Privacy Policy

Under Brazil’s General Data Protection Law (LGPD)

Clever Health, through its services and proprietary technology products, is committed to protecting the personal data of its customers and users, in line with the principles of transparency, lawfulness, security, and accountability in the processing of personal information.

Recognizing that privacy is a fundamental right, Clever Health adopts this Privacy Policy as part of its corporate governance, in accordance with the General Data Protection Law (Law No. 13,709/2018) and the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014).

Covered site:

• cleverhealth.com.br

Purposes of this Policy

• Set clear guidelines for processing personal data, observing the applicable legal bases;
• Describe the technical and administrative security measures used to protect collected data;
• Guarantee data-subject rights, including access, correction, deletion, portability, and withdrawal of consent;
• Prevent incidents and spread privacy practices among employees, partners, and suppliers;
• Promote a culture of data protection as essential to trust and excellence in the services we offer.

This Policy applies to all personal-data processing carried out by Clever Health in providing its services and platforms, covering interactions in Brazil or directed at individuals located in Brazil.

1. What data we collect

We collect personal data in different situations, depending on how the user interacts with our services.

Data you provide directly

When you give us your data directly — for example by filling in contact forms or contracting our services — we collect identification information (name, email, phone), professional data (company, role, field), contact data (business address), and messages you send. We may also process contractual data related to the solutions you purchase.

Data collected automatically

When you access our sites and platforms, data is collected automatically, such as browsing information, usage behavior (pages visited, time on page, traffic source), and data obtained through cookies and similar technologies, detailed in the “Cookies” section.

Technical data (service customers)

For customers of technology services, we also process technical data needed to operate the contracted solutions, such as system settings, logs, support tickets, and technical communications.

2. Purposes of processing

We use personal data to perform and manage our services, support customers, improve the solutions we offer, send promotional communications, and meet legal obligations.

These purposes include:

• Performing signed contracts, providing support, and communicating with users;
• Developing and improving products, running usage analyses and research;
• Responding to requests and sending marketing materials, updates, newsletters, and event invitations;
• Meeting tax, regulatory, and audit requirements and exercising legal rights.

3. Legal basis for processing

We process personal data on different legal grounds, depending on the context of collection and the relationship with the data subject.

Consent

Whenever required, we ask for the data subject’s free, informed, and unambiguous consent, especially for marketing communications, non-essential cookies, or when specific legislation requires it.

Performance of a contract

Another relevant basis is performance of a contract or pre-contractual steps, when processing is needed to provide services requested by the data subject, handle support, or enable commercial agreements.

Legal obligation

We also rely on compliance with a legal or regulatory obligation when the law requires collection, storage, or sharing of data with public authorities, including tax, labor, or consumer situations.

Legitimate interest

Finally, we process data on Clever Health’s legitimate interest, provided the fundamental rights and freedoms of data subjects are respected. This applies to cases such as information security, fraud prevention, service improvements, and customer relationships.

4. Data sharing

We may share personal data with third parties carefully and only when necessary to fulfill the purposes of this Policy.

Service providers

Cloud hosting providers, analytics tools, and payment systems. These suppliers receive only the data strictly needed for their work and are contractually bound to confidentiality and security.

Business partners

Data may also be shared with business partners when that sharing is essential to providing the services contracted by the data subject.

Legal authorities

To meet legal obligations or a court order, we may provide data to competent authorities.

Analytics tools

We use tools such as Google Analytics, which receive data within the limits of the purpose and under the safeguards required by applicable law.

5. Retention and disposal

We store personal data only for as long as strictly necessary to fulfill the purposes for which it was collected, respecting minimum legal retention periods and other regulatory obligations.

Retention period

Data is kept for 90 (ninety) days on servers in Brazil and in other countries that offer an adequate level of data protection, always in line with applicable rules. When the period ends or the purpose is fulfilled, data is anonymized or securely deleted, unless it must be kept to meet a legal obligation, protect rights in legal proceedings, or at the data subject’s request.

Additional retention criteria include the contract term, internal investigations, audits, inspections, and fraud prevention.

6. Cookies and similar technologies

We use cookies and similar technologies to offer a personalized experience, improve site performance, and understand how visitors use our services. These files store and manage browsing preferences, collect analytics, and enable essential features.

Cookies are small text files that record information about your browsing and interaction with the site, including preferences, sessions, performance, and advertising. We use different types of cookies; see our Cookie Policy on the official Clever Health website.

You may manage or withdraw consent for cookies at any time by configuring your browser or using the options available on the site.

7. Information security

Information security is a priority for Clever Health. We employ technical and administrative measures to protect personal data against unauthorized access, leaks, loss, alteration, and any form of inadequate or unlawful processing.

Technical measures

These measures include firewalls, data encryption, authenticated access control, privilege segmentation, and activity logs.

Internally, we run periodic training for employees and contracted consultants on our information-security and privacy policies and practices, so everyone understands the importance of data protection in the corporate environment.

8. Data-subject rights

Under the LGPD, personal-data subjects have a set of rights that may be exercised at any time upon request.

Confirmation and access

Confirmation that processing exists and access to the data held by Clever Health.

Correction

Correction of incomplete, inaccurate, or outdated data.

Deletion

Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data.

Portability

Portability of the data to another service provider, upon express request.

Information about sharing

Information about the entities with which the data has been shared.

Withdrawal of consent

Withdrawal of consent, when applicable.

How to exercise your rights

Requests should be sent by the data subject to privacidade@cleverhealth.com.br. Clever Health will take all reasonable steps to verify the requester’s identity and respond within the legal deadline, clearly and adequately.

9. Data protection officer (DPO)

For information about Clever Health’s data-protection officer, contact privacidade@cleverhealth.com.br.

10. Policy updates

This Policy will be updated periodically. The current version will always be available on the official Clever Health website.

11. Contact channels

Questions or requests related to this Policy can be sent to:

Email: privacidade@cleverhealth.com.br

Hours: Monday to Friday, 8:00 a.m. to 6:00 p.m. (Brasília time)