How we handle your personal data.

This policy describes how Medunity LTDA collects, uses, stores and protects your personal information, in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018) and other applicable regulations.

Last updated: August 2026

1. Data Controller

Medunity LTDA is the controller of personal data collected through the platform. This means we are responsible for deciding how and why your data is processed. Our Data Protection Officer (DPO) can be contacted at dpo@cuidalia.com.br for any privacy-related questions.

2. Personal Data Collected

We collect different categories of data: Registration data — full name, email, phone number, ID number (when required for booking), date of birth. Professional profile data — professional registration number, specialties, practice address, academic background. Usage data — pages visited, searches performed, clicks, time spent, interactions with professionals. Technical data — IP address, browser type, operating system, device, approximate geolocation. Transaction data — booking history, reviews made, messages exchanged.

3. Legal Bases for Processing

We process your data based on: Contract performance — to provide the contracted services (booking, profile, communication). Consent — for marketing communications, analytical cookies and experience personalization. Legitimate interest — for platform improvement, fraud prevention, security and aggregated statistical analysis. Legal obligation — for compliance with tax, regulatory requirements and judicial requests. Protection of life — in exceptional cases related to the data subject's health.

4. Purposes of Processing

Your data is used to: create and maintain your platform account; process and manage appointment bookings; send confirmations, reminders and appointment notifications; display professional profiles in search results; personalize recommendations and relevant results; send communications about news and features (with consent); prevent fraud, abuse and misuse of the platform; generate aggregated statistics and reports (without individual identification); comply with legal and regulatory obligations; and continuously improve the quality of our services.

5. Data Sharing

We share your personal data only in the following situations: With healthcare professionals — name and contact details to facilitate scheduled appointments. With service providers — infrastructure providers (cloud hosting), transactional email, payment processing, always under contracts with confidentiality and data protection clauses. With authorities — when required by law, court order or legal proceedings. We NEVER sell, rent or trade your personal data with third parties for marketing or advertising purposes.

6. External Search and Third-Party Sources

When you search by specialty and city, in addition to professionals registered on Cuidalia, we may display complementary results obtained publicly through the Google Places API, always identified as "We also found these on Google" with visible attribution. We log these searches and interactions with those results (views, clicks) for statistical purposes and platform improvement, based on our legitimate interest. If you use the "Notify me" feature, we collect the email you provide and use it, with your explicit consent, to notify you if the professional joins Cuidalia — and to let the professional know there was patient interest in the area, as part of our commercial outreach to those professionals. You may request removal of that request at any time through the contact channels in this policy. Content obtained from Google is not stored for more than 30 days, and its display does not represent an endorsement, verification, or affiliation between Cuidalia and the professional shown.

7. Storage and Security

Your data is stored on secure servers with the following protection measures: TLS 1.3 encryption in transit and AES-256 at rest; role-based access control (RBAC) with principle of least privilege; continuous monitoring of unauthorized access attempts; regular encrypted backups; environment segregation (development, staging, production); periodic security audits; and documented and tested incident response plan.

8. Cookies and Tracking Technologies

We use cookies and similar technologies for: Essential cookies — necessary for platform operation (session, authentication, language preference). Without them, the platform does not function properly. Analytical cookies — to understand usage patterns, most visited pages and needed improvements. Can be disabled. Preference cookies — to remember your choices (theme, language, search filters). We do NOT use third-party advertising cookies. You can configure your browser to block non-essential cookies, but this may affect platform features.

9. Your Rights

You have the right to: Confirmation — know if we process your personal data. Access — obtain a copy of the data we hold about you. Correction — correct incomplete, inaccurate or outdated data. Anonymization/Blocking/Deletion — request processing of unnecessary or excessive data. Portability — receive your data in a structured format for transfer to another service. Deletion — request deletion of data processed based on consent. Information — know with whom we share your data. Revocation — withdraw consent at any time. To exercise your rights, access your account settings or send a request to privacy@cuidalia.com.br. We will respond within 15 business days. The right to erasure does not cover data processed on a legal basis other than consent, such as health and clinical records, which are subject to a statutory retention period (see section 10).

10. Data Retention

We keep your personal data for the following periods: Active account — while your account exists and is used. After account deletion — data is removed within 30 days. Transaction data — kept for 5 years for tax and legal purposes. Security log data — kept for 6 months. Published reviews — maintained even after account deletion (anonymized). Data may be retained for longer when required by law or for defense in legal proceedings. Health records and clinical records — kept for at least 20 (twenty) years from the last entry, as required by Brazilian Law 13.787/2018. For this reason, deleting your account does not erase clinical records: they remain in the custody of the professional or clinic responsible for the appointment, with restricted and audited access. The record's change history is also preserved, to protect the integrity of the record.

11. International Data Transfer

Some of our service providers may be located outside Brazil. In such cases, we ensure that the transfer occurs to countries with an adequate level of protection or through standard contractual clauses that ensure protection equivalent to the LGPD.

12. Children's Data

The platform is intended for users over 18 years of age. Minors under 18 may only use the platform with verifiable consent from parents or legal guardians. If we become aware that we have collected data from minors without adequate consent, we will delete that information immediately.

13. Security Incidents

In the event of an incident that may cause risk or significant harm to data subjects, we will notify the Brazilian National Data Protection Authority (ANPD) and affected data subjects within a reasonable time, as required by the LGPD, informing: the nature of affected data, risks involved, measures adopted for mitigation and recommendations to the data subject.

14. Changes to This Policy

This Policy may be updated periodically. Significant changes will be communicated via email or platform notification at least 15 days in advance. The updated version will always be available on this page with the date of the last modification.

15. Contact and Channels

For questions, requests or complaints about privacy and data protection: Data Protection Officer (DPO): dpo@cuidalia.com.br. General support: privacy@cuidalia.com.br. If you are not satisfied with our response, you may file a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.