Privacy Policy

This Privacy Policy describes how Oficial Saúde collects, uses, stores and protects personal data of users of the Oficial Saúde app, the Oficial Band smartband and the oficialsaude.app website, in compliance with Brazil’s General Data Protection Law (LGPD — Law 13.709/2018).

By using our services, you declare that you have read and understood this Policy. If you do not agree with these terms, we recommend not using the app.

We collect only the data needed to operate the health, fitness, nutrition and well-being super app:

• Account data — full name, email, phone/WhatsApp, language and profile preferences.
• Health & training data — heart rate, sleep, blood pressure, SpO₂, workouts, loads, body measurements and nutrition, captured by the app and the Oficial Band.
• App usage data — screens viewed, interactions and error diagnostics, in aggregate, to improve the product.
• Technical data — device model, operating system, device identifiers, IP address and access logs, collected automatically for security and app operation.

Health data is sensitive data (LGPD, art. 11) and is processed only with your explicit, revocable consent. Nothing is public by default: Social Health Share shares only the metrics you choose, with people you authorize, and can be turned off anytime.

• Build your Human Digital Twin — and personalize training, plans and health recommendations.
• Trigger alerts and insights — about heart, sleep, blood pressure and recovery.
• Authenticate your access — and keep your account secure.
• Send operational notifications — about beta invites, confirmations and product news.
• Provide support — and respond to your requests.
• Meet legal and regulatory — obligations before competent authorities.
• Improve the experience — through aggregated, anonymized usage data.

Oficial Saúde does not sell personal data — and never sells health data. Sharing happens only when needed for operation:

• Authorized followers — on Social Health Share, only the metrics you choose to share.
• Service providers — cloud infrastructure, notification and email delivery tools, under contracts requiring confidentiality and LGPD compliance.
• Public authorities — when required by law, court order or health regulation.

We adopt appropriate technical and organizational measures to protect your data, with layers of encryption and device integrity verification:

• Encryption in transit — TLS 1.3 on every connection between app, Oficial Band and servers.
• Encryption at rest — databases and backups protected with AES-256.
• Keys & biometrics — keys stored in Secure Enclave (iOS) and Android Keystore; your biometrics never leave the device.
• Device Attestation — Apple App Attest and Google Play Integrity cryptographically prove each request comes from a genuine device and an untampered app before your data is released. Compromised devices are blocked.

No system is absolutely immune to incidents. If a security incident may pose relevant risk to data subjects, we will notify those affected and the Brazilian Data Protection Authority (ANPD), as required by the LGPD.

We keep your personal data only as long as needed to fulfill the purposes of this Policy, observing legal retention periods — such as access logs (minimum 6 months, per the Brazilian Internet Civil Framework).

You can export a copy of your data and request permanent deletion in the app or via our contact channels: completed within 30 days, including backup removal in the next cycle. After these periods, data is securely deleted or anonymized.

Under art. 18 of the LGPD, you may request at any time:

• Confirmation — that processing exists and access to your data.
• Correction — of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion — of unnecessary or excessive data.
• Portability — of data to another service provider.
• Deletion — of data processed based on your consent.
• Information and revocation — about sharing performed and withdrawal of consent.

Requests are handled within the deadlines set by the LGPD, through the channels listed in the contact section.

Our website may use cookies essential to its operation and analytics cookies, with aggregated data, to understand page usage. You can manage cookies in your browser settings. The app may use device identifiers exclusively for authentication and notifications.

The Oficial Saúde app is intended for people aged 18 or older. Data of minors, when provided by a legal guardian, is processed exclusively in the minor’s best interest, as per the LGPD.

This Policy may be updated periodically to reflect legal or operational changes. The current version will always be available on this page, with the effective date shown at the top. Relevant changes will be communicated through the app or by email.

To exercise your rights or ask questions about this Policy, contact our Data Protection Officer:

• Email — dpo@oficialsaude.app
• WhatsApp — +55 21 99203-8986
• Website — oficialsaude.app/contato