MINUTA — pendente de revisão jurídica | DRAFT — pending legal review
Privacy policy
Version 2 · October 30, 2026
Collected data and purpose
We process email, name, authentication identity, family and professional links, preferences, children’s data and sensitive health data: vaccines, medication, exams, growth, teeth, appointments and routines. Photos, documents, milestones, messages and location are processed when supplied for the requested feature. Purposes are authentication, organizing care, authorized access and requested functions. We do not sell health data or use it for behavioral advertising targeting children.
Legal bases and protection of children
Health data is sensitive (LGPD article 11). Health organization features rely on specific, highlighted consent (article 11, I). For children, we require a parent or legal guardian’s attestation and consent, guided by best interests and minimization (article 14). An adult account alone does not prove this status. Ordinary account data necessary for the service is processed for service provision (article 7, V); minimal evidence may be kept for the regular exercise of rights (articles 7, VI, and 11, II, d, where applicable). Analytics and group milestones have separate, revocable choices, off by default. Legal review of these bases and parental verification is pending.
Providers, access and transfers
Convex hosts data and files. Cloudflare delivers transactional email. Google Gemini processes documents when you request prescription, exam or vaccine extraction. Google Places receives searches and location to find services. Himetrica receives limited events only with your permission. Caregivers, doctors and group members receive only what their access permits. These providers may process data outside Brazil. Countries, contracts, subprocessors, backup periods and applicable international transfer mechanisms (LGPD articles 33 to 36 and ANPD rules) must be validated by the controller before final publication. This draft does not claim unverified certifications or safeguards. AI extraction happens only when you request it; do not send more information than needed.
Retention and data subject rights
While the account is active, we keep data necessary for requested functions. Deletion starts cleanup of data and files under your sole responsibility; records belonging to another family may remain. A routine removes orphaned records, unlinked files after a safety period, expired doctor access and expired temporary credentials. The latest receipt for each active consent remains while the account exists. Minimal audit records, revoked or superseded consent history and evidence from deleted accounts are kept for up to five years, subject to legal review, for accountability and legal claims; they do not include health content. Visit Profile > Privacy and data for confirmation and access, JSON/PDF, correction, deletion and withdrawal. For anonymization, restriction, objection, review, sharing details or questions about a refusal, contact the data protection contact. You can petition ANPD.
Milestones and optional choices
Milestone sharing is optional and starts off. After you authorize it and accept each group’s notice, members can see the first name, title, date, category, note and photo of milestones. Do not include intimate or health information. Withdrawal stops new reads; the app cannot recover copies already made by others. Consent history records versions, dates, channel and withdrawals. A group authorization does not grant access to consultations or clinical records.
Usage data
Usage analytics with Himetrica is optional and starts disabled. We only send generic actions after your permission, without names, contact details, account IDs or health content. We use temporary random identifiers with no link to your account. We do not send full URLs, searches or document titles. As with any connection, the provider receives the source IP. You can withdraw permission in privacy preferences or your profile; new sends stop immediately. In the app and portal, the choice is recorded in your account; signing out stops sends on this device and signing in restores the server choice. On the website without an account, the choice applies to this device. Withdrawal does not delete data already received by the provider.
Data protection contact
privacidade@yupee.appprivacidade@yupee.app is the provisional data protection contact, pending operational validation and legal review. Identify your account and request; do not send medical reports or health documents in your first email.