Privacy Policy

1. Introduction

Dr. Paula Andrade - Humanized and Integrative Pediatrics ("we", "our", or "the Practice"), registered under CRM-SP 204778, RQE 131771, with offices located at Av. Brig. Faria Lima, 1912, Suite 7G, Itaim Bibi, São Paulo - SP, Brazil, is committed to protecting the privacy and personal data of our patients and website visitors.

This Privacy Policy has been prepared in compliance with Brazil's General Data Protection Law (LGPD - Law No. 13.709/2018) and other applicable regulations, and aims to inform you how we collect, use, store, and protect your personal information.

Note for expat families: Brazil's LGPD is similar in scope to the European GDPR and provides robust data protection rights. All data processing described here follows Brazilian law.

2. Data Controller

3. Data We Collect

3.1 Data you provide:

• Full name
• Phone number and WhatsApp
• Email address
• Information about the child (name, age, health history)
• Address (when needed for home visits)

3.2 Data collected automatically:

• IP address
• Browser type and device
• Pages visited and time spent
• Traffic source (how you reached the site)
• Cookies and similar technologies

3.3 Sensitive health data:

During consultations, we may collect sensitive health data(Art. 11 of LGPD), including medical history, allergies, current medications, and information about the child's development. This data is treated with the highest level of protection and medical confidentiality.

4. Purpose of Data Processing

We use your personal data for:

• Medical services: appointment scheduling, pediatric care, patient follow-up
• Communication: appointment reminders, medical guidance, answering questions
• Legal obligations: compliance with CFM (Federal Council of Medicine) regulations, health surveillance, and other regulatory bodies
• Website improvement: navigation analysis to enhance the user experience
• Marketing (with consent):sending educational content about children's health
• Email marketing: processing and delivery of free educational materials via Cloudflare Workers infrastructure

5. Legal Basis for Data Processing

Personal data processing is carried out based on the following legal grounds (Art. 7 and 11 of LGPD):

• Consent: for the use of analytical cookies and sending marketing communications
• Contract performance: for providing the contracted medical services
• Legal obligation: for compliance with CFM regulations and health legislation
• Health protection: for protecting the life and physical integrity of the patient
• Legitimate interest: for improving services and website security

6. Cookies and Tracking Technologies

We use cookies for:

• Essential cookies: necessary for the website to function
• Analytical cookies (Google Analytics): to understand how visitors use the site

You can manage your cookie preferences through the consent banner displayed when you access the site. Declining analytical cookies does not affect your browsing experience.

7. Data Sharing

Your data may be shared with:

• Laboratories and clinics: when necessary for complementary exams
• Other healthcare professionals: in case of medical referrals
• Health authorities: in case of mandatory notification
• Service providers: website hosting (Cloudflare), analytics (Google), email delivery (Cloudflare Workers)

We do not sell, rent, or commercialize your personal data to third parties.

8. Data Retention

• Medical records: kept for a minimum of 20 years after the last appointment (CFM Resolution No. 1.821/2007)
• Browsing data: kept for up to 26 months
• Contact data: kept as long as there is a relationship with the practice or until you request deletion
• Email marketing data: kept until you unsubscribe or request deletion

9. Your Rights (Art. 18 of LGPD)

You have the right to:

• Confirmation of the existence of data processing
• Access to your personal data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data
• Portability of data to another service provider
• Deletion of data processed based on consent
• Information about data sharing
• Revocation of consent at any time

To exercise your rights, contact us at contato@drapaulaped.com.br or the Data Protection Contact at contato@drapaulaped.com.br. We will respond within 15 business days.

10. Data Security

We adopt technical and organizational measures to protect your data, including:

• SSL/TLS encryption on all communications
• Hosting on secure infrastructure (Cloudflare)
• Restricted access control for sensitive data
• Medical confidentiality as per the Brazilian Code of Medical Ethics

11. Children's and Adolescents' Data

We process children's and adolescents' data exclusively for pediatric medical care purposes, always with the consent of parents or legal guardians, in accordance with Art. 14 of LGPD.

12. Changes to This Policy

This Privacy Policy may be updated periodically. Significant changes will be communicated through a notice on the website. We recommend that you review this page regularly.

13. Contact

For questions, requests, or complaints related to privacy and data protection, please contact us:

14. National Data Protection Authority (ANPD)

If you are not satisfied with our response or believe your data is being processed improperly, you may contact Brazil's National Data Protection Authority (ANPD):

Website: www.gov.br/anpd