How we handle your personal data.

This policy describes how Medunity LTDA collects, uses, stores and protects your personal information, in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018) and other applicable regulations.

Last updated: June 2026

1. Data Controller

Medunity LTDA is the controller of personal data collected through the platform. This means we are responsible for deciding how and why your data is processed. Our Data Protection Officer (DPO) can be contacted at dpo@cuidalia.com.br for any privacy-related questions.

2. Personal Data Collected

We collect different categories of data: Registration data — full name, email, phone number, ID number (when required for booking), date of birth. Professional profile data — professional registration number, specialties, practice address, academic background. Usage data — pages visited, searches performed, clicks, time spent, interactions with professionals. Technical data — IP address, browser type, operating system, device, approximate geolocation. Transaction data — booking history, reviews made, messages exchanged.

3. Legal Bases for Processing

We process your data based on: Contract performance — to provide the contracted services (booking, profile, communication). Consent — for marketing communications, analytical cookies and experience personalization. Legitimate interest — for platform improvement, fraud prevention, security and aggregated statistical analysis. Legal obligation — for compliance with tax, regulatory requirements and judicial requests. Protection of life — in exceptional cases related to the data subject's health.

4. Purposes of Processing

Your data is used to: create and maintain your platform account; process and manage appointment bookings; send confirmations, reminders and appointment notifications; display professional profiles in search results; personalize recommendations and relevant results; send communications about news and features (with consent); prevent fraud, abuse and misuse of the platform; generate aggregated statistics and reports (without individual identification); comply with legal and regulatory obligations; and continuously improve the quality of our services.

5. Data Sharing

We share your personal data only in the following situations: With healthcare professionals — name and contact details to facilitate scheduled appointments. With service providers — infrastructure providers (cloud hosting), transactional email, payment processing, always under contracts with confidentiality and data protection clauses. With authorities — when required by law, court order or legal proceedings. We NEVER sell, rent or trade your personal data with third parties for marketing or advertising purposes.

6. Storage and Security

Your data is stored on secure servers with the following protection measures: TLS 1.3 encryption in transit and AES-256 at rest; role-based access control (RBAC) with principle of least privilege; continuous monitoring of unauthorized access attempts; regular encrypted backups; environment segregation (development, staging, production); periodic security audits; and documented and tested incident response plan.

7. Cookies and Tracking Technologies

We use cookies and similar technologies for: Essential cookies — necessary for platform operation (session, authentication, language preference). Without them, the platform does not function properly. Analytical cookies — to understand usage patterns, most visited pages and needed improvements. Can be disabled. Preference cookies — to remember your choices (theme, language, search filters). We do NOT use third-party advertising cookies. You can configure your browser to block non-essential cookies, but this may affect platform features.

8. Your Rights

You have the right to: Confirmation — know if we process your personal data. Access — obtain a copy of the data we hold about you. Correction — correct incomplete, inaccurate or outdated data. Anonymization/Blocking/Deletion — request processing of unnecessary or excessive data. Portability — receive your data in a structured format for transfer to another service. Deletion — request deletion of data processed based on consent. Information — know with whom we share your data. Revocation — withdraw consent at any time. To exercise your rights, access your account settings or send a request to privacy@cuidalia.com.br. We will respond within 15 business days.

9. Data Retention

We keep your personal data for the following periods: Active account — while your account exists and is used. After account deletion — data is removed within 30 days. Transaction data — kept for 5 years for tax and legal purposes. Security log data — kept for 6 months. Published reviews — maintained even after account deletion (anonymized). Data may be retained for longer when required by law or for defense in legal proceedings.

10. International Data Transfer

Some of our service providers may be located outside Brazil. In such cases, we ensure that the transfer occurs to countries with an adequate level of protection or through standard contractual clauses that ensure protection equivalent to the LGPD.

11. Children's Data

The platform is intended for users over 18 years of age. Minors under 18 may only use the platform with verifiable consent from parents or legal guardians. If we become aware that we have collected data from minors without adequate consent, we will delete that information immediately.

12. Security Incidents

In the event of an incident that may cause risk or significant harm to data subjects, we will notify the Brazilian National Data Protection Authority (ANPD) and affected data subjects within a reasonable time, as required by the LGPD, informing: the nature of affected data, risks involved, measures adopted for mitigation and recommendations to the data subject.

13. Changes to This Policy

This Policy may be updated periodically. Significant changes will be communicated via email or platform notification at least 15 days in advance. The updated version will always be available on this page with the date of the last modification.

14. Contact and Channels

For questions, requests or complaints about privacy and data protection: Data Protection Officer (DPO): dpo@cuidalia.com.br. General support: privacy@cuidalia.com.br. If you are not satisfied with our response, you may file a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.