Privacy Policy
Your contact information, care records and recording choices have different purposes. Here you can understand what is collected, who may receive it and how to exercise your rights.
- Company responsible for the platform
- ERNANI VINICIUS THUM CONSULTORIA EM TECNOLOGIA DA INFORMACAO LTDA — CNPJ 43.559.670/0001-55
- Privacy contact
- contato@terapeuta-ideal.com.br
1. Who this policy covers
This policy explains how data is handled on the Terapeuta Ideal website, portals and app features. It covers visitors, people requesting information, professionals, patients, legal representatives and emergency contacts.
The company identified above makes decisions about account, relationship, support, security and platform operation data. For care records, the professional or clinic determines clinical purposes and confidentiality and retention duties; the platform provides technology and processes data needed for those services. Responsibilities depend on the purpose of each processing activity.
Contact our privacy channel about platform data and the responsible professional about your care. This policy does not replace specific recording authorization or the professional’s explanations.
2. Data we process
Avoid diagnoses, clinical narratives or other people’s personal data in interest and demo forms. Provide care information in the appropriate spaces, following your professional’s guidance.
| Context | Data and purpose |
|---|---|
| Interest, contact and demo requests | The “Try it now” form requires name and phone; email and subsequent questions are optional. Questions cover interest, expectations, budget range, session format, city and state for in-person care, professional goals and a message. The demo has a separate registration requiring name, email and phone. Other forms collect the contact details and messages you provide. We use these to respond and follow up on your request. |
| Professional and patient accounts | Identity, contact and login details and, depending on the registration, Brazilian taxpayer ID (CPF), date of birth, address, time zone, professional registration and emergency contact. These support access, identification, scheduling and communication. A professional may enter some patient details. |
| Public agenda requests | First and last name, email, WhatsApp, time zone, selected time and session type, sharing authorization and request status. These form a private intake record shared with the selected professional to evaluate the request and contact you. Approval is required; the request does not automatically create a patient account or confirmed appointment. Contact details are excluded from public-page navigation counters. |
| Care and health information | Appointments, session messages, forms, answers, notes, progress records, documents and information entered by the professional or patient, including other people mentioned during care. Authorized recording also produces audio, transcripts and derived materials. These may reveal sensitive personal health data. |
| Subscriptions and payments | Customer information, selected plan, amounts, payment status and subscription, invoice and transaction references, for billing and service management. Payment service providers process payments. |
| Communications and support | Requests, email and instant message content, delivery identifiers, dates and delivery or read status, for support, invitations, account recovery and troubleshooting. |
| Usage and technical information | Cookies, local preferences, browser and device information, access and connection failures, call quality and public-page navigation events, for operation, security, diagnostics and website evaluation. |
3. Purposes and legal grounds
The legal ground depends on the data and purpose. Registration, access, scheduling and subscriptions may involve a contract or requested steps before a contract. Necessary records may support legal obligations or the exercise of rights. Security and relationship activities may rely on legitimate interests after assessing necessity and individual rights.
Sensitive health data requires a specific ground under Brazil’s LGPD, such as specific consent, a legal obligation, the exercise of rights, or health protection by a health professional or service. The party responsible for care determines its applicable ground; legitimate interests are not a ground for sensitive data.
Optional recording and its use for transcription and clinical documentation support require specific authorization. Refusing or withdrawing this authorization does not mean cancelling care. Submitting an interest form allows a response to that request; it is not general authorization for recording, clinical processing or unrelated campaigns.
4. Calls, audio recording and artificial intelligence
The Federal Council of Psychology (CFP) advises that psychologists may record sessions when necessary for professional use, with the patient’s knowledge and agreement about the recording and its purpose, while preserving confidentiality.
Camera and microphone access is used by features that need those permissions. Live transmission and recording are separate: the platform’s recording feature captures audio when enabled and authorized.
In online sessions, the patient can allow or refuse recording, change the choice and decide whether to remember it for future sessions. For the in-person feature, when enabled, the professional must obtain authorization and record their confirmation before recording.
Authorized audio may be sent to transcription and artificial intelligence providers to produce transcripts, summaries, suggested progress notes and reports about people and relationships mentioned during sessions. Outputs may contain errors and require professional evaluation; they do not replace clinical assessment.
Withdrawal prevents new recording once applied. It does not automatically erase previously authorized audio, transcripts or documents. Already submitted audio may finish processing. Requests to erase these materials are assessed separately, considering retention duties and the rights involved.
5. Who may receive data
Sharing depends on the feature and purpose. We do not sell personal data. Operations may involve the following recipient categories:
You can ask our privacy channel to identify the entities with which your personal data has been shared, as well as the purposes and information involved.
| Recipient | Purpose and information involved |
|---|---|
| Responsible professional or clinic | Patient data, appointments and care materials needed for follow-up. Administrative and support access may occur according to permissions and operational need. |
| Infrastructure and storage | Hosting, databases, storage and call connectivity services to operate the platform and store records. |
| Transcription and artificial intelligence | Care-related audio or text, depending on the feature, for transcription and the supporting materials described above. |
| Payment processing | Customer and payment information needed for billing and subscription management. |
| Email and message delivery | Contacts, message content and details needed for communications, invitations, account recovery and support. |
| Internal communication and support services | Notifications sent to the team through these services may include contacts and interest answers, support requests, and names and identifiers associated with session starts or ends. |
| Public-page analytics | Public-page navigation and events to evaluate the website and campaign conversions. Details and limits appear in the cookies section. |
| Authorities and other authorized parties | When necessary for a legal obligation, valid order, protection of rights or another applicable legal ground. |
6. Processing outside Brazil
Infrastructure, communication, payment and AI providers may process data in other countries, including the United States. Not all data necessarily remains in Brazil.
International transfers must comply with the grounds and safeguards of the LGPD and ANPD regulations. You can ask our privacy channel about recipients, countries and the mechanism applicable to your data.
8. Retention
Retention depends on the purpose, the service relationship and legal or professional duties. Interest contacts may be retained to answer and follow up on requests; account and billing data for contract management and applicable obligations; care records and audio materials according to their authorized purpose and the responsible professional’s duties.
Interest questionnaire access and visitor demo access expire after 24 hours. The tutorial for authenticated professionals follows their login session expiry. Expiration does not erase the registered contact. Archiving a patient, session or note also does not necessarily erase its data.
You can ask about retention and request erasure or restriction. Assessment considers whether the purpose has ended, the legal ground and any preservation duties. If erasure is not possible, we will explain why; backups and necessary records may have different retention cycles from active data.
9. Security and confidentiality
The platform uses authentication, authorization checks, password hashing and file access controls. Access depends on role and function. These measures reduce risks but do not guarantee absolute security.
Protect your credentials and access links, use trusted devices and avoid sharing clinical documents outside appropriate channels. Report suspected unauthorized access to our privacy channel.
Incidents posing relevant risk or harm must be notified to affected individuals and the ANPD in the circumstances and timeframes required by applicable regulations.
10. Children, adolescents and other people’s data
Care involving children or adolescents must respect their best interests and applicable legal requirements. The professional must assess the legal representative’s involvement and necessary care and recording authorizations, without removing the platform’s responsibilities.
When entering a representative or emergency contact, provide only necessary data and inform that person about its use. Requests concerning minors may require verification of legal representation.
11. Your rights
- Confirm whether your data is processed, request access and information about its use, and obtain information about the public and private entities with which your data has been shared.
- Correct incomplete, inaccurate or outdated data.
- Request anonymization, blocking or erasure of unnecessary, excessive or unlawfully processed data.
- Request portability under applicable regulations and erasure of data processed with consent, subject to legal preservation exceptions.
- Withdraw consent, understand whether you can refuse it and the consequences, and object to processing where legally applicable.
- Request review and information about decisions based solely on automated processing that affect your interests.
- Submit a petition to the ANPD if a request to the responsible party remains unresolved.
12. Making a request
Write to the privacy email below, describing your request and relationship to the platform. Avoid attaching care records or sensitive documents unnecessarily. We may request proportionate information to verify identity or representation and prevent disclosure to another person.
Care-related requests may require the responsible professional or clinic’s involvement. We respond within applicable legal timeframes; the complete access statement under the LGPD is due within 15 days. Withdrawing consent does not invalidate previously authorized processing.
13. Changes to this policy
This version replaces the previous policy. Updates will appear here with a revision date. Material changes to purposes or data use must be communicated through appropriate channels, with renewed authorization when required.