Our commitment
Simplafy processes personal data in accordance with the principles of purpose, adequacy, necessity, transparency, security and prevention (LGPD, art. 6). This page details how we apply those principles in practice and how you, as a data subject, can exercise your rights.
1. Roles in data processing
We act in two distinct roles:
- Controller — for data collected on our website, in commercial interactions and for managing job applicants.
- Processor — for data that customers enter into the Platform (messages, patient records, leads). We process this data under the Customer's documented instructions.
2. Applicable legal bases
| Processing | Legal basis (LGPD art. 7) |
|---|---|
| Operation of the Platform | Performance of a contract |
| Billing, invoices | Compliance with a legal obligation |
| Security and anti-fraud logs | Legitimate interest |
| Direct marketing | Consent |
| Defense in legal proceedings | Regular exercise of rights |
3. Sensitive personal data
In the Simplafy Saúde product, we may process sensitive data (health, biometrics) as a processor, under:
- The data subject's specific and prominent consent (art. 11, I);
- Protection of health, in a procedure carried out by health professionals (art. 11, II, "f");
- Compliance with a regulatory obligation (CFM, ANS, etc.).
4. Your rights as a data subject (art. 18)
- Confirmation that processing exists;
- Access to the data;
- Correction;
- Anonymization, blocking or deletion;
- Portability;
- Deletion of data processed based on consent;
- Information about the entities with which we share your data;
- Information about the possibility of not giving consent;
- Withdrawal of consent.
5. How to exercise your rights
There are three channels. Use whichever is most comfortable for you:
- E-mail — [email protected] with the subject "Direito do Titular — [type]" (Data Subject Right).
- Form — fill it in at /contato, selecting "LGPD" as the reason.
- Letter — addressed to SIMPLAFY LTDA, A/C DPO, SAUS Q4 Bl. A Sala 513, Brasília/DF.
We will ask for proof of identity proportionate to the risk level of the request. For representation by third parties, a specific power of attorney is required.
6. Response deadlines
- Confirmation and access: within 15 days;
- Correction, deletion, portability: within 15 days;
- Complex requests: justified extension, with the new deadline informed in writing.
7. Incident notification
In case of a security incident involving personal data that may cause relevant risk or harm to data subjects, we will notify the ANPD and the affected data subjects within a reasonable time (reference: 2 business days), following the Authority's guidance.
If you suspect an incident, write immediately to [email protected].
8. National Data Protection Authority
If you are not satisfied with our response, you have the right to report to the National Data Protection Authority (ANPD): www.gov.br/anpd.