Laudário privacy, security and terms of use

1. Roles in data processing

In the context of the use of the Platform:

• The Client (physician, clinic or healthcare company) acts as the Controller of the personal data entered into the system, being responsible for defining the purposes and legal bases of the processing
• Laudário acts as the Processor, processing personal data on behalf of the Controller and in accordance with its legitimate instructions
• For data collected directly by Laudário, such as the registration data of the administrator user, Laudário may act as Controller

2. Data collected

2.1 Platform User Data

• Full name
• Professional email
• Phone number
• CPF or CNPJ, when applicable
• Billing data
• Professional registration, such as CRM, when applicable
• IP address and access logs
• Location of the account holder's phone, only when the account requires login approval by phone, for account security and to detect shared use

2.2 Patient Data entered by the Client

• Name
• Date of birth
• Clinical identifiers
• Medical information and health data
• Images and exams, when applicable

Patient data is entered exclusively by the Client, who is responsible for its legitimacy, purpose and legal basis for processing.

3. Purposes of processing

Personal data may be processed to:

• Enable the operation of the Platform
• Allow the creation, editing and storage of reports
• Manage user accounts, access and profiles
• Process payments, charges and billing
• Comply with legal and regulatory obligations
• Ensure security, traceability and fraud prevention
• Improve system features, stability and performance
• Measure the results of Laudário ads and avoid showing them to existing customers
• Produce statistics and scientific studies using anonymized, pseudonymized or aggregated data, as described below

Statistics and scientific research. Laudário may use Platform usage metrics and anonymized or aggregated data to produce statistics, improve the service and carry out scientific studies, subject to the following:

• Editor usage metrics include the time taken to prepare the report, the type of exam, the number of fields changed and the use of dictation. They do not include patient names, exam identifiers or report text, and the user account is represented by a code (pseudonymization)
• Results are disclosed only in aggregated form, without identifying patients, professionals or clinics
• Laudário does not attempt to re-identify individuals and does not sell individual data
• Report content is used in research only after anonymization and with the authorization of the Client, who is the Controller of that data
• Studies intended for scientific publication undergo review by a Research Ethics Committee, when required
• The Client may request, through the channels in this Policy, that their account data not be used in new studies. Results already aggregated or published cannot be withdrawn

4. Legal bases

Data processing may be based on the following legal bases:

• Performance of a contract
• Compliance with a legal or regulatory obligation
• Protection of health, when applicable
• Legitimate interest
• Consent, when necessary

5. Data sharing

Laudário may share data only when necessary for:

• Cloud infrastructure providers
• Backup and storage services
• Payment processing services
• Advertising platforms (Google Ads and Meta, owner of Instagram and Facebook), within the limits described in section 10
• Compliance with a legal obligation
• Compliance with a court order or a request from a competent authority

Laudário requires contracted third parties to adopt adequate standards of security, confidentiality and data protection.

6. Storage and security

Laudário adopts appropriate technical and administrative measures to protect data against unauthorized access, loss, destruction, improper alteration or unauthorized disclosure.

The measures applied may include:

• Data encryption, when applicable
• Role-based access control
• Audit logs and traceability
• Periodic backups
• Security monitoring and incident prevention

7. Data retention

Personal data will be kept for as long as necessary to fulfill the purposes for which it was collected, respecting legal obligations, healthcare regulations and contractual requirements.

8. Rights of data subjects

Under the LGPD, data subjects have the following rights:

• Confirmation of the existence of processing
• Access to the data
• Correction of incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion of unnecessary data
• Portability, when applicable
• Information about sharing
• Withdrawal of consent, when consent is the legal basis

Requests related to patient data must be sent to the respective Controller (clinic, company or responsible professional). When Laudário acts as Controller, requests may be made through the contact indicated in this Policy.

9. International transfer

If data is stored on infrastructure located outside Brazil, Laudário will adopt adequate measures to ensure that the international transfer complies with the LGPD, through contractual safeguards and equivalent protection mechanisms.

10. Cookies and similar technologies

Cookies are small files stored in the browser. On the Laudário website and public pages we use two categories:

• Necessary: keep the login session, store the chosen language and your cookie choice, and help with security. They do not depend on consent, because the service does not work without them. They last for the session or up to 12 months.
• Advertising: used by Google Ads and the Meta Pixel (Instagram and Facebook) to measure which ads lead to sign-ups and subscriptions and to show Laudário ads to people who have visited the site. They are only enabled with your consent; until then, the Google tag works without storing cookies (Google Consent Mode) and the Meta Pixel sends nothing. Their duration follows each platform's rules, usually from 90 days to 13 months.

In the logged-in area of the Platform, the Google Ads tag follows the same cookie choice and is loaded at most once per session, reporting only a fixed Platform address. The address, title and content of the screens, including patient and report data, are never sent to Google. The Meta Pixel is not loaded in the logged-in area.

On the first visit we show a notice to accept, reject or configure advertising cookies. The choice is kept for 12 months and can be changed at any time through the "Cookie preferences" link in the site footer, or by deleting the browser cookies. Rejecting does not prevent use of the site or the Platform.

To measure ad results, Laudário may record, at sign-up, the ad click identifier (GCLID) and inform Google Ads which clicks resulted in a subscription. Customer contact data (e-mail and phone) may also be sent to Google in encrypted form, to measure ads and avoid showing them to existing customers. More information about Google's processing: policies.google.com/technologies/ads. About Meta's: facebook.com/privacy/policy.

11. Changes to this Policy

This Policy may be updated periodically to reflect legal, regulatory or operational changes or developments of the platform. We recommend reviewing this document regularly.

12. Contact and Data Protection Officer

For questions or requests related to data protection:

• Data Protection Officer (LGPD): Laudário
• Email: [email protected]

By using the platform, the user declares to be aware of this Privacy Policy and of how Laudário processes personal data in the context of its services.