Privacy policy

1. Who is responsible for your data (Controller)
Clínica Uro Onco is the controller of the personal data processed through its channels.
Data Protection Officer (DPO): Dr. Bruno Santos Benigno (CRM-SP 126265 · RQE 60022).
Contact: contato@clinicauroonco.com.br
For any questions, requests or exercise of rights related to this Policy, please use the contact above.

2. Where the data we process comes from (channels)
We process data that you provide to us or that is generated when you interact with us through: our website (clinicauroonco.com.br), including forms and the service chat; the clinic's official WhatsApp; direct messages (DMs) on Instagram and Facebook/Messenger; e-mail and telephone; and in-person and telemedicine care.

3. What data we collect
• Identification and contact: name, phone number, e-mail and, where applicable, the identifier of the social media account you use to contact us.
• Service and scheduling data: consultation dates and preferences, history of messages exchanged on our channels, records of confirmations and reminders.
• Browsing data (website): essential and analytics cookies (see item 9).
• Health data (sensitive data): only when you choose to send it (for example, test results or clinical descriptions). This data receives special treatment (item 6).
We do not request sensitive data through public channels. Whenever possible, please discuss your case through a private, secure channel.

4. What we use your data for (purposes)
To schedule, confirm and reschedule consultations and procedures; send reminders, instructions and information about your care; answer questions and provide support; improve the quality and organization of our service; send educational content on men's health and urologic oncology, with your consent (optional and separate from service communications); and comply with legal, regulatory and ethical obligations.

5. Legal basis for processing (LGPD)
Depending on the purpose, we process your data on the following grounds: consent (art. 7, I); preliminary procedures and performance of a contract at your request (art. 7, V); protection of health, by health professionals or health services (art. 11, II, “f”), for health data; compliance with a legal or regulatory obligation (art. 7, II); and legitimate interest (art. 7, IX), where applicable and without overriding your rights and freedoms.

6. Health data — special treatment and medical confidentiality
Tests, reports, results and clinical descriptions that may be sent through our channels are forwarded to the medical record and removed from our customer relationship management (CRM) system, preserving medical confidentiality. Results and diagnoses are not communicated by chat, DM or social media — only during a consultation, in person or via telemedicine, in an appropriate setting. Sensitive health data is not sent to artificial intelligence tools.

7. Sharing and processors
To operate our services, we may use providers that process data on our behalf (processors), always under contract and limited to the minimum necessary: a cloud provider (hosting in Brazil); messaging and social media platforms (Meta — WhatsApp, Instagram and Messenger) to enable conversations on these channels; a payment platform (Asaas), when invoices or payment links are issued; and an artificial intelligence tool for operational support (without access to sensitive health data). We do not sell your personal data.

8. Data obtained through Meta platforms (Instagram, Messenger and WhatsApp) and international transfer
When you contact us via Instagram, Messenger or WhatsApp, we receive the information needed to talk with you (for example, your display name/identifier on the platform and the content of the messages you send us), used exclusively for service, scheduling and support. These platforms are operated by Meta and may process data outside Brazil. In such cases, processing complies with the LGPD safeguards for international data transfers. Use of these platforms is also subject to Meta's own privacy policies.

9. Cookies (website)
We use essential cookies (needed for the website to function) and analytics cookies (to understand usage and improve the experience). You can manage or disable cookies in your browser settings.

10. Storage, security and retention
Your data is hosted in Brazil, with security measures such as encryption, role-based access control and audit logging. Conversations and backups are retained for at least 3 years; after that period, they are anonymized or deleted, unless there is a legal obligation to keep them longer.

11. Your rights as a data subject
Under the LGPD, you may request at any time: confirmation that processing takes place and access to your data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data or data processed in non-compliance; portability; information about whom we share your data with; and withdrawal of consent. To exercise your rights, write to contato@clinicauroonco.com.br. We will respond within the time limits set by law.

12. How to request deletion of your data
To request deletion of your personal data (including data obtained via Instagram, Messenger or WhatsApp), send an e-mail to contato@clinicauroonco.com.br with the subject “Data deletion” (“Exclusão de dados”), stating the channel through which you contacted us. We will confirm the request and carry out the deletion, except where retention is required by law.

13. Audience and minors
Our channels are intended for people aged 18 and over. We do not knowingly collect data from children and adolescents without the consent and representation of their legal guardians.

14. Updates to this Policy
This Policy may be updated to reflect improvements or legal changes. The current version is always published on this page, with its last updated date.

15. Contact
Clínica Uro Onco — Data Protection Officer (DPO): Dr. Bruno Santos Benigno (CRM-SP 126265 · RQE 60022).
E-mail: contato@clinicauroonco.com.br