LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Appointment form | Identify the appointment | Pre-contractual steps (item V) |
| Phone / WhatsApp and email | Appointment form | Confirm the appointment | Pre-contractual steps (item V) |
| Service of interest | Appointment form | Route the enquiry | Pre-contractual steps (item V) |
| Health information | Intake, in person | Treatment — sensitive data (LGPD art. 11) | Consent (item I) |
| Clinical records | During treatment | Clinical record keeping — sensitive data | Legal obligation (item II) |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
| Area of interest | Booking button | To route you to the right professional among the eight areas | Preliminary steps to a contract (item V) |
| What you say about a symptom or condition | WhatsApp conversation and intake form | Sensitive personal data (art. 5, II). Used to assess and build the care plan — see the dedicated section below | Specific, highlighted consent (art. 11, I) or health protection by a professional (art. 11, II, f) |
| Clinical record and treatment history | Appointments | Continuity of care and a professional-council obligation | Health protection (art. 11, II, f) and legal obligation (item II) |
This is the difference that changes everything on this page: health data is sensitive personal data under LGPD art. 5, II, and its regime (art. 11) is stricter than that of a phone number or an email address. Consent for sensitive data must be specific and highlighted — it cannot be folded into a generic “I agree”, nor bundled with cookie consent.
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
The WhatsApp conversation is the intake form
The booking path here is WhatsApp, which means the first thing a new person does is describe a symptom in an app. Worth saying out loud: from the moment the message is sent, the processing of that data inside the app is also governed by Meta Platforms’ policy, over which we have no control.
So the practical guidance is: send enough to book, and leave the clinical detail for the assessment with the professional. How long conversations are kept and on which device [CONFIRM].
Clinical records
A treatment record in a health establishment has its own retention period, set by the professional council of whoever provides the care, and it cannot be deleted on request while that period runs — that is a legal obligation, not our choice. Who holds it, where, for how long and who has access [CONFIRM — and the answer changes with each professional’s council].
Who processes data on this site today
On the current site, three third-party services load before any consent:
- Google Tag Manager (GTM-PXGKXCQS) — a tag container. [CONFIRM what runs inside it]
- Google reCAPTCHA — a functional processor on the form, but still a Google service that sees the visitor’s IP. On a health site it is worth asking whether it is needed.
- Facebook domain verification — and, behind it, probably a pixel. [CONFIRM whether it is live]
All three process outside Brazil, so each needs a stated international-transfer basis (art. 33). In this proposal all three sit behind the consent bar, off by default.
What this site does not publish, and why
There is no before-and-after photograph anywhere, no gallery, no slider and no space held for one — CFM Resolution 1.974/2011 prohibits before/after imagery in medical advertising in Brazil. There is also no price, promotion or discount on any service, under the same resolution, until it is confirmed which offerings are medical procedures and which are wellness services.
And no image on this site is a Valena room, professional or client: every one is stock and labelled as such. No face appears beside a treatment name, because a face beside a treatment is read as a result.
Professional registrations
A health establishment must display its responsible professional and that person’s council registration, as well as a current municipal health licence [CONFIRM]. Depending on the services provided, waste management (RDC 222/2018) and sterilisation protocols also apply [CONFIRM]. None of it has been assumed here.