Privacy Policy

1. Who we are

CIDA AI is a digital health organization and management assistant. This policy explains how we collect, use, store, and protect your personal data. The controller of your personal data is Deivide D. Dutra, an individual responsible for CIDA AI, based in Brazil. For privacy matters, contact our data protection officer, Deivide D. Dutra, at suporte.oficialmcm@gmail.com.

2. Data we collect

• Name, email address, and registration details
• Photos and medical document files you submit
• Information extracted from documents, such as professionals, dates, tests, and medications
• Medication, reminder, family, and preference data you configure
• Language, country, profile, and notification preferences
• Technical and usage data required for security, operation, and service improvement
• Subscription and payment status data provided by payment processors

3. How we use data

• Organize and display your documents and health information
• Process submitted documents using automated and artificial intelligence features
• Create reminders for appointments, tests, prescriptions, and medication
• Provide personal and family features you request
• Manage registration, subscriptions, plan access, and support
• Protect the service, prevent misuse, and improve quality

4. Legal grounds and sensitive data

We process personal and health data under applicable law, including Brazil’s LGPD where relevant. Processing is performed to provide requested services, meet legal obligations, protect rights, and, where required, with your consent.

Health data is sensitive personal data. We process it based on your specific and prominent consent, under Article 11, item I, of Brazil’s General Data Protection Law (Law 13,709/2018), and, for users in the European Union, on your explicit consent, under Article 9(2)(a) of the General Data Protection Regulation. You may withdraw this consent at any time from your Profile, without affecting the lawfulness of processing carried out before the withdrawal.

5. Use of artificial intelligence

When you submit a photo of a document, the image and the text required for analysis are sent to OpenAI, which processes the information in the United States and returns the extracted data to CIDA. OpenAI acts as a processor, handling the data solely to provide this service. Under OpenAI’s API service terms, the data sent is not used to train its models. AI-based reading may contain errors: always check the information against the original document. CIDA does not diagnose, does not interpret test results, and does not replace medical advice.

6. Data sharing

We only share what is necessary with processors acting on behalf of CIDA and following our instructions:

• OpenAI (artificial intelligence analysis of images, United States)
• OneSignal (medication alarm notifications, United States — receives only an account code, the language and the notification text, never your documents)
• Base44 (app hosting and data storage)
• Stripe and Hotmart (payment processing — they do not receive your health documents)
• Email delivery provider (account messages)

We do not sell your personal data. We do not use your health data for advertising.

7. International transfers

Some of our processors handle data outside Brazil and the European Union, mainly in the United States. These transfers take place with the safeguards provided under applicable law, such as standard contractual clauses, in accordance with Article 33 of the LGPD and Article 46 of the GDPR.

8. Security

We use encrypted connections, access controls, and account-level record separation. No system is risk-free, but we continually work to reduce unauthorized exposure.

9. Your rights

Subject to applicable law, you may:

• Confirm and access the data we process
• Correct incomplete, inaccurate, or outdated data
• Request anonymization, portability, or deletion where available
• Withdraw consent and obtain information about sharing
• Challenge automated decisions where provided by law

To exercise your rights, use Profile → Data deletion or contact us. If you believe your rights have not been respected, you may lodge a complaint with Brazil’s National Data Protection Authority (ANPD) or, in the European Union, with the data protection authority of your country.

10. Users in the European Union

If you are in the European Union, you have the rights set out in Articles 15 to 22 of the GDPR: access, rectification, erasure, restriction of processing, portability, and objection, as well as the right to withdraw consent at any time.

11. Users in the United States

If you are in the United States, please also read our Consumer Health Data Privacy Policy:

We do not sell your personal information and do not share it for cross-context behavioral advertising.

12. Retention and deletion

We keep data as long as needed to provide the service and comply with legal obligations. Following a deletion request, data is removed or anonymized within 30 days unless retention is legally required.

13. Cookies and local technologies

We use session cookies and local storage required for authentication, language, security, and operation. We do not use these technologies to sell personal data.

14. Children

Accounts must be created by people aged 18 or older. A minor’s information may only be managed by an authorized legal guardian.

15. Changes and contact

We may update this policy and will communicate material changes through the app or available channels. Contact: