Privacy Policy

SolvyMed ("we", "our", or "us") is a clinic management platform operated by BurrowSoft. This Privacy Policy explains how we collect, use, store, and protect information when you use our mobile app and web platform (collectively, the "Service").

By using SolvyMed, you agree to the practices described in this policy. If you do not agree, please stop using the Service.

This policy applies to:

• Healthcare professionals (doctors, therapists, and similar) who use SolvyMed to manage their practice.
• Secretaries / receptionists who manage appointments on behalf of a professional.
• Patients who book appointments or access their records through the app.

3.1 Account information

When you create an account we collect your name, email address, and password (stored as a secure hash). Healthcare professionals may also provide their specialty, clinic name, address, phone number, and CNPJ.

3.2 Patient data

Professionals enter patient records into the Service. This may include full name, CPF, date of birth, sex, phone number, email, emergency contact, insurance type, medical notes, diagnoses, prescriptions, exam files, and appointment history. This data is entered by the professional and belongs to their practice.

3.3 Appointment and scheduling data

We store appointment dates, times, types, statuses, payment amounts, and associated notes.

3.4 Payment information

Subscription payments are processed by Stripe. We do not store your full card number, CVV, or banking details. We only retain a payment provider reference ID and your subscription status.

3.5 Device and usage data

We collect device type, operating system version, and push notification tokens for the purpose of sending appointment reminders. We do not sell or use this data for advertising.

• To provide and operate the Service (scheduling, patient records, prescriptions, payments).
• To send appointment reminder push notifications.
• To process subscription payments and manage your account.
• To respond to support requests.
• To comply with legal obligations.

We do not use your data for advertising and we do not sell your data to any third party.

We share data only with the following service providers, strictly to operate the platform:

• Supabase — database, authentication, and file storage (servers in Brazil, São Paulo region).
• Vercel — website hosting (server processing in Brazil, São Paulo region).
• Stripe — payment processing for subscriptions.
• Expo — push notification delivery service.
• Resend — transactional email (account confirmations and password resets) (USA).
• Sentry — error monitoring for the website; error reports carry technical details and are filtered for personal data before they are sent (USA).

We may disclose information if required by law, court order, or to protect the rights and safety of our users or the public.

All data is stored on Supabase infrastructure with encryption at rest and in transit (HTTPS/TLS). Row-level security policies ensure that professionals can only access their own patients and records. The mobile app offers an optional biometric / PIN lock for an additional layer of protection.

Despite our measures, no system is completely secure. We encourage you to use a strong password and to keep your device secure.

Medical records (clinical notes, prescriptions and exam files) are kept for at least 20 years, as required by Brazilian law for patient records. A patient with medical records cannot be deleted, only archived, and an account that holds medical records is closed rather than deleted, so the records are kept. Other account data is kept while the account is active.

After 24 hours, a clinical note or prescription can no longer be edited or deleted. It can be corrected, and each correction is kept with its date, author and reason. Files removed from a patient's chart after 24 hours are hidden, not deleted, and are kept for the legal retention period.

You can close or delete your account yourself in Settings, or ask us by email:

• Secretaries, patients, and professionals whose patients have no medical records: the account is deleted immediately.
• A professional whose patients have medical records: the account is closed. The login, contact details, photo, payment and practice details are deleted immediately. The medical records and the patient list are kept, inaccessible, for the legal retention period (20 years from closure), then permanently deleted. The professional's name and professional registration stay with the records as their author.
• Patients of a closed practice can request copies of their records from support@solvymed.com.
• Payment history is kept by our payment processor (Stripe), as required by tax law.
• The same email address can be used to open a new, empty account.

Under the Brazilian General Data Protection Law (LGPD — Lei n.º 13.709/2018) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data ("right to be forgotten"), except medical records, which are kept as described in section 7.
• Request a portable copy of your data.
• Withdraw consent at any time.
• Lodge a complaint with your national data protection authority.

To exercise any of these rights, contact us at the address below.

SolvyMed is not directed at children under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify users of material changes via in-app notification or email. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have any questions or requests regarding this Privacy Policy, please contact:

BurrowSoft
Email: support@solvymed.com