Privacy policy
This Privacy Notice and the Terms of Use apply exclusively to the Caren platform.
By registering and using the services, you confirm that you have read and understood the Terms of Use and the Privacy Notice applicable to the service and agree to be bound by them.
You may withdraw your consent to the provisions of this Privacy Notice at any time by simply notifying Caren via email at privacidade@caren.app.
If you withdraw your consent or do not authorize the Privacy Notice, some of the services available on the platform may become unavailable for access. Refusal of the terms related to the Privacy Notice will prevent access to the platform.
PURPOSE:
The priority of Caren is to ensure the privacy and security of the data subjects' information.
Therefore, this Privacy Notice aims primarily to define the guidelines adopted by Caren regarding the collection, use, and disclosure of personal information. In other words, our goal is to provide transparency regarding the use of personal data and protect your privacy, as well as inform you about your rights or clarify any doubts regarding how your information is being used.
By accepting the Privacy Notice of Caren, the user acknowledges and agrees that we may process personal data in accordance with the terms set forth herein, as provided by Brazilian legislation, particularly the General Data Protection Law and related legislation.
If Caren modifies the terms of this Privacy Notice, you will be duly notified through our official communication channels with the User. At that time, you will have the opportunity to consent to the new terms or not.
If you have any questions or suggestions regarding the platform’s Privacy Notice or any other information, you may contact us via email at privacidade@caren.app, which will be responded to during business hours, Monday to Friday, from 9 AM to 6 PM.
GLOSSARY:
For a better understanding of this document, we will explain some definitions used in the Notice. Whenever you read the terms described below, whether in uppercase or lowercase, plural or singular, with or without bold, they should be interpreted as follows:
Personal Data: These are pieces of information that can identify a natural person, directly or indirectly. Direct identification occurs when the data itself identifies the person who is the data subject (e.g., CPF [Brazilian Taxpayer ID]). Indirect data, on the other hand, are those that require additional information for identification (e.g., residential address).
Sensitive Personal Data: These are data regarding racial or ethnic origin, religious beliefs, political opinions, membership in a union or religious, philosophical, or political organization, data concerning health or sexual life, genetic or biometric data, when linked to a natural person.
LGPD: Acronym referring to the General Personal Data Protection Law (Law No. 13.709/2018).
Processing: When any operation is performed with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of the information, modification, communication, transparency, dissemination, or extraction.
Legal Bases: Hypotheses in which the LGPD authorizes Caren to use personal data.
We or Our: This term is used when referring to Caren.
You: Any person accessing our website, whether as a visitor and/or User, and/or a representative of a legal entity that accesses or interacts with the activities or functionalities available on our website.
User: Employees or clients who use our service.
AWARENESS AND CONSENT – FREE AND INFORMED:
The patient user declares awareness that:
Through the platform, personal and health information will be transmitted to the professional responsible for the consultation via videoconference;
The care of patients under 18 years of age, or others who require representation or assistance, will occur in accordance with the Terms of Use and this Privacy Notice, with the participation and/or consent, as applicable, of at least one legal guardian and subject to the technical feasibility assessment by the professional responsible for the consultation;
It may be necessary, at the discretion of the professional responsible for the consultation, to conduct additional tests to assist in the diagnosis;
The healthcare professional responsible for the consultation may request the patient’s physical presence at a healthcare facility, even after a teleconsultation, due to the limitations of this type of technology-based support care;
Except for consultations conducted by Psychologists, the data collected in the teleconsultation will be recorded and stored in a medical record, which will maintain the required confidentiality as mandated by law;
The teleconsultation may be interrupted by either the patient or the healthcare professional;
PERSONAL DATA COLLECTED:
Data: full name; country; state; city; biological sex; password; professional registration; technical specialty, profile picture, CPF.
Purpose: Registration and identification of users on the platform.
Legal Basis: Healthcare Professional: Contract Execution / Patient: Consent.
Data: weight; height; date of birth; documents and tests uploaded to the platform.
Purpose: Provision of the platform and proper functioning of telehealth tools and electronic medical records.
Legal Basis: Health Protection.
Data: email and mobile phone.
Purpose: Communication.
Legal Basis: Consent.
Data: IP access log information, date, and time.
Purpose: Audit, Platform Security.
Legal Basis: Compliance with Legal Obligation.
The personal data collected by the platform have the specified legal basis. The data subject may revoke this consent at any time. Caren guarantees that personal data for which consent has been revoked and which are not supported by another legal basis justifying their retention will be duly deleted.
USE OF ARTIFICIAL INTELLIGENCE:
The platform may use artificial intelligence resources in part of its interactions, in order to support the care journey, including, at certain moments, conversational interactions with the patient and the analysis of information to flag risks to the healthcare team. Not all interactions available on the platform involve artificial intelligence.
Artificial intelligence acts solely as a support tool. Clinical decisions are, in all cases, the responsibility of the healthcare professional, and there is no automated decision producing effects on the patient without due human intervention.
Before processing by artificial intelligence models, personal data and sensitive personal data are subjected to pseudonymization and minimization techniques, so that the information sent for processing does not allow the direct identification of the data subject.
The artificial intelligence models are accessed through providers acting as data processors (operators), subject to contractual data protection obligations.
SHARING OF DATA:
To ensure the best delivery of our products and services, we rely on the collaboration of other companies in our operations. In some circumstances, it is necessary to share data with third parties, as described below:
Suppliers and partners: We rely on the assistance of suppliers and partners who may process personal data, including payment data. The information is shared exclusively to fulfill the purposes of the services provided. We always conduct a rigorous evaluation of our suppliers and partners, establishing contractual obligations for the protection of personal data to minimize risks to data subjects.
Public authorities: Your data may be shared with public authorities to comply with applicable legislation. If a judge or a legally competent authority requires the sharing of certain personal data, for example, for an investigation, we are obliged to comply with that request. However, we are strongly opposed to any abuse of authority and, if we consider an order to be abusive, we will always defend the privacy of data subjects.
STORAGE AND RETENTION OF DATA:
Caren stores your data on secure servers and follows its own internal policies for the retention and disposal of personal data, determining the appropriate retention period for each type of personal data collected. This considers the nature of the data, the need for collection, and the purpose for which it will be processed. Personal data is stored only for the time necessary to fulfill the purposes for which it was collected, unless there is another valid reason for its retention, such as compliance with legal, regulatory, contractual, or other obligations.
The primary responsibility for processing patient data lies with the healthcare professional who uses the platform as a virtual care tool. However, to enhance information security in its role as a data operator, Caren informs that electronic medical records will be stored for a period of 20 (twenty) years in accordance with current legislation.
INTERNATIONAL DATA TRANSFER:
Part of the processing and storage of data takes place in cloud infrastructure and artificial intelligence providers located abroad, currently in the United States of America.
This flow characterizes an international transfer of data, carried out in accordance with the legal bases and safeguards set forth in the General Data Protection Law (articles 33 and 34), including the execution of contractual data protection clauses with the processors involved.
Caren adopts security measures to protect the data subject to international transfer, including encryption in transit and at rest, access control, and prior pseudonymization of the information.
COOKIES:
What Cookies Are. A cookie is a piece of information stored locally on the User’s computer or device, containing information about their activities on the Internet.
Cookies Used. The cookies may be used in different ways and modalities. Caren may use:
Performance Cookies: This type of cookie collects anonymous information about how Users use the platform to optimize it. The information collected by these cookies never contains personal details from which you could be identified.
Necessary/Security Cookies: These are cookies absolutely essential for the proper functioning of the website. These cookies ensure basic functionalities and security features of the website anonymously.
Statistics Cookies: Statistics cookies help platform owners understand how visitors interact with the websites by collecting and reporting information anonymously.
Marketing Cookies: Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and, therefore, more valuable to publishers and third-party advertisers.
Access to Cookies. Access to cookies ends as soon as the User closes the browser. The User is given the option to accept or refuse cookies.
Consent for Use of Cookies. User acceptance is required before the session begins for cookies to be used.
Cookie-Free Option. The data subject may choose to refuse the use of cookies. If the User opts not to accept them, their access to most of the information available on the platform will not be compromised. However, the data subject may not be able to fully use the services offered.
DATA SUBJECTS’ RIGHTS:
Under the law, you have rights related to your data processed by us. Below, we provide a list of these rights along with information on how to exercise them. Upon receiving your request, we may require identity verification before fulfilling it. This verification may include requesting additional data to ensure your correct identification. Additionally, if you designate a third party to make requests on your behalf, that third party must provide documentation proving your authorization, such as a signed power of attorney.
To exercise any of these rights, you may contact us via the email provided.
Confirmation and Access: Allows you to verify whether we process your personal data and, if so, request a copy of the data we have about you.
Correction: Allows you to request the correction of any incomplete, inaccurate, or outdated personal data about you.
Anonymization, Blocking, or Deletion: Allows you to request that your data be anonymized (so it can no longer be linked to you and thus ceases to be personal data), temporarily blocked (suspending data processing), or deleted (permanently erasing all your data), except in cases provided by law.
Portability: You have the right to request, through an express request, that your personal data be provided to you or a third party of your choice in a structured and interoperable format for transfer to another provider, provided this does not violate Caren’s intellectual property or trade secrets.
Information on Sharing: You have the right to know which public and private entities we share your data with. If you have questions or want more details, you have the right to request this information.
Information on the Option to Not Consent: Allows you to have clear and complete information about the possibility and consequences of not providing consent. Your consent, when required, must be free and informed. Therefore, whenever we request your consent, you will be free to deny it, although in such cases, we may need to limit our services to you.
Revocation of Consent: You have the right to revoke your consent regarding processing activities based on consent. However, this will not affect the legality of any processing carried out previously. If you revoke your consent, we may not be able to provide certain communications or services, but we will inform you when this occurs.
Objection: The law allows the processing of personal data even without your consent. However, if you disagree with this processing, you may object to it in certain cases, requesting its interruption.
GENERAL INFORMATION:
The Platform operates in accordance with Brazilian legislation, complying, in particular, with the terms of Law No. 12.965/2014 (Internet Civil Framework), Law No. 13.709/2018 (General Data Protection Law), Law No. 13.787/2018 (Electronic Medical Record Law), CFM Resolution No. 2.314/2022 (Telemedicine Regulation), CFM Resolution No. 2.217/2018 (Medical Ethics Code), CFP Resolution No. 11/2018 (Psychological Services Provided via Information Technologies), CFP Resolution No. 10/2005 (Psychologist Professional Ethics Code), and other applicable laws.
If you have any questions, comments, or requests related to your personal data, please contact our Data Protection Officer responsible for personal data processing, who can be reached at: privacidade@caren.app.