This is an English translation provided for convenience. The Portuguese version is the official document and prevails in case of any difference. Official version in Portuguese
Legal document · English translation
Privacy Policy
Version 1.1.0 · Brazilian Law 13,709/2018 (LGPD)
In one sentence: we collect what is necessary to operate your account and keep it secure, we anonymize the IP address of sign-in records after 90 days, and we never sell data or cross data between accounts.
This policy is about YOUR data. Your clients’ data follows your instruction — see the DPA (in Portuguese).
PRIVACY POLICY — CRMPMU PLATFORM
Version 1.1.0
This policy explains what CRMPMU does with the data of those who USE the
platform (the professional and her team). The data of the CLIENTS she serves is
processed under her instruction — see the DPA.
1. WHAT WE COLLECT FROM YOU
1.1 Registration: name, email, clinic name.
1.2 Security: a record of sign-in attempts (date, result and IP address),
devices with an active session, and the second factor.
1.3 Usage: a record of the relevant actions taken in the account — who did
what, and when. This is what makes it possible to audit and to answer
"who changed this?".
2. WHAT WE USE IT FOR
2.1 To operate the platform and keep your account secure.
2.2 To detect and block improper access — including attempts to reach
another account's data.
2.3 To talk to you about your account (security notices, billing, changes).
Marketing communication only with opt-in, and always with a way out.
3. HOW LONG WE KEEP IT
3.1 Registration data: for as long as the account exists, and for up to 30
days afterwards.
3.2 IP address in sign-in records: anonymized after 90 days. The audit trail
remains (when, and with what result); the identifier is removed.
3.3 Records the law requires to be kept (tax, clinical) follow the legal
period, even after the account is closed.
4. WHO WE SHARE IT WITH
4.1 With infrastructure providers strictly necessary for the operation
(hosting, message delivery, payment processing), each limited to what it
needs and bound to confidentiality.
4.2 With public authorities, when there is a legal order.
4.3 We never sell personal data, and we never cross data between accounts.
5. WHERE THE DATA IS KEPT
On servers under our direct administration, with encryption in transit,
backup and point-in-time recovery. Backup copies are kept in encrypted
external storage.
6. YOUR RIGHTS (LGPD, art. 18)
You may request, at any time: confirmation of processing, access,
correction, anonymization, portability and deletion. The platform has export
and deletion in its own interface; requests that require analysis are
answered within the legal period. Contact: suporte@pmuplay.com.br.
7. INCIDENTS
In case of a security incident with risk to you or to your clients, we notify
you within 48 hours of detection — a shorter period than the legal one, and
assumed by contract.
8. CHANGES
Changes raise the version of this policy. Accepting version
1.1.0 is not accepting a future version.
WhatsApp section · version 1.0.0
WhatsApp messages — for people served by a clinic
This part is addressed to you, a client or student of a clinic that uses CRMPMU to talk on WhatsApp.
Who is responsible for your data
The clinic that serves you is the controller: it decides why and how your data is used. CRMPMU is the processor: it stores and processes the data on the clinic’s behalf, following the clinic’s instructions, and never for its own purposes.
What data we process
Your phone number and your WhatsApp profile name; the content of the messages sent and received, with the files attached to them (photo, audio, document); the date, time and status of each message (sent, delivered, read or failed); and your replies to message buttons, such as “I confirm” or “I need to reschedule”.
When your first message comes from an ad, we also store the identification of that ad.
Why we process it
To remind you of and confirm your appointment, send aftercare instructions after the procedure, send the contract for signature, notify you about payment for a service you hired, and answer your questions.
Promotional messages are sent only to people who authorized receiving them, and the authorization can be withdrawn at any time.
Messages sent on the clinic’s initiative do not ask for health information.
Legal basis
The performance of the service you hired from the clinic and the clinic’s legitimate interest in serving you, for service and reminder messages; your consent, for promotional messages (Brazilian Law 13,709/2018, art. 7, I, V and IX).
Who we share it with
Messages travel through WhatsApp, a Meta service, which carries them under its own terms. Inside the platform, only the clinic that serves you and the people it authorizes see your conversations. We do not sell personal data and we do not cross data between clinics.
How long we keep it
Conversations are kept for 5 years after your last appointment at the clinic. Whatever is part of your clinical record follows the clinical record period, of 20 years.
How to request deletion
You may request the deletion of your conversations at any time, without waiting for that period. The steps are at /en/data-deletion. You receive an answer within 15 days.
Requests for access, correction, portability, anonymization or deletion: write to the address below, or use the export and deletion available inside your own account.