Privacy Policy

Professional registration data: name, email, professional license number (CRM), specialty, and institution.

Clinical data entered by the user to operate the tools (for example, age, PSA, staging, biopsy and MRI data). Such data is used in pseudonymized form whenever possible.

Application usage and diagnostic data, for security, metrics, and service improvement.

With respect to patients' clinical data, the professional/institution user acts as the controller, being responsible for the legal basis of the processing (as a rule, the data subject's consent or another applicable legal ground). ProstPlanAI acts as the processor, handling such data in accordance with the user's instructions and this Policy.

With respect to the professional's own registration and usage data, the processing is based on the performance of the contract and the legitimate interest in operating and improving the service.

When the user makes use of the automatic extraction of reports, the submitted documents are processed by an artificial intelligence service in a controlled environment (server-side), for the sole purpose of extracting the clinical fields for the professional's review. The access keys to these services remain in the backend and are not exposed to the client.

Data is stored on infrastructure with per-user isolation (row-level access control) and technical security measures. Third-party credentials, where they exist, are encrypted at rest.

We adopt reasonable measures to protect the data; no system, however, is completely immune to incidents.

We do not sell personal data. Sharing occurs only with the processors necessary to provide the service (for example, cloud infrastructure, AI processing, and payment processor) and where required by law or a competent authority.

The data subject may request confirmation of processing, access, correction, anonymization, portability, and deletion of their data, under the LGPD. Requests relating to patients' clinical data must be directed to the professional/institution acting as controller.

The user may delete their account at any time through the account deletion feature in the application.

Data is retained for as long as necessary for the purposes described and to comply with legal obligations, and is deleted or anonymized when no longer needed.

To exercise rights or clarify questions about privacy, contact us by email at contato@prostplanai.com.