Home / Privacy policy
Privacy policy
What we collect on this website, why we collect it, how long we keep it and what you can demand from us. Written to be read, not to be survived.
What this covers
This policy is about this website: the member sign-up, the referral programme and the security logs. Your medical records are a separate matter — they live at the clinic, under medical confidentiality and the retention rules of the Conselho Federal de Medicina, and are never published or processed here.
Who is responsible
The controller is CLINICA ALMAAZ SERVICOS MEDICOS LTDA, CNPJ 21.590.169/0001-19, Av. Ataulfo de Paiva, 391 — Sl 407 & 408, Leblon, Rio de Janeiro — RJ, 22440-032. For anything in this policy, message us on WhatsApp at +55 21 99634-7557 and a person at the clinic will handle it.
What we collect, and why
| Data | Collected when | What it is for | Legal basis (LGPD) |
|---|---|---|---|
| Name, e-mail, WhatsApp number | You create a member account | Identify you, let you sign in, and let the clinic contact you. | Art. 7, V — performance of a contract you asked for |
| Declared interest (weight loss, hormones, IV…) | You create a member account | So the conversation starts from what you actually want. | Art. 11, I — your specific consent (see the note below) |
| Password | You create a member account | Sign-in. Stored as a PBKDF2 hash with a per-user salt — we cannot read it, and neither can anyone who steals the database. | Art. 7, V — performance of a contract |
| IP address, browser, date and time | Sign-up, sign-in and failed sign-in | Security, audit trail and rate limiting against abuse. Also a legal requirement for application logs. | Art. 7, II — legal obligation (Marco Civil, art. 15) and Art. 7, IX — legitimate interest |
| Referral code, IP and browser | You arrive through a referral link | Honour the 5% and stop the same visit being counted twice. | Art. 7, IX — legitimate interest |
| Internal notes | The clinic writes them in the admin panel | Service history. Administrative only — clinical notes do not go here. | Art. 7, IX — legitimate interest |
About health data
The interest you declare on the form (weight loss, hormonal replacement, IV therapy) says something about your health, and the LGPD treats health data as sensitive (art. 5, II). So: the field is optional, it is only there because you typed it, it is used only to start the conversation, and it is never sold, traded or used to target advertising. You may ask us to erase it at any time and keep the account.
Every button on this site opens a conversation on WhatsApp — that is how the clinic books. From the moment the conversation starts it happens inside WhatsApp, which is run by Meta and governed by Meta's own privacy terms, not by ours. What we do is pre-fill the message; what you send after that is between you, the clinic and WhatsApp. The clinic keeps those conversations for the same reason it keeps any patient contact: to serve you.
Who else sees it
We do not sell, rent or trade personal data, and there is no advertising or analytics tracker on this site. The data lives in Cloudflare infrastructure (hosting and database), which processes it on our instructions as an operator and may store it on servers outside Brazil — an international transfer allowed by art. 33 of the LGPD, done under contractual safeguards. Beyond that, we only share data when the law or a court requires it.
How long we keep it
Account data: while the account exists, and after deletion only what the law makes us keep. Access logs: six months, which is what the Marco Civil da Internet requires. Referral records: while the programme is running. Ask us to delete the account and it goes — we will tell you exactly what had to stay behind and why.
How it is protected
Traffic is encrypted end to end (HTTPS). Passwords are PBKDF2-SHA256 hashes with a salt for each user, compared in constant time. Sessions are signed cookies, HttpOnly, so JavaScript cannot read them. The admin panel has its own separate session, is not indexed and is rate limited. No system is perfect, and we will not pretend otherwise — but if a breach ever puts you at risk, you and the ANPD will be told, as art. 48 requires.
What you can demand
Article 18 of the LGPD gives you the right to ask us, free of charge, to:
- confirm that we process your data at all, and see it
- correct anything incomplete, wrong or out of date
- anonymise, block or delete data that is unnecessary, excessive or handled unlawfully
- receive your data in a portable format, or have it moved to another provider
- delete data we hold on the basis of your consent
- know who we have shared it with
- withdraw consent — and know what happens if you do
Ask on WhatsApp at +55 21 99634-7557. We answer within 15 days. If you are not satisfied with the answer, you may complain to the ANPD (gov.br/anpd).
Children and teenagers
This site is not aimed at anyone under 18 and we do not knowingly create accounts for minors. If you are a parent or guardian and believe an account was created by a child, tell us and we will delete it.
Changes to this policy
If what we collect changes, this page changes first, and the date below changes with it. If the change is significant, we will say so on the site instead of quietly editing.
For what the site stores in your browser, see the Cookie policy. Last updated: 2026-08-26