Legal / Privacy Policy En | Game IA Doctor

1. Who we are

This Privacy Policy describes how MARINA LARA SO ORTODONTIA LTDA, registered under Brazilian company number (CNPJ) 04.102.726/0001-96, referred to as POWERDOCTOR, processes the personal data of students of Formação IA Doctor and users of the Equipe Invisível application.

PowerDoctor acts as the data controller under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).

Data Protection Officer: suporte@powerdoctor.com.br

2. Who this policy applies to

Healthcare professionals enrolled in Formação IA Doctor who use the Equipe Invisível application and its artificial intelligence agents, including Íris, the marketing agent.

This policy covers the professional's data. It does not cover patient data, which is not collected by this platform.

3. Data we collect

Data you provide directly

Account data: name, email, phone or WhatsApp number, profession, specialty, professional council and city
Strategic Profile (GAME diagnosis): answers about your clinic's structure, technology, payment methods, patient service, digital presence, professional goals and stated difficulties, including audio recordings you choose to submit as answers
Materials you upload: screenshots, reports, images, PDFs and text you attach for analysis
Conversations: the content of your conversations with the platform's artificial intelligence agents
Digital addresses: website, Instagram, Facebook, YouTube and Google Business Profile URLs you register as references

Data from accounts you connect

Connecting accounts is optional, requires your express authorization, and can be revoked at any time. When you authorize it, we access read-only:

Meta platforms (Instagram and Facebook)

Public information from your Instagram professional profile: username, picture, biography, follower and post counts
Your posts: images, captions, date and format
Performance metrics (Insights): reach, impressions, profile visits, clicks, saves, shares, comments and conversations started
Information and metrics from your linked Facebook Page
If and when you specifically authorize it, advertising campaign performance data, read-only

Google platforms

Information from your Google Business Profile: category, description, services, hours, photos, public reviews and replies
Profile performance metrics: searches that surface the profile, views, direction requests, clicks and calls
When connected, aggregated Google Analytics data from your website: sessions, traffic sources and conversions
When connected, Google Search Console data: search queries and page performance

Technical data

IP address, device type, browser, date and time of access, and platform usage logs, collected for security and service operation.

What we do NOT collect

Personal or health data of patients
Medical records, identifiable clinical images or treatment records
The content of private messages exchanged between you and your patients
Passwords for your third-party accounts. Authorization uses the OAuth protocol, and PowerDoctor never has access to your credentials

If you mistakenly upload material containing patient data, it will be deleted and you will be notified.

4. How we use your data, and the legal basis

Purpose — Legal basis (LGPD)
Delivering the contracted service: generating diagnoses, analyses, plans and marketing content personalized for your clinic — Performance of a contract, art. 7, V
Accessing and analyzing data from the accounts you connect — Consent, art. 7, I
Processing audio recordings you submit, including transcription to text — Consent, art. 7, I
Storing history and generated documents, to provide continuity — Performance of a contract, art. 7, V
Emailing you the reports and plans produced for you — Performance of a contract, art. 7, V
Ensuring security, preventing fraud and logging access — Legitimate interest, art. 7, IX
Complying with legal and regulatory obligations — Legal obligation, art. 7, II

5. Limited use and no model training

Data obtained from Meta and Google platforms is used exclusively to generate analyses, recommendations and marketing materials presented to you, the account holder, within the platform.
This data is not used to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models, whether our own or third parties'.
This data is not sold, rented, licensed or shared for advertising, third-party profiling, data brokerage or any purpose unrelated to providing the service.
No data from a connected account is shown, compared or made available to any other student on the platform.
Use of Meta platform data complies with the Meta Platform Terms and Developer Policies. Use of Google API data complies with the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell personal data. We share only with processors necessary to operate the service, and only to the extent necessary:

Cloud infrastructure and hosting providers
Artificial intelligence model providers that process conversation content to generate agent responses
Email delivery provider, to send you the generated reports
Public authorities, where required by law or court order

All processors are bound by contractual confidentiality and security obligations.

7. International transfers

Some of the providers above are located outside Brazil. In those cases, international transfers are carried out under art. 33 of the LGPD and contractual clauses ensuring an adequate level of protection.

8. How long we keep data

Account data and Strategic Profile: for the duration of your enrollment and up to 5 years afterwards, for contractual evidence
Data from connected accounts: while the connection is active. When you revoke a connection, data obtained from that platform is deleted within 30 days
Uploaded materials, conversations and generated documents: for the duration of your enrollment, or until you request deletion
Access logs: 6 months, under the Brazilian Internet Civil Framework

After these periods, data is deleted or irreversibly anonymized.

9. Security

We apply technical and administrative measures to protect your data: encrypted transmission, authenticated access control, logical segregation of each student's data, and access logging. No student can access another student's data.

In the event of a security incident with relevant risk, you and the Brazilian Data Protection Authority will be notified within the legal deadlines.

10. Your rights

Under art. 18 of the LGPD, you may at any time request: confirmation that processing exists, access to your data, correction of incomplete or outdated data, anonymization, blocking or deletion of unnecessary or excessive data, data portability, deletion of data processed based on consent, information about who we share data with, information about the option not to consent and its consequences, and withdrawal of consent.

How to exercise these rights: write to suporte@powerdoctor.com.br. We respond within 15 days.

11. How to revoke access to connected accounts

Inside the platform: go to Conexões da Íris and click Disconnect on the relevant channel.

Directly on the source platform:

Instagram: Settings, Apps and websites, remove the app's access
Facebook: Settings and privacy, Settings, Apps and websites, remove the app
Google: myaccount.google.com/permissions, select the app and remove access

Revoking access immediately stops the collection of new data. Data already obtained from that platform is deleted within 30 days.

12. Cookies

We use only cookies necessary for the operation and authentication of the platform. We do not use advertising or third-party tracking cookies inside the application.

13. Minors

The platform is intended exclusively for healthcare professionals aged 18 or over. We do not knowingly collect data from minors.

14. Changes to this policy

We may update this policy. Material changes will be communicated by email and prominently within the platform before taking effect.

15. Contact

MARINA LARA SO ORTODONTIA LTDA · CNPJ 04.102.726/0001-96 · POWERDOCTOR · Data Protection Officer: suporte@powerdoctor.com.br