LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Appointment form | Identify the appointment | Pre-contractual steps (item V) |
| Phone / WhatsApp and email | Appointment form | Confirm the appointment | Pre-contractual steps (item V) |
| Service of interest | Appointment form | Route the enquiry | Pre-contractual steps (item V) |
| Health information | Intake, in person | Treatment — sensitive data (LGPD art. 11) | Consent (item I) |
| Clinical records | During treatment | Clinical record keeping — sensitive data | Legal obligation (item II) |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
| Name, age and details of the enrolled child | Enrolment in the children’s class | To organise the class and its safety. A minor’s data under LGPD art. 14: processed in the child’s best interest and limited to what is needed | Specific, highlighted consent from the legal guardian (art. 14) |
| Legal guardian’s name and contact | Enrolment in the children’s class | To authorise the enrolment, to be notified, and to be the channel for any request about the child’s data | Consent (art. 14) and performance of a contract (art. 7, V) |
| Injury, surgery, pain and physical limitation | Screening before training and before any therapy | Sensitive health data (art. 5, II). Used only to adapt the exercise or to recommend the therapy safely | Specific consent (art. 11, I) and protection of health (art. 11, II, f) |
| Contraindications for cryotherapy and acupuncture | Screening before the session | To stop a session that must not happen. That is the only purpose and it feeds nothing else | Protection of health by a professional (art. 11, II, f) |
| Progress and session records | Physiotherapy and therapy appointments | To follow the case. A physiotherapy record carries its own retention period set by the profession’s council [CONFIRM the period] | Legal and regulatory obligation (art. 7, II) |
This address processes sensitive health data (LGPD art. 5, II) at almost every door: the screening before training, the complaint that leads to physiotherapy, the contraindication that stops a cryotherapy session. Art. 11 is narrower than art. 7 and requires specific, highlighted consent, or protection of health carried out by a professional. And some of that data belongs to a child, which adds art. 14 on top.
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Children’s data: the rule is different
The children’s jiu-jitsu class means a minor’s name, age and details in the records. LGPD art. 14 treats that separately from everything else and requires three things:
- the processing must be in the child’s best interest;
- it needs specific, highlighted consent from a parent or legal guardian — a generic tick-box at the foot of a form does not do;
- a child’s participation cannot be conditioned on handing over more data than is necessary.
That is why the children’s enrolment form on this site starts with the legal guardian, keeps the consent separate from everything else, and will not proceed without it. The child does not go onto a marketing list, and the guardian can withdraw consent at any time. [CONFIRM where that consent is recorded today and who has access to the children’s class records]
Images of children
Photos and video of a kids’ class are the content that circulates most in this trade and the content that demands the most care. A minor’s image requires specific written permission from the guardian, separate from the enrolment contract, stating where the image may appear and for how long — and that permission can be withdrawn, which in practice means knowing which post each child appears in.
No image on this site shows a child. Every photo is stock, labelled as a placeholder, and shows adults or empty spaces. [CONFIRM the studio’s image policy]
Five activities, five councils, no registration published
Physical training, physiotherapy, chiropractic, acupuncture and cryotherapy do not answer to the same professional council, and each brings its own duty of confidentiality and its own record-retention period. A physiotherapy record, for instance, is not deleted because the client asked: a regulatory period applies.
No registration number was published anywhere and none has been invented on this site. CREF, CREFITO and the credentials of whoever performs acupuncture and chiropractic [CONFIRM all of them]. Health-authority licence and AVCB fire certificate for the unit [CONFIRM — never invent a certificate number].
Who the controller is
Registered name, CNPJ, the unit inside the shopping centre and the data officer (DPO) who receives art. 18 requests [CONFIRM all of them]. None of it could be found and none of it was invented.
One point is worth insisting on: an Instagram inbox is not a data-subject channel. It has no deadline, no auditable record, and it depends on somebody seeing the message. For an address processing adults’ health data and children’s data, that does not hold. A dedicated e-mail address solves it. [CONFIRM]
Cookies
Everything non-essential is off by default and nothing is pre-ticked. One observation that usually goes unmade: a remarketing audience built from the children’s class page is an audience of parents assembled from a page about minors. That needs a decision before it needs a tag. [CONFIRM]
Retention
Enquiries that did not become an enrolment [CONFIRM]. Enrolment and fees follow the applicable tax and civil periods [CONFIRM]. Physiotherapy records follow the council’s period [CONFIRM]. Children’s class records are deleted when the child leaves, except anything tied to a legal period [CONFIRM].
Plans, cancellation, and no promise of a result
Minimum term, cancellation notice, penalty and suspension have to be clear before signature. CDC art. 46 says a consumer is not bound by a clause they had no chance to know, and art. 54 requires limiting clauses to be highlighted. [CONFIRM all the terms]
No page on this site promises a health result. No activity is presented as treating, curing or relieving a condition. Under the CDC (arts. 30 and 37) advertising binds whoever publishes it, and a health-outcome promise is where that costs the most.