Privacy Policy

1. Imaginos's two roles

For the professional/clinic User's own data — registration, identification, credentials, contact, billing, and browsing — Imaginos is the Controller.

For patients' clinical data entered into the platform by the User — dermatoscopy and trichoscopy images and clinical metadata — Imaginos is the Processor. The Controller is the professional or clinic, who holds the clinical relationship and the duty to obtain legal bases at source.

2. Data we process

User registration and identification (Controller): name, email, phone, professional registration, clinic name, role, and protected credentials. With external login (e.g., Google), we receive only name and email — never your provider password.

Billing data (Controller): processed by payment operators; we do not store full card numbers.

Patient clinical data (Processor): clinical images, identifiers, and metadata entered by the User — sensitive personal health data belonging to the User Controller.

Technical and browsing data (Controller): IP, device, browser, and logs, for security, fraud prevention, and service improvement.

3. Purposes and legal bases

We process data for: providing the contracted service (contract performance, art. 7, V); compliance with legal obligations (art. 7, II); legitimate interest (art. 7, IX) in security, fraud prevention, and feature development; operational communications and, with an opt-out, communications about the platform; exercise of rights (art. 7, VI); and protection of health (art. 11, II, "f"), within the clinical relationship led by the User Controller.

For sensitive patient data, the legal basis at source (including patient consent where required) is the responsibility of the User Controller.

4. Data sharing

We do not sell personal data. We share only with: infrastructure operators (hosting, database, storage, image processing) under security obligations; an artificial intelligence provider, for the natural-language processing behind assistive features (such as the support assistant), under a data processing agreement that contractually prohibits using the data to train the provider's models; payment operators; competent authorities under legal obligation; and in corporate transactions, preserving this Policy's obligations.

We do not share patient clinical data for marketing. Clinical data is accessible only to those the User authorizes and to technical staff in restricted support or maintenance situations.

5. International transfer

Part of the infrastructure may be located outside Brazil. Where this occurs, the transfer will comply with the LGPD, with adequate contractual clauses and comparable protection guarantees. Where feasible, we prioritize storing clinical data in a region compatible with the User's requirements.

6. Information security

We adopt technical and organizational measures: encryption in transit and, where applicable, at rest; restricted, segregated access control; access logging and monitoring; environment segregation; and incident response. Images are kept in private storage, accessed only via authentication and signed URLs — with no public access.

No system is fully immune to incidents. You are responsible for safeguarding your credentials. In an incident that may pose relevant risk, we will notify the User Controller and, where applicable, the Brazilian data protection authority (ANPD), cooperating in fulfilling legal duties.

7. Anonymized images for research and AI

Imaginos may use data — including clinical images — in aggregated and anonymized form, without allowing re-identification, for research, statistics, scientific validation, and feature improvement, including the training and improvement of artificial intelligence and computer vision models.

Under article 12 of the LGPD, effectively anonymized data is not personal data. Anonymization is performed by Imaginos before any use. This purpose is enabled by default, especially on free and trial plans; exclusion may be requested at legal@imaginos.app. The User Controller must ensure, at source, the legal basis allowing this anonymization.

8. Assistant and real-time AI features

The platform offers real-time AI-assisted features — such as the support assistant — available only when enabled by the organization (a decision of the professional/clinic Controller, made by an administrator). In these features, data is processed exclusively to deliver the response to the User, through an AI provider engaged as a sub-processor, under a data processing agreement that contractually prohibits retention and use of the data to train the provider's models. This real-time processing is distinct from and independent of the anonymized data use described in the previous section.

Any context shared with the assistant is minimized and pseudonymized before sending: patient identification is reduced to initials and internal codes, and free-text clinical fields are not sent. Conversations with the assistant are recorded and used by Imaginos to improve the product — which the User is notified about on first use — and are kept for up to 12 months.

9. Retention and deletion

Data is kept for as long as necessary for its purposes and while the contractual relationship lasts. Upon account closure — including cancellation of the subscription for non-payment exceeding 90 days — your data, including clinical data, remains available for export for up to 90 days, with periodic notices; after that period without export, it is permanently deleted or anonymized. Data already anonymized and incorporated into studies and models is not affected by closure.

Legal retention periods specific to the healthcare sector — such as the minimum of 20 years for a medical record from the last entry (Law 13,787/2018, art. 6; CFM Resolution 1,821/2007, art. 8) — are the responsibility of the User Controller of the clinical data, who must ensure their own retention of that data outside the platform, if needed, within the export window. As Processor, Imaginos does not assume this long-term retention duty.

10. Data subject rights

Under the LGPD, the data subject may request confirmation, access, correction, anonymization, blocking, deletion, portability, information on sharing, and withdrawal of consent.

As Imaginos is generally the Processor of patient data, patient requests should be directed to the professional or clinic Controller; Imaginos will assist. For data where Imaginos is the Controller (User data), requests may be made to the Data Protection Officer.

11. Cookies

The platform uses cookies strictly necessary for operation and security and, with consent where required, usage measurement cookies. You can manage preferences in your browser; disabling necessary cookies may impair functionality.

12. Changes to this Policy

Imaginos may amend this Policy due to legal, regulatory, operational, or feature changes. Material changes will be communicated with reasonable notice, by email or platform notice, indicating the effective date. Continued use after the effective date constitutes agreement.

13. Data Protection Officer and contact

Data Protection Officer: legal@imaginos.app. General contact: contact@imaginos.app. Address: Rua Ambrosio Pereira, 42, São Paulo/SP, 04612-030, Brazil. The data subject may file a complaint with the Brazilian data protection authority (ANPD). Venue: courts of São Paulo/SP.