Privacy Policy

1. Who is responsible

This policy covers the website, patient app, and professional CPAPCalm platform, a product of TR MEDICO HOSPITALAR LTDA, CNPJ 11.627.055/0001-42, at Rua Carneiro Vilela, 688, Aflitos, Recife/PE, CEP 52050-033, Brasil.

At initial launch, only patients linked to TR's own operation use the service. TR is therefore the controller of account and follow-up data. Before an independent clinic uses CPAPCalm, it must be identified as controller of care data and this policy will be updated when necessary.

Internal privacy lead: Tiago Pacheco de Moura, Director. Privacy questions and rights requests: contact@cpapcalm.com. Support: support@cpapcalm.com.

2. Data we may process

• Identity and contact data, account identifiers, date of birth, and clinic relationship.
• Health and care data, including intake, clinical notes, questionnaires, sleep diary, CPAP adherence/events/metrics, reports, documents, and care messages.
• Equipment details, including manufacturer, model, serial number, settings, and imported files.
• Communications, attachments, preferences, delivery/read evidence, and push tokens.
• Technical and security data such as IP, device, OS, language, timezone, sessions, authentication and audit events.
• Commercial and tax data where applicable.

2.1 Subjects and sources

Data subjects include adult patients, professionals, staff, business contacts, and visitors. Data may come from the subject, a TR professional, CPAP equipment or files, authorized integrations, and technical events needed for operation and security.

3. Purposes and legal grounds

• Perform contracts and requested steps to create an account and deliver support and features.
• Protect health and support care delivered by health professionals or services, where applicable.
• Comply with legal and regulatory duties, including integrity and retention of clinical and tax records.
• Prevent fraud, secure accounts, keep proportionate logs, and establish or defend legal claims.
• Provide optional notifications and permission-based device functions with consent or specific authorization where required.

4. AI and human review

Professional artificial-intelligence features, when enabled, may use a Railway worker and OpenAI services only to transcribe, translate, summarize, format, or organize information. We remove direct identifiers when they are not needed. These features do not make clinical recommendations.

Before personal data is sent, the product must identify the recipient, data, and purpose and obtain explicit permission. Every clinical interpretation, instruction, and decision is made and owned by an identified healthcare professional.

5. Sharing and international transfers

We use providers for infrastructure, authentication, storage, hosting, notifications, messaging, video, tax documents, and technical processing. The Subprocessors page identifies the providers and their functions. Each provider must receive only the data needed and offer protection consistent with this policy and applicable law.

Some providers may process data outside Brazil. Their use depends on a valid international-transfer mechanism and appropriate contractual and technical safeguards.

6. Retention and deletion

We keep each data category only for as long as its purpose or a legal duty requires. Records included in a medical record may be kept for 20 years after the latest record, or longer when required by law. Tax, security, and legal-claim data follow their applicable periods.

When an account is closed, data without a retention requirement is deleted or anonymized. Data that must be retained is access-restricted and is not used for other purposes. The Account deletion page explains the process and timelines.

7. Your rights

You may request confirmation, access, correction, sharing information, portability when regulated, objection, review of automated decisions, anonymization, restriction, or deletion where applicable. Email contact@cpapcalm.com. We may verify identity and route clinical requests to the responsible controller.

8. Security, advertising, age, and changes

We use authentication, access controls, encryption in transit, database access policies, audit records, and secure-development practices. No measure removes every risk.

We do not sell personal data or use health data for behavioral advertising. The service is intended for people aged 18 or older.

We will publish material changes on this page and, when needed, in the app. The date above identifies the current version.