Privacy Policy

SolvyMed is a clinic management platform (mobile app and website, the "Service") operated by Vitor Carvalho, an individual, trading as BurrowSoft, 297 Moo 1, Baan Sanian, Mueang Nan, Nan 55000, Thailand ("BurrowSoft", "we"). This policy explains what personal data we process, why, and your rights under the Brazilian General Data Protection Law (LGPD, Lei n.º 13.709/2018) and, where applicable, other data protection laws.

• For account data of professionals, secretaries and patients (name, email, login, subscription), BurrowSoft is the controller.
• For patient records that a professional enters (clinical notes, prescriptions, exams, files, appointments), the professional or clinic is the controller and BurrowSoft is the operator (processor), acting only on their instructions. Requests about those records should go to the clinic first. We will help the clinic answer them.

3.1 Account information: name, email and password (stored only as a secure hash). Professionals may add their specialty, professional registration, clinic name, address, phone, CNPJ (tax ID) and a Pix key.

3.2 Patient data entered by professionals or their secretaries: identification and contact data (name, CPF, date of birth, sex, phone, email) and health data (notes, diagnoses, prescriptions, exams, files, appointment history). Health data is sensitive personal data under the LGPD.

3.3 Appointments and payments: dates, times, status, amounts and payment status.

3.4 Subscription billing: handled by Stripe. We never see or store full card numbers; we keep only a Stripe reference and your subscription status.

3.5 Device and technical data: device type, operating system version, app version, push notification tokens, and technical error reports.

3.6 Website usage and marketing attribution: only with your consent, anonymous usage statistics about our website, and the campaign that brought you to it (for example UTM tags and the referring website), which is saved with your account when you sign up. Patient data is never used for analytics or marketing.

• To provide the Service (scheduling, records, prescriptions, payments, secretary access).
• To send appointment notifications (push notifications) and service emails (such as account confirmation, password reset and account notices).
• To bill subscriptions and manage accounts.
• To detect and fix errors and keep the Service secure. Error reports are stripped of patient data and contain at most an internal user ID.
• With your consent: to measure which campaigns bring new professionals to SolvyMed and to improve sign-up.
• To meet legal obligations, including medical record retention.

We do not sell personal data. We do not use patient data for advertising.

All act under contract and only to operate the Service:

We may disclose information if required by law or court order.

Some providers above process data outside Brazil. We only use providers that commit to adequate protection (for example, standard contractual clauses), as required by Art. 33 of the LGPD and the rules of the ANPD. Clinical records are stored in Brazil.

• The professional sees all data of their own patients, including medical records.
• Secretaries the professional invites (up to 3) can see and manage patients' identification and contact data (including the patient's profile photo), the schedule and appointment payments, and can add, archive and restore patients. They cannot see medical records, prescriptions, exams or clinical files.
• Patients see their own appointments and the clinic's booking and payment information.
• Nobody outside the clinic, including other SolvyMed users, can see a clinic's data. SolvyMed staff access data only when needed for support or legal obligations.

Encryption in transit (TLS) and at rest; row-level access rules so each clinic sees only its own data; secretaries cannot access clinical records; patient files and photos are private and served only through short-lived links; an optional PIN/biometric lock in the app. No system is completely secure, so please use a strong password and keep your device secure.

• Medical records (clinical notes, prescriptions, exams, files, appointment history) are kept for at least 20 years, the period Brazilian law sets for patient records (Lei n.º 13.787/2018), even if the clinic archives the patient or closes its SolvyMed account. A patient with medical records can be archived but not deleted.
• After 24 hours, a clinical note or prescription can no longer be edited or deleted. It can be corrected, and each correction is kept with its date, author and reason. Files removed from a patient's chart after 24 hours are hidden, not deleted, and are kept for the retention period.
• When a professional closes their account (in Settings, or by asking us): login, contact details, photo, payment settings and subscription are deleted or anonymized right away. The professional's name and registration remain on the retained records, because records must identify their author. The retained records and the patient list are locked: nobody, including the professional, can access them in the app. They are permanently erased 20 years after the account was closed. Patients of a closed practice can request a copy of their records (see section 10). A professional whose patients have no medical records is deleted right away.
• When a patient or secretary deletes their account: their login, profile and links to clinics are deleted. The records clinics hold about a patient are kept as described above.
• The same email address can later be used to open a new, empty account.
• Other data: account data while the account is active. Error reports: up to 90 days. Usage statistics: up to 12 months. Billing records: as long as tax law requires (kept by Stripe).

Under the LGPD you may: confirm whether we process your data; access it; correct it; request anonymization, blocking or deletion of unnecessary data; request portability; learn who we share it with; withdraw consent (for example, for usage statistics, at any time in the cookie settings); and complain to the ANPD (Autoridade Nacional de Proteção de Dados).

Deletion requests do not override the legal retention of medical records (see section 9). Patients who want a copy of their records should ask their clinic. If the clinic has closed its SolvyMed account, contact us at support@solvymed.com and we will provide it after verifying your identity.

The website uses strictly necessary cookies without asking: your login session, your language (NEXT_LOCALE) and your cookie choice (sm_consent, kept for 12 months). Everything else is used only if you accept it in the cookie banner:

• Analytics: a random identifier in your browser's storage (sm_anon_id) for usage statistics, not linked to your account.
• Marketing: a cookie (sm_attr, up to 90 days) that remembers the campaign, referring website and page of your first visit. If you sign up, it is saved with your account once your email is confirmed.

We ask again after 12 months, or sooner if what these categories cover changes. You can change your choice at any time via "Cookie settings" at the bottom of our pages, or here: Cookie settings. Withdrawing a category deletes what it stored in your browser.

Accounts may only be created by people aged 18 or over. Clinics may keep records of minor patients; in that case the clinic is responsible for obtaining the consent of a parent or guardian as required by law.

We will announce material changes in the app or by email before they take effect.

Controller: Vitor Carvalho, trading as BurrowSoft, 297 Moo 1, Baan Sanian, Mueang Nan, Nan 55000, Thailand.
Data Protection Officer (Encarregado): Vitor Carvalho, support@solvymed.com.
Support: support@solvymed.com