Privacy Policy (English)

Last updated: November 7, 2026. This is the English version of our Privacy Policy; the Portuguese text is equivalent.

This policy explains which personal data CortexClin processes, why, with whom it is shared and what your rights are, under Brazil's General Data Protection Law (Law 13,709/2018, "LGPD"). It applies to the website https://cortexclin.com.br, to the application https://sistema.cortexclin.com.br and to the CortexClin mobile and TV apps.

1. Who we are

CortexClin is a practice-management system (ERP) for dental, aesthetic and medical clinics in Brazil, operated by Cortexclin Tecnologia Desenvolvimento de Software Customizavel LTDA, a Brazilian company registered under CNPJ 69.853.977/0001-58, headquartered at Rua Pais Leme, 215, Conj. 1713, Pinheiros, São Paulo/SP, CEP 05424-150, Brazil. Clinics use it for scheduling, patient records, billing, invoices and communication with their patients.

• As controller, we process data of website visitors, of clinics that subscribe, and of clinic staff who use the system (user accounts).
• As processor, we process data of the clinics' patients and contacts on behalf of each clinic, following its instructions. The clinic is the controller of that data.

2. Data we collect

• Website visitors: browsing data (IP address, browser, device, pages visited) and what you type in contact or sign-up forms (name, e-mail, phone, clinic name and tax ID).
• Clinic users: name, e-mail, phone, role, professional license number when applicable, password (stored only as a hash), two-factor authentication data, and access and audit logs (IP address, device, date and time, actions performed).
• Patients and contacts of the clinics: registration data (name, national ID, date of birth, gender, address, phones, e-mail, guardian), financial data of the relationship with the clinic (quotes, sales, installments, payments, invoices), messages exchanged with the clinic by WhatsApp, Instagram and e-mail, signed documents, clinical photos and, when the clinic uses the clinical modules, health data (medical history, records, prescriptions, exams).
• Payments: processed by payment institutions. We do not store full credit card numbers.
• Mobile app: the CortexClin app is for clinic staff and only works with an account created by the clinic. On the device it uses: the camera and photo picker, only when the user taps to add a clinical photo or photograph a bill (from the gallery the app receives only the chosen image); the device's biometrics or passcode to unlock the app, verified by the device itself (the app never receives fingerprints or face images); a device identifier for notifications such as "patient arrived", which may show the patient's name and appointment time; and, on the device, the login session in OS-protected storage, a temporary copy of the schedule and of the patient records viewed, for offline use (up to 24 hours), and notes and photos recorded offline, only until they are uploaded. Everything is erased on sign-out. The app does not use location, the microphone or the device's contacts, shows no ads and does not track users across other apps or websites.

3. How we use the data

• to provide the service the clinic subscribed to (scheduling, records, billing, patient communication);
• to send appointment reminders, confirmations, payment notices and other operational messages on behalf of the clinic;
• to send review invitations and promotions, only with the patient's consent, which can be withdrawn at any time;
• to issue invoices and keep the records required by law;
• for account security, fraud prevention and auditing;
• for technical support and product improvement;
• to keep patient contacts in the Google account that the clinic chooses to connect (section 5).

4. Sharing

We do not sell personal data. We share it only with service providers that help us operate the service, to the extent needed: cloud hosting and storage; payment institutions chosen by the clinic; Meta Platforms, for the clinic's WhatsApp and Instagram messages; Expo (650 Industries), to deliver mobile app notifications through Apple's and Google's push services; electronic signature and timestamp providers; artificial intelligence providers configured by the clinic, for the features it turns on (contract drafting, conversation summaries, exam analysis); municipal invoice systems and authorities when required by law; and Google LLC, only as described in section 5.

5. Data obtained from Google services (Google Contacts)

A clinic may optionally connect a Google account to CortexClin so that the patients and contacts registered in the system appear with their correct names on the clinic's phone — and therefore in the WhatsApp app on that phone, which reads the phone's address book. The connection is made by a clinic administrator through Google's consent screen and can be undone at any time.

5.1 What we request

• https://www.googleapis.com/auth/contacts — to see, create, edit and delete contacts in the connected Google account;
• https://www.googleapis.com/auth/userinfo.email — to identify which account was connected and show it in the settings.

5.2 What we do with this access

• create, in the connected account, one contact with the name and phone number(s) of each patient or lead registered by the clinic, with the label "CortexClin";
• before creating, read the phone numbers of the account's existing contacts — in memory, for a few minutes, never stored — to reuse a contact the clinic had already saved with that number instead of creating a duplicate;
• update the name and phone numbers of that contact when the record changes in the system; other contact fields are never modified;
• delete the contact when the record is deleted in the system or when the patient exercises the right to erasure;
• stop updating a lead marked as lost, or all leads when the clinic turns that option off: the contact the system created is deleted, and one the clinic had saved by hand is kept;
• store only the contact's identifier at Google, the name and phone numbers we wrote to it, the e-mail of the connected account and the access credential, which is encrypted.

5.3 What we do not do

• we do not read, copy or store the account's contact list for any other purpose;
• we do not use data obtained from Google for advertising, profiling, training artificial intelligence models, or generating or editing images of any kind;
• we do not transfer this data to third parties, except as necessary to provide the service, with your consent, for security purposes or to comply with the law;
• no one on our team reads this data, unless the clinic expressly authorizes it to solve a support issue, or when required for security reasons or by law.

5.4 Revocation and retention

The clinic can disconnect the account in Settings → Google Contacts, or remove CortexClin's access at myaccount.google.com/permissions. On disconnection the access credential is deleted immediately and access is also revoked at Google (unless the same Google account is still connected in another unit of the clinic, where revoking would break that connection). Contacts already created remain in the clinic's Google account, which can remove them using the "CortexClin" label.

5.5 Limited Use

CortexClin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. International transfers

Some providers (for example Google, Meta and artificial intelligence providers) may process data outside Brazil, with the safeguards required by article 33 of the LGPD.

7. Retention

Clinic and patient data are kept while the clinic's contract is active. After it ends, the clinic has a period to export its data, after which it is deleted or anonymized, except what must be kept by law (tax records; access logs for 6 months). Visitor and sales-contact data are kept for as long as needed to answer the request.

8. Security

Encrypted connections (TLS), encryption at rest of sensitive fields and integration credentials, role-based access control within each clinic, two-factor authentication, automatic lock on inactivity, an append-only audit log, backups and logical separation of each customer's data.

9. Cookies

The website uses only what is strictly necessary. The application stores session data in the browser to keep you signed in, removed when you sign out. We do not use third-party advertising cookies.

10. Your rights

Under the LGPD you may confirm processing, access, correct, anonymize, block or delete data, request portability, learn with whom it is shared, withdraw consent and object to processing. Patients should contact their clinic, which is the controller and has the tools to answer them; we will forward requests sent to us. Users and sales contacts can write to privacidade@cortexclin.com.br; we answer within 15 days. Step-by-step data deletion instructions (including data received from Facebook, Instagram and WhatsApp, and mobile app accounts) are at Data deletion.

11. Children

The website and subscription are intended for adults. Data of underage patients is registered by the clinic with the consent of a parent or legal guardian.

12. Contact

Data protection officer: Jean Augusto — privacidade@cortexclin.com.br. Product support: suporte@cortexclin.com.br.