a hash of access codes and login rate limiting. No system is completely immune to failure; in case of a relevant incident we will notify those affected and the ANPD as required by law.

9. Changes to this policy

We may update this policy. The current version is always on this page with the date of the last update.