Privacy Policy

1. Who we are

Biosenz is an AI-assisted integrative medicine platform for healthcare professionals: physicians, nutritionist physicians and integrative practitioners.

This policy explains what data we collect, how we use it and how we protect it, in compliance with Brazil's LGPD (Law No. 13.709/2018).

2. Data we collect

• Name, email, phone, password (hashed) and professional profile information.
• Clinical data entered by the professional: exams (PDF or image), records, history and AI-generated analyses.
• Access logs, features used and credits consumed.
• Payment data processed by Asaas; we do not store card data on our servers.
• Session cookies (httpOnly) and interface preferences.

3. How we use your data

• Authenticate and manage your account.
• Process exams via OCR and send the extracted text to AI models to generate analyses, diagnoses and protocols.
• Store records and clinical history for registered patients.
• Send notifications about the service.
• Improve the product based on aggregated, anonymized metrics.

Patient clinical data is used exclusively for the contracted features. We do not use it to train AI models.

4. Sharing with third parties

We share data with the partners required to operate the service:

• Anthropic (Claude): receives exam and record text to generate analyses and diagnoses. Does not retain data after processing.
• OpenAI (GPT): used for protocol generation. Does not retain identifiable personal data.
• Google: OAuth authentication and complementary AI where applicable.
• ElevenLabs: voice synthesis (Biovoice). Only the submitted text is processed.

We do not sell or share your data for advertising purposes.

5. Storage and security

Data is stored encrypted at rest and in transit (TLS). Passwords are hashed. Authentication tokens travel in httpOnly cookies, inaccessible to browser scripts. Exam files are kept in restricted-access storage.

We use role-based access control and audit logs to protect sensitive health data.

6. Data retention

We keep your data while the account is active. When you request deletion, all personal and clinical data is removed within 30 days, unless a longer retention period is legally required.

7. Your rights (LGPD)

At any time, you may:

• Request a copy of your data.
• Correct incorrect or outdated data.
• Request deletion of your personal data.
• Receive your data in a structured format (portability).
• Withdraw your consent or object to processing in certain situations.

To do so, contact us at the email below.

8. Cookies

We use httpOnly cookies for authentication (session token and refresh token), which are required for the platform to work. We also save interface preferences (light/dark theme), which contain no personal data.

We do not use tracking cookies for advertising purposes.

9. Changes to this policy

We may update this policy at any time. Material changes will be communicated by email or by a notice in the platform. Continuing to use Biosenz after the notice means you accept the changes.

10. Contact

Questions or requests regarding personal data: