Privacy policy

Clínica Almaaz Serviços Médicos Ltda (“Clínica Almaaz”, the “Clinic” or “we”), registered under CNPJ 21.590.169/0001-19, with offices at Av. Ataulfo de Paiva 391, rooms 407 and 408, Leblon, Rio de Janeiro, RJ, 22440-032, Brazil, is the Controller of the personal data collected on this website, www.clinicaalmaaz.com.br. This Policy explains, in plain terms, how we handle your personal data when you sign up for our membership programme or our newsletter, under Brazilian Law 13.709/2018 (the General Data Protection Law, “LGPD”).

This is a courtesy translation of the Portuguese original. In case of any divergence, the Portuguese version prevails.

1. Who it applies to and what it covers

This Policy applies to visitors to the website and to people who sign up for the membership programme or the newsletter, Brazilian or foreign, under article 3 of the LGPD.

It does not cover clinical care, in person or by telemedicine, which is governed by its own documents provided at the appointment, nor medical record data, which follows professional secrecy and the applicable legislation.

Sign-up is for people aged 18 or over. Minors may only be registered by a parent or legal guardian. The Clinic does not direct this website or its advertising to children or teenagers.

2. What data we collect

We do not ask for health data through the website. Please do not enter diagnoses, test results or other health information in forms or messages on the site. If you do, we will treat that data confidentially and only as far as necessary.

On confidentiality: taking part in the membership programme may indicate that you are a patient of the Clinic. For that reason your sign-up data is treated confidentially and is never disclosed to third parties for advertising purposes.

• Sign-up data: name, e-mail and telephone, and only these. They are the data necessary for the services offered through the website (principle of necessity, article 6, III).
• Browsing data: IP address, date and time of access, device, browser and pages visited, as well as cookies (see item 8).
• Newsletter interaction data: through the sending platform we may know whether an e-mail was delivered, opened or clicked, only to measure reach and improve the content.

3. What we use your data for, and on what basis

On consent. The newsletter is optional and is requested in its own field, which is not pre-ticked. You may withdraw consent at any time, free of charge and easily, through the unsubscribe link in the messages or by contacting the Data Protection Officer (item 10). Refusing or cancelling the newsletter does not prevent you from taking part in the membership programme and does not affect your care. We will continue to send essential communications about the programme, such as changes to its rules or to contracted benefits.

Your health data is not used for marketing. We do not use medical record information or health data for the newsletter or for promotional communications. Any such use would require specific, highlighted consent, and is not planned.

We do not sell or transfer your data to third parties for advertising purposes.

4. Who else sees it

We share data only when necessary and to the minimum extent, with:

• suppliers who process data on our behalf (processors): e-mail and newsletter sending platform, customer relationship (CRM) and membership system, website, e-mail and cloud storage providers, and messaging services;
• public authorities, where there is a legal obligation or a court order.

Our suppliers may only use the data under our instructions and are bound by security and confidentiality duties.

5. International transfer

Some suppliers may store or process data on servers outside Brazil. This only happens under one of the mechanisms in article 33 of the LGPD and in ANPD Resolution 19/2024, such as a country or body recognised as adequate by the ANPD (currently the European Union, under ANPD Resolution 32/2026), standard contractual clauses, or specific and highlighted consent. You may ask the Data Protection Officer for information about the destination countries and the mechanism used.

6. How long we keep your data

• Membership: while your account is active and, afterwards, for as long as needed to comply with legal obligations and to exercise rights.
• Newsletter: until you unsubscribe or withdraw consent. We keep only the minimum record of the consent and of the cancellation, to honour your choice and to evidence compliance with the law.
• Browsing data: for the period set by the legislation applicable to access logs (Brazilian Internet Civil Framework, Law 12.965/2014).

Once the period ends, data is deleted or anonymised, unless a new legal obligation applies (articles 15 and 16 of the LGPD).

7. Security and incidents

We take technical and administrative measures to protect your data against unauthorised access, loss and misuse, among them: secure connection (HTTPS), access control restricted by role, backups, confidentiality agreements with suppliers and staff training. In the event of an incident that may cause relevant risk or harm, we will notify the ANPD and the affected data subjects within the regulatory deadline (currently three business days, ANPD Resolution 15/2024).

8. Cookies

We use cookies and similar technologies. Those strictly necessary for the operation and security of the website do not depend on consent. Analytics, marketing and third-party cookies are only activated with your consent, which can be managed or withdrawn at any time in the cookie preferences tool on the website or in your browser settings.

9. Your rights

Under article 18 of the LGPD you may request, at any time: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data or data processed in breach of the law; portability; deletion of data processed on the basis of consent; information about the entities with which we share your data; information about the possibility of refusing consent and its consequences; withdrawal of consent; and objection to processing carried out on a basis other than consent, where the law has been breached.

We will answer immediately in simplified form, or by full statement within 15 days (article 19). There is no charge. For your safety, we may confirm your identity before answering. You may also complain to the Brazilian Data Protection Authority (ANPD) or turn to consumer protection bodies and to the courts.

10. Data Protection Officer and contact channel

To exercise your rights or ask questions about this Policy, contact our Data Protection Officer, the channel of communication between the Clinic, data subjects and the ANPD:

• Officer: Juliana Ananias da Silva
• E-mail: lgpd.almaaz@gmail.com
• Telephone: +55 21 99835-3644

11. Updates and applicable law

This Policy is governed by Brazilian law, in particular the LGPD, the Consumer Protection Code and the Internet Civil Framework, and may be updated to reflect legal changes or changes in our processes. Changes will be published on this page, with the date of the last update. If there is a relevant change in the purposes of processing, we will inform data subjects and, where necessary, ask for new consent.