Privacy Policy

1Who we are (Controller)

1.1. Doctorquest Ltda., registered under CNPJ No. 63.001.498/0001-27 (“DoctorQuest”), is the controller of the personal data processed on the “Aprenda ECG Pro” platform (aprendaecg.com.br and app.aprendaecg.com.br).

1.2. This Policy describes how we collect, use, share and protect personal data, in compliance with the LGPD and the Marco Civil da Internet.

2Contact channel for data subjects

2.1. DoctorQuest provides a dedicated channel for privacy and data protection matters and for exercising the rights provided for in the LGPD: contato@doctorquest.com.br.

2.2. Through this channel, data subjects may send questions, requests and complaints about the processing of their personal data. We may ask for additional information to verify the requester’s identity before fulfilling a request.

2.3. Communications are received and answered in accordance with the LGPD and the regulations of the ANPD (Brazilian National Data Protection Authority).

3Scope

3.1. This Policy applies to the processing of data of visitors, subscribers and users of the Platform, including the website and the app.

4Data we collect

4.1. Registration and account: name, email, password (stored in encrypted form) and, where applicable, CPF (Brazilian taxpayer ID), date of birth, phone number, profession/field of practice and professional license number.

4.2. Authentication: user ID, access tokens and session records.

4.3. Payment and subscription: purchased plan (for example, 12 or 24 months), payment history and subscription status. The data needed for billing is processed by a payment processor, currently Asaas; other providers may be engaged for this purpose. We do not store full card details.

4.4. Usage and browsing: access logs, IP address, device and browser identifiers, content accessed, study progress and performance.

4.5. Interactions with AI Features (when available in the product): content and questions submitted to the artificial intelligence features.

4.6. Communication and support: messages, questions and requests sent to DoctorQuest.

4.7. Cookies and similar technologies: as described in Section 10.

4.8. De-identified educational content: the ECG tracings and clinical cases that make up the Content are presented in anonymized/de-identified form, do not allow patients to be identified and do not constitute personal data of identifiable individuals for the purposes of the LGPD.

5How we collect data

5.1. We collect data directly from the data subject (registration, use of the Platform, contact); automatically (cookies, logs and similar technologies); and from third parties (for example, payment processors and analytics tools).

6How we use the data

6.1. We use the data to: create and manage the account and Subscription; provide access to the Content and features; process payments, renewals and refunds; provide support; personalize the experience and track progress; operate AI Features, when available; detect and prevent fraud, unauthorized sharing, piracy and contract violations; keep the Platform secure; improve and develop the Platform; send service communications and, with consent, marketing communications; and comply with legal, tax and regulatory obligations.

6.2. Research and improvement: we may use data on usage of and interaction with the Platform, including interactions with AI Features, in aggregated and anonymized form, for scientific research, statistics, educational metrics and continuous improvement of the Content and features. Once irreversibly anonymized, this data does not identify the data subject and is no longer personal data, under Article 12 of the LGPD. The data subject may object to this use at any time through the channels in Section 2.

7Legal bases (LGPD)

7.1. Performance of a contract (Art. 7, V): registration, Subscription, access to Content and support.

7.2. Compliance with a legal obligation (Art. 7, II): tax, accounting and regulatory obligations.

7.3. Legitimate interest (Art. 7, IX): security, prevention of fraud and piracy, statistics and research using anonymized data, audience and campaign measurement through cookies and pixels (Section 10), and service improvement, balanced against the rights of the data subject, who may object to this processing at any time.

7.4. Consent (Art. 7, I): marketing communications by email or message, which may be withdrawn at any time.

8Data sharing

8.1. We may share data with: payment processors (currently Asaas; other providers may be engaged), to process transactions; hosting and cloud infrastructure providers; analytics and communication tools; AI technology providers; advertising and campaign measurement platforms (for example, Meta/Facebook and Google), through cookies and pixels, as described in Section 10; accounting, legal and security firms and consultants, under a duty of confidentiality; and public authorities, when required by law, court order or valid request.

8.2. Our partners process data according to our instructions and applicable law. We do not sell personal data.

9International transfers

9.1. Some providers may be located outside Brazil (for example, in the United States). In such cases, we adopt safeguards consistent with the LGPD (Art. 33) to protect the transferred data.

10Cookies and similar technologies

10.1. We use essential cookies (operation and authentication), performance/analytics cookies (usage statistics) and marketing and advertising cookies, including third-party pixels and tags such as the Meta Pixel and Google, used for campaign measurement and remarketing. Data subjects can manage or block cookies in their browser settings and turn off ad personalization in the settings of the respective platforms.

11Automated decisions and AI

11.1. AI Features, when available in the product, support study and do not make decisions with legal effects on the data subject. Under Article 20 of the LGPD, data subjects may request information about automated processing that affects them.

12How long we keep data

12.1. We keep data for as long as needed for its purposes and for the duration of our relationship with the data subject, subject to legal retention periods. As a guide: (i) registration and account data, for the duration of the Subscription and up to 5 (five) years after it ends, for the regular exercise of rights; (ii) tax and payment data, for the period required by tax law (generally 5 years); (iii) application access logs, for at least 6 (six) months, under Article 15 of the Marco Civil da Internet. Once the purpose has been fulfilled, data is deleted or anonymized, except where retention is required by law.

13Information security

13.1. We adopt technical and organizational measures (access control, encryption where applicable, backups, monitoring, logs and internal policies) to protect data against unauthorized access and against accidental or unlawful destruction, loss, alteration or disclosure. No system is completely secure; in the event of a significant incident, we will take the steps required by the LGPD, including, where required, notifying the authorities and the data subjects.

14Data subject rights

14.1. Under Article 18 of the LGPD, data subjects may request: confirmation that processing takes place; access to their data; correction of incomplete or outdated data; anonymization, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about data sharing; information about the option to withhold consent and its consequences; and withdrawal of consent.

14.2. To exercise your rights, contact contato@doctorquest.com.br. We may ask for information to verify your identity.

14.3. Data subjects may also file petitions and complaints with the Brazilian National Data Protection Authority (ANPD), under Article 18, §1 of the LGPD, as well as with consumer protection agencies.

15Children and adolescents

15.1. The Platform is intended for healthcare professionals and students and is not directed at anyone under 18. We do not knowingly collect data from children. If we identify improper processing, we will take appropriate action.

16Changes to this Policy

16.1. This Policy may be updated. The current version will always be available on the Platform, with its update date. Material changes may be communicated through the available channels.

17Contact

17.1. Questions about privacy and data protection: contato@doctorquest.com.br.

18Governing law

18.1. This Policy is governed by the LGPD (Brazilian Law No. 13,709/2018) and the Marco Civil da Internet (Brazilian Law No. 12,965/2014).