Privacy Policy

Last Updated: October 5, 2026

Hello! Welcome to the INSTITUTO IDEIA FERTIL DE SAUDE REPRODUTIVA web portal!

First, thank you very much for visiting! Please know that when you enter our portal, you entrust us with your personal data and information. That is why we are committed to maintaining that trust.

Our Privacy Notice will explain to you, clearly and accessibly, which personal data will be collected, with whom it will be shared, and where it will be stored.

DPOnet, registered with the Brazilian National Registry of Legal Entities (CNPJ) under No. 36.487.128/0001-79, has been appointed as our Data Protection Officer. As such, it is qualified to perform all the functions and responsibilities of the position provided for in the Brazilian General Personal Data Protection Law (LGPD).

If you wish to exercise any of your rights set forth in the LGPD, simply click the “LGPD Communication Channel” Seal on our website and complete the “Data Subject Request Form.”

By accessing and browsing our portal, you accept our Notice, acknowledging and fully agreeing to how we will use your personal information.

To make it easier for you to understand, our Privacy Notice is organized as follows:

1. Information Collected
2. Why and How We Use Your Data
3. Information Sharing
4. Data Subjects’ Rights
5. Information Security
6. Updates to Our Privacy Notice
7. Applicable Law
8. Data Protection Officer Contact Information

1. INFORMATION COLLECTED:

This section presents the main activities involving the collection of your personal information, according to the main purposes, affected data subjects, legal bases, and categories of personal data collected to enable you to interact with us:

Information provided by you:

• Registration data: when you register on our website, you provide us with information essential to creating your account.
• Authentication information: to ensure a secure browsing environment, we may request additional identification and authentication information.

Automatically generated information:

• Access logs: the organization automatically collects application access logs, which may include the IP address used to access our website, along with the date and time. The collection of this data is mandatory under Law No. 12,965/2014, also known as the Brazilian Internet Civil Rights Framework, but it will only be provided to third parties with your express authorization or pursuant to a court order.
• Communication with the organization: when you communicate with the organization, we collect information about your communication, including metadata such as IP address, date, time, and the content of communications, including any information you choose to provide.
• Website management: for this purpose, we use cookies, which are text files generated and stored in your browser or device by websites, applications, and online advertisements, as described in Section 3.

2. WHY AND HOW DO WE USE YOUR DATA?

We greatly value your privacy, and that is precisely why all data and information about you are handled with the highest level of confidentiality, used solely for the purposes described here, which you are aware of and have authorized:

Purpose: To allow you to access and use all the features of our portal

Affected data subjects: Data subjects and their legal representatives

Legal basis: Legitimate interest (Article 7, item IX)

Category of personal data: Registration and identification data

Purpose: To comply with legal obligations (responding to requests to exercise rights)

Affected data subjects: Data subjects and their legal representatives

Legal basis: Compliance with a legal obligation (Article 7, item II)

Category of personal data: Registration and identification data; Information about the data subject’s interaction with processing agents

Purpose: To send messages, alerts, notifications, and updates regarding support or services provided, products, services, promotions, news, updates, events, and other matters that may interest you

Affected data subjects: Data subjects and their legal representatives

Legal basis: Legitimate interest (Article 7, item IX)

Category of personal data: Registration and identification data

Purpose: To detect and prevent fraud, spam, and security incidents

Affected data subjects: Data subjects and their legal representatives

Legal basis: Compliance with a legal obligation (Article 7, item II)

Category of personal data: Registration and identification data

Purpose: To verify or authenticate the information you provide, including by comparing it with data collected from other sources

Affected data subjects: Data subjects and their legal representatives

Legal basis: Performance of contracts (Article 7, item V)

Category of personal data: Registration and identification data

Purpose: For any purpose you authorize at the time of data collection

Affected data subjects: Data subjects and their legal representatives

Legal basis: Consent (Article 7, item I)

Category of personal data: Registration and identification data

We may occasionally use data for purposes other than those provided for in this Privacy Notice, but all such purposes will fall within your legitimate expectations. Any use of your data for purposes that do not meet this condition will require your prior authorization.

Storage of personal data:

We store your personal data securely, in accordance with the security standards applicable to the circumstances, and in a manner that facilitates the exercise of your rights under the LGPD.

Deletion of personal data:

All personal data collected will be deleted from our servers upon your request, through a free and straightforward procedure, or when it is no longer necessary or relevant to the provision of our services, unless there is another reason to retain it, such as a legal obligation to retain data or the need to preserve it to safeguard the organization’s rights, pursuant to Articles 15 and 16 of the LGPD.

3. INFORMATION SHARING:

All information we store about you may be considered an asset in transactions involving the organization. Accordingly, we reserve the right, for example, to include your data among the company’s assets if it is sold, acquired, or merged with another company. Through this Privacy Notice, you acknowledge this possibility.

The organization must provide your data and information if required by a court order.

We may share your personal data with public or private organizations, in compliance with the provisions of the LGPD, particularly the principle of necessity, and always in a manner consistent with the purpose(s) for which it was collected.

When we share your personal data with data processors, we will require that your data be processed in accordance with our instructions, including secure storage, retention only for the instructed period, and no subsequent sharing with other organizations without our prior express authorization.

Service providers acting as data processors:

To manage our healthcare and administrative activities, we rely on the technology services of the companies listed below, which act as service providers to INSTITUTO IDEIA FERTIL DE SAUDE REPRODUTIVA and, in that capacity, may process (including accessing, storing, consulting, and processing) personal data of patients and other data subjects, including registration data and information contained in medical records, which may include sensitive personal data concerning health, pursuant to Articles 5, item II, and 11 of the LGPD. In these cases, INSTITUTO IDEIA FERTIL DE SAUDE REPRODUTIVA acts as the data controller, and the service providers process the data on its behalf and in accordance with its instructions, for the purposes described here.

a) CliniSYS – JJF Tecnologia e Sistemas de Saúde Ltda. (CNPJ No. 35.479.957/0001-47): provider of the clinical management and electronic medical record system. It acts as a personal data processor, processing data exclusively to fulfill the purposes established by us. According to its own policy, it adopts security measures such as access control and authentication, encryption, a firewall, audit logs, and daily backups, and, as a rule, does not share data with third parties, except with the controller. Any international transfer takes place through cloud computing partners, subject to specific contractual clauses. Privacy Policy: clinisys.com.br/wp-content/uploads/2026/09/3-Politica-de-Privacidade.pdf.

b) Chatvolt: provider of an automated customer service platform (chatbot), which may process registration data and information provided by data subjects during customer service interactions on our behalf. According to its policy, data is encrypted in transit and at rest, is neither sold to third parties nor used for advertising, and may be stored in the United States of America and processed by subprocessors located there, which constitutes an international data transfer carried out pursuant to Article 33 of the LGPD. Privacy Policy (LGPD): docs.chatvolt.ai/privacy/br-lgpd.

We require these companies to process data in accordance with our instructions, adopt appropriate technical and administrative security measures, maintain the confidentiality of information, and refrain from sharing it with other organizations without our prior express authorization. Data subjects may exercise their rights, including with respect to data processed by these providers, exclusively through our LGPD Communication Channel, indicated in Section 4. We recommend reading these companies’ privacy policies, which apply to the processing they carry out, without prejudice to this Notice.

4. DATA SUBJECTS’ RIGHTS:

The LGPD establishes that data subjects have the right to obtain the following from the controller, regarding their personal information processed by the controller, at any time and upon request:

• Confirmation of the existence of processing;
• Access to the data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary data or data processed in violation of the Law;
• Data portability;
• Deletion of personal data processed with their consent;
• Information about the public and private entities with which the controller has shared data;
• Information about the possibility of withholding consent and the consequences of refusal;
• Withdrawal of consent.

If data subjects wish to exercise any of their rights set forth in the Law or ask questions regarding this documentation, they simply need to click the “LGPD Communication Channel” Seal on our website and complete the “Data Subject Request Form.”

Through the Seal, any interested party is directed to the Privacidade&Você Portal and can verify the authenticity of the company’s compliance with the LGPD, including: the latest review of its control mechanisms, displaying the date and time the review was conducted; the company’s privacy policies; the contact channel for data subjects; and the contact channel for the ANPD.

5. INFORMATION SECURITY:

All your data is confidential, and only authorized individuals will have access to it. We make every reasonable effort consistent with industry practices to ensure the security of our systems and your data. Our servers are located in different locations to ensure stability and security and may only be accessed through previously authorized communication channels.

All your information will be encrypted whenever possible, provided that doing so does not prevent its use by the platform. You may request a copy of your data stored in our systems at any time. We will retain data and information only for as long as it is necessary or relevant to the purposes described in this Privacy Notice, for periods predetermined by Law, or for as long as it is necessary to maintain the organization’s legitimate interests.

It is important to clarify that we cannot guarantee that all your data on our platform will be free from unauthorized access, particularly if the credentials required to access our application are improperly shared.

Therefore, we recommend that you keep your access password in a secure location and advise against sharing it with third parties. You agree to notify the organization immediately, through a secure channel, of any unauthorized use of your account, as well as any unauthorized access to it by third parties.

6. UPDATES TO OUR PRIVACY NOTICE:

We reserve the right to update our Privacy Notice as often as necessary to provide you with more reliable information and continually improve your experience.

7. APPLICABLE LAW:

This document is governed by and must be interpreted in accordance with the laws and regulations that make up the Brazilian legal system. The courts of the Judicial District of Santo André, State of São Paulo, are designated as having jurisdiction to resolve any matters arising from this document, with an express waiver of any other jurisdiction.

8. DATA PROTECTION OFFICER CONTACT INFORMATION:

DPOnet, registered with the CNPJ under No. 36.487.128/0001-79, has been appointed as the Data Protection Officer of Teste Da DPO and, as such, is qualified to perform all the functions and responsibilities of the position provided for in the LGPD.

Responsible party: DPOnet

Contact: Privacidade&Você

Check the validity of this document by scanning the QR Code below.

QR Code