Version 3, effective since 16 October 2026
This document is a translation. In case of divergence between the languages, the Portuguese version prevails.
This policy explains how Azenit processes personal data on the DeepDataMD platform: the website, the system used by healthcare professionals, the links and messages sent to patients, and the mobile app. It says which data are processed, for what purpose, with whom they are shared, for how long they are kept and how you exercise your rights.
It applies to you if you are a patient or research participant followed by a centre, clinic or professional that uses the platform, if you are a healthcare professional with an account on the platform, or if you simply visit the website.
We comply with the Brazilian General Data Protection Law (LGPD, Law 13.709/2018), which applies to all users, wherever they are, because we process the data in Brazil. For those in the European Union, the General Data Protection Regulation (GDPR) also applies and, for those in Portugal, Portuguese Law 58/2019 as well. These rules add up: one does not exclude the other. Section 13 explains how the GDPR applies.
We may change this policy when the platform, the law or our suppliers change. When the change is relevant, we notify the professionals with an account on the platform through the channels they registered and publish the new version on this page, with the version number and the date on which it takes effect.
AZENIT DESENVOLVIMENTO E LICENCIAMENTO DE PROGRAMAS LTDA, a limited liability company registered under CNPJ (Brazilian company registration number) 39.908.059/0001-18, with its registered office at Avenida Paraná, number 1150, Bairro Francisco Doncatto, CEP 95190-000, in the city of São Marcos/RS, Brazil. We develop and operate the DeepDataMD platform.
To contact us, write to contato@deepdatamd.com or to the postal address above. Matters concerning your personal data and this policy are handled by the data protection officer, through the channel in section 2.1.
Azenit's data protection officer is Leonardo Pellizzoni. The data protection officer can be contacted at privacidade@deepdatamd.com. For those in the European Union, this officer performs the role of data protection officer provided for in the GDPR.
Azenit does not use patient data for its own purposes. The platform is the tool that the centre, clinic or healthcare professional uses to follow you. For this reason, our role changes depending on the data:
| Data | Azenit's role | Who decides and responds to you |
|---|---|---|
| Data of patients and research participants: registration, studies, medical records, questionnaires and answers, appointments, teleconsultation, messages, files and health data sent by the app | Processor ("operadora" under the LGPD, "subcontratante" under the GDPR) | The centre, clinic or healthcare professional, which is the controller ("controlador" under the LGPD, "responsável pelo tratamento" under the GDPR) |
| Healthcare professionals' accounts: registration, login, two-step verification and access logs | Controller | Azenit |
| Website: necessary cookies and commercial contact | Controller | Azenit |
When we process data on behalf of the centre, we do so under the data processing agreement signed with it and following its instructions. The legal basis and the purpose of the processing are those the centre informs to you, for example the protection of health, in care or clinical follow-up, or the conduct of research, with the study's own consent form.
If you are a patient or research participant, the centre registers you on the platform and uses the functions below. In all of them, Azenit processes your data on behalf of the centre.
The healthcare professional registers your identification and contact data, such as name, date of birth, sex, CPF (Brazilian individual taxpayer number), RG (Brazilian identity card number), telephone, email and health insurance, and records information about your health condition, such as notes and progress from appointments. You do not create an account or a password on the platform.
The professional registers questionnaires and schedules their delivery to you. You receive the link by email, WhatsApp or SMS and answer online or through the app. The answers are linked to your record and to the study or follow-up they belong to, and generate charts and indicators that the professional uses to follow your progress.
You can exchange messages with the centre through WhatsApp, including to answer questionnaires in a conversation, with the questions sent automatically by the platform, and you can send files, such as test results and photos. The messages and files are kept in your record, available to the professional.
The professional schedules appointments and the platform sends you reminders and links. When the appointment is a teleconsultation, you join through the link received and the video call takes place in a service hosted on Microsoft Azure. We record the date and time, the IP address and the approximate location of whoever joins the teleconsultation, as proof of access.
If the centre enables the app for you, it links your device to your record. The app shows your pending questionnaires and your appointments and, if you authorise it on the device, sends your steps, exercise, heart rate and sleep data to the platform. It also sends a device identifier and a token used for notifications. The app does not create an account: it is the centre that registers you.
When recording an access or a relevant action, such as answering a questionnaire, joining a teleconsultation, logging in to the app or exporting data, we keep the IP address, the source port and the browser or device used. At that moment, we look up the IP address in the ip-api.com service to obtain the approximate location and the internet provider, and we keep the result together with the log. These logs serve security and the proof of who accessed what.
If you take part in research, your consent to participate is governed by the study's consent form, a separate document, presented by the centre and approved according to the research rules. This policy does not replace that form and is not your consent to the research. When the centre uses the platform to record your acknowledgement or your consent, that record is kept on behalf of the centre, together with the other answers of the study.
If you are a healthcare professional, we process your name, email, telephone, password, access profile, the centre or clinic you belong to and the login records: date and time, IP address, approximate location obtained through ip-api.com, browser and device. In two-step verification, we send codes by email, WhatsApp or SMS and we may store a code in your browser to recognise the device on your next accesses. We use these data to maintain your account, ensure the security of the platform and fulfil the agreement with the centre or clinic.
If you request a demonstration or contact us through the website, we process the data you provide, such as name, email, telephone and institution, to respond to your contact. The website uses only the cookies described in section 14.
We do not sell personal data and we do not share them for advertising. To operate the platform, we use suppliers that process data on our behalf, as sub-processors. They are:
| Supplier | What we use it for | Destination country |
|---|---|---|
| Microsoft Azure | Database, file storage, background processing, secret storage, teleconsultation and artificial intelligence (Azure AI Foundry) | Brazil, United States or European Union, depending on the region of each service |
| Brevo | Sending emails, such as questionnaire links, reminders, verification codes and notices | European Union |
| Bird (MessageBird) | Sending and receiving messages through WhatsApp and SMS | European Union |
| Meta | Provider of WhatsApp, through which the messages travel | United States |
| ip-api.com | Approximate location and internet provider from the IP address, in the access logs | Abroad (United States or European Union) |
| Anthropic, OpenAI and Microsoft, through Azure AI Foundry | Language model used in the chat of the professional's dashboard, described in section 12 | United States or European Union, depending on the region of the service |
Each supplier receives only the data necessary for the service it provides and is bound by contract to process them only for that purpose and with security measures. The list is kept in our record of processing operations and this policy is updated when a supplier is added or removed.
Besides the suppliers, we may share personal data when required by law or by order of a competent judicial, administrative or regulatory authority, and, in the event of a corporate reorganisation, with whoever takes over the operation of the platform, under the same duty of confidentiality. For patient data, the centre is informed of these cases according to the agreement.
Some suppliers in section 7 are located or operate outside Brazil, in the United States and in the European Union. When your data are transferred to those countries, the transfer relies on the supplier's contractual clauses, which oblige it to protect the data at the level required by the LGPD and the GDPR, and, between Brazil and the European Union, on the mutual recognition of adequacy between the two jurisdictions.
For data of patients in the European Union, the processing in Brazil by Azenit takes place on behalf of the centre, based on the processor agreement signed with it, which provides for the safeguards required by the GDPR.
We keep the data for as long as necessary for the purpose for which they were collected and for the period required by law. The periods vary by category:
| Category | Period |
|---|---|
| Clinical research data, including questionnaire answers and app data collected in a study | For the period defined in the study protocol and, at a minimum, for five years after the end of the research, according to Brazilian Law 14.874/2024 (the clinical research law) and Resolution CNS 466/2012 (of the Brazilian National Health Council) |
| Medical records and clinical follow-up outside research | According to the period defined by the controller and by the applicable professional regulations |
| Messages, files and teleconsultation records | For the same period as the follow-up or the study they belong to |
| Healthcare professionals' accounts | While the account exists and, afterwards, for the period necessary to comply with legal obligations and to defend rights |
| Access logs and message delivery logs | For the period necessary for security, auditing and proof of delivery, respecting the minimum required by law |
| Commercial contact through the website | Until the contact is handled and for the period necessary for the commercial relationship that results from it |
For patient data, it is the centre that defines the period and decides on deletion, within the limits of the law. In research, the withdrawal of consent takes effect from the moment you express it and usually means the end of collection, with what has already been collected kept for the mandatory period, in anonymised form when the protocol allows. Once the period ends, the data are deleted or anonymised.
Under the LGPD, you have the right to: confirmation that we process your data; access to the data; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of data that are unnecessary, excessive or processed in breach of the law; portability to another supplier; information about with whom we share your data; information about the possibility of not giving consent and about the consequences of that; and withdrawal of consent, when the processing is based on it.
Under the GDPR, you also have the right to restriction of processing, to object to processing and not to be subject to a decision based solely on automated processing.
Make your request through the data subject rights form, stating which right you want to exercise and, if you know it, which centre or professional follows you. The request may be made by the data subject or by their legal representative. The request is free of charge. Upon receiving it, we give you a reference number and send you, by email, the acknowledgement of receipt, with the date and the response deadline.
We respond within 15 days from receipt. If the request is complex, we inform you within that period of the reason and the new date. Refusals are always justified.
To protect your data, we may ask for information that confirms your identity, in proportion to what was requested, such as confirmation through a code sent to the email address or telephone number already registered.
If you believe that the processing of your data violates the law, you may lodge a complaint with the Brazilian National Data Protection Authority (ANPD), in Brazil, wherever you are. If you are in the European Union, you may also lodge a complaint with the data protection authority of your country, which in Portugal is the Portuguese National Data Protection Commission (CNPD). This right does not depend on you having made a request to us first.
We adopt technical and administrative measures to protect personal data against unauthorised access, destruction, loss, alteration or improper disclosure. Among them: encryption of the communications between your browser or app and the platform; encryption, in the database, of sensitive data and of the data that identify you; role-based access control, in which each professional only sees the patients and the functions that their centre has enabled; two-step verification for professionals; and logs of access and relevant actions.
No system is completely secure. If a security incident occurs that may cause risk or harm to you, we notify the ANPD and you, within the deadlines set by law, and, for data processed on behalf of the centre, we notify the centre without delay so that it can take the measures that fall to it.
The platform does not make automated decisions about you. Scores and charts calculated from your answers are support tools, interpreted by the healthcare professional, who is the one who decides about your follow-up.
The professional's dashboard has a chat that uses language models from Anthropic, OpenAI and Microsoft, through Azure AI Foundry. The professional asks questions about the study data and the model answers based on those data. The model is a tool of the professional and does not decide anything about you.
The platform is also used by centres and professionals in Portugal. Azenit operates entirely from Brazil and has no establishment in the European Union. For those in the European Union, the GDPR adds to the LGPD, which still applies.
For data of patients followed in the European Union, the centre is the controller and Azenit is the processor, under Article 28 of the GDPR. The processor agreement with the centre defines the instructions, the security measures, the authorised sub-processors and the assistance we provide to the centre to respond to your requests. For the data of professionals' accounts, Azenit is the controller.
The rights provided for in the GDPR, including restriction and objection, are exercised through the channel in section 10, within the same 15-day period. In Portugal, in clinical research, Portuguese Law 58/2019 allows some rights to be limited to the extent necessary for the research, and erasure may be refused when it would make the objectives of the research impossible. You may lodge a complaint at any time with the data protection authority of your country, which in Portugal is the CNPD, in addition to the ANPD.
The data protection officer in section 2.1 also performs the role of data protection officer under the GDPR. Security incidents affecting data of patients in the European Union are notified to the centre without undue delay, so that it can meet the 72-hour deadline of the GDPR.
Cookies are small files that the website stores in your browser. The platform uses only cookies strictly necessary for its operation and security. We do not use audience analytics, advertising or social media cookies, and no third party stores cookies through our website.
| Cookie | What it is for | Duration |
|---|---|---|
| Authentication cookie | Keeps the professional signed in after login | Session, until the end of the access or sign-out from the platform |
| Anti-forgery cookie | Protects forms against forged submissions from other websites | Session |
| DBICUSU | Recognises the professional's device after two-step verification, so as not to ask for the code on every access | 120 days |
| DDMDACS | Records that the browser has already logged in, to open the login screen instead of the website presentation | 365 days |
As these cookies are necessary, there is no option to refuse them within the platform. You can delete or block them in your browser settings, but without them it is not possible to log in.
The website, the app and the messages may contain links to third-party websites. We are not responsible for the content or the privacy practices of those websites, and a link does not mean that we recommend them. When you access another website, you are subject to its terms and privacy policy. We recommend reading those documents before providing any personal data.
If you have questions about this policy, about your data or about how to exercise your rights, write to the data protection officer at privacidade@deepdatamd.com, or to the postal address in section 2. Requests about your rights follow the channel described in section 10.
