Skip to main content
Salutho

Privacy Policy

Last updated: July 2, 2026 | Brazil's LGPD (Law 13,709/2018)

Salutho is committed to protecting your privacy and operates in compliance with Brazil's General Data Protection Law (LGPD — Law 13,709/2018). This policy explains what data we collect, why we collect it, and how you can exercise your rights. It applies to salutho.com and to campaign pages operated by Salutho on other domains (e.g., landing pages).

1. Data Controller

Salutho — R. João Planincheck, nº 1444, sala 07, Jaraguá do Sul/SC, Brazil, ZIP 89.252-275.

For data-related inquiries, contact our Data Protection Officer (DPO) at [email protected].

Regarding patient data stored in SaluGestor: your clinic is the Data Controller; Salutho acts as Data Processor, handling data solely on your instructions under a Data Processing Agreement (DPA).

2. What data we collect

From website visitors and leads:

  • Browsing data (cookies, IP, device, pages visited) — to measure performance and improve experience.
  • Data voluntarily provided via forms (name, email, phone/WhatsApp, clinic, medical specialty, type of practice) — for commercial follow-up and demo scheduling.

From SaluGestor clients:

  • Clinic and professional registration data (name, medical license, specialty, contact).
  • Financial and payment data (individual/company tax ID, billing data).
  • Platform usage data (access logs, actions performed) — for security and audit purposes.

From patients (processed on behalf of the clinic):

Patient data entered in SaluGestor belongs to the contracting clinic/professional. Health data is treated as sensitive personal data (LGPD Art. 5, II) and processed only as instructed by the controller (the clinic).

3. Legal bases (LGPD Art. 7 and Art. 11)

Data processing is based on:

  • Performance of a contract (Art. 7, V): for contracting clients.
  • Consent (Art. 7, I): for marketing communications and optional cookies.
  • Legal obligation (Art. 7, II): for invoicing and compliance with legal authorities.
  • Healthcare provision (Art. 11, II, f): for sensitive health data processed on behalf of healthcare professionals.
  • Legitimate interest (Art. 7, IX): for platform security and fraud prevention.

4. How we protect your data

  • Data stored exclusively on servers located in Brazil.
  • Encryption in transit (TLS) and at rest for sensitive data.
  • Role-based access control with full audit logging.
  • Backup and disaster recovery procedures.
  • Privacy and Security by Design applied from system conception.

More details on our Security & LGPD page.

5. Data sharing and international transfers

We share data only with:

  • Providers supporting platform operations (hosting, email, payment processing, WhatsApp Business API, Mevo for digital prescriptions), under contract and confidentiality obligations.
  • Public authorities, upon legal request.

We do not sell your data or patient data to third parties.

International transfers: We use audience analytics tools (Google Analytics/GTM) whose browsing data is processed on servers outside Brazil. This processing occurs under appropriate contractual clauses in compliance with LGPD Art. 33.

6. Data retention

Data is retained for the period necessary to fulfill its purpose or as required by law (e.g., invoices for 5 years; medical records per applicable healthcare legislation). After that period, data is deleted or anonymized.

7. Your rights (LGPD Art. 18)

You may at any time request:

  • Confirmation that your data is being processed
  • Access to your data
  • Correction of incomplete, inaccurate, or outdated data
  • Anonymization, blocking, or deletion of unnecessary data
  • Data portability
  • Deletion of data processed based on consent
  • Information about public and private entities with whom we share your data
  • Information about the possibility of withholding consent and the consequences of doing so
  • Withdrawal of consent

To exercise any of these rights, contact our DPO at [email protected] or use our contact page. We will respond within 15 days. You may also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

8. Cookies

We use first-party and third-party cookies for site functionality, usage analytics, and personalization. Details in our Cookie Policy.

9. Changes to this policy

We may update this policy periodically. The date of the last update appears at the top of this document. Material changes will be communicated 30 days in advance.