Privacy Policy — MyHealth

Version (policy_version): 2.9 Last updated: July 14, 2026 Effective: July 14, 2026. Changes (2.9, 2026-07-14): Optional lock-screen detail (off by default): the adult account holder may enable, on their own records, (a) the medication name and dosage in medication reminders, chosen separately per device; and (b) the vaccine name and dose in vaccine reminders — always as a factual echo of what you recorded, never the purpose, drug class, due-date calculation, booster recommendation, or urgency (Section 12-A). Minor and managed profiles are excluded: a dependent's notice always stays generic ("Reminder for a dependent"). Also in this version: a new refill / low-stock reminder (opt-in, neutral fixed body, under the same consent as medication notifications) and the Section 4 table extended. Legal basis: specific, explicit consent (LGPD Art. 7, I and Art. 11, I; GDPR Art. 6(1)(a) and Art. 9(2)(a)). Triggers re-consent for everyone. Changes (2.7, 2026-07-13): New Data manager (Section 7.2): upon your specific, highlighted consent (LGPD art. 7, I and art. 11, I; GDPR art. 9(2)(a); for Washington/USA residents, the separate consent required by the MHMDA), collected on your device with reinforced identity confirmation, an adult you designate may access and record data in your health record. Revocable at any time, in one tap, with immediate effect. Strictly personal acts (consents, account deletion, links, credentials, purchases, bulk export) are technically blocked for the Manager (on the server and in the app). We keep an audit trail of all the Manager's acts and show it to you, plus an in-app activity summary the Manager cannot turn off. Minors cannot appoint a Manager. Changes (2.6, 2026-07-13): New family sharing of hereditary conditions (Section 7.1), opt-in and item by item: the source enables a tracked diagnosis and linked family members may incorporate it into their own family history through express, item-by-item acceptance. It transmits only the condition, year of onset, and status (minimization locked in code); a permanence notice at the moment of the toggle; one-tap revocation (ex nunc); the recipient may delete the incorporated item at any time; erasure of the source's data de-identifies the origin in the recipient's record. Legal basis: specific, highlighted consent (LGPD art. 11, II, "a"; GDPR art. 9(2)(a)) and, where applicable, a valid authorization under the My Health My Data Act (Washington/USA). Minors' profiles do not participate as a source by their own decision. Changes (2.5, 2026-07-13): Non-sensitive daily contexts (coffee/caffeine, energy levels, hydration, workout perception, and routine changes) become part of the context sent to the AI only in weekly aggregated form (day counts and routine-change category — never the individual daily entry, never free text), under the AI Processing and International Transfer consents (§3.2 and Sections 6 and 9). The Sensitive Health Journal (alcohol, stress/what shaped the night) remains outside the AI. Changes (2026-07-05): in-app support channel (Profile › Support); account number (account_ref); AI-assisted support under consent; support-reply notification (push); email delivery via Apple Private Relay for those who use "Hide My Email". Changes (2.4, 2026-07-05): Sensitive Health Journal — opt-in collection (daily_journal) of daily records of alcohol and of stress/what shaped the night as sensitive data, with its own, prominent consent (off by default, revocable, blocked on the server, unavailable on minors' profiles); these records stay on your device/health record and are not sent to the AI. The mood check-in remains under the general clinical consent.

In short (read this first)

MyHealth is an iPhone app that helps you organize your own health record, with an artificial intelligence (AI) assistant that reads the documents and photos you upload to extract and fill in records (which you confirm before saving) and offers a supportive educational reading. You bring together your lab results, conditions, medications, vaccines, appointments, measurements, and documents in a single place, and the app builds a timeline of your health to prepare you for the conversation with your doctor.

The most important points:

• Who you are is kept separate from your health data. Your name, email, phone, and identification document (such as your tax ID) are stored in an encrypted vault (authenticated field-level encryption — AEAD — deterministic, using the pgsodium library, AES-256) and are decrypted only under your own identity, by a secure function. The clinical tables refer to you only by a code (pseudonym).
• Your data stays in Brazil. The database is hosted in the São Paulo region (sa-east-1).
• The AI receives the clinical content of your health record — without your direct identifiers — and only if you consent. It may include lab results, medications, symptoms, sleep and wearable metrics, your device's events, lifestyle habits you declare (smoking, alcohol, activity, sleep), and menstrual cycle records, plus your sex and age. Name, tax ID, email, and phone are kept encrypted in a separate vault and are not sent to the AI. Your data does not train models. This processing involves an international transfer to the United States (Anthropic). See Sections 6 and 9.
• The account is for people 18 or older. Minors are only included as a profile managed by an adult guardian (Section 11).
• The AI features are paid and consume your usage quota (analyzed pages and AI Chat prompts). There is an initial free courtesy, a subscription that renews the quota each cycle, and add-on packs that do not expire. Purchases are processed by Apple (App Store); a minor's AI use is charged to the guardian. See Section 9 and the Terms.
• You're in charge. You can access, correct, export (in the standard health format FHIR R4 and as PDF), revoke consents, and delete your account whenever you want.
• MyHealth is NOT a doctor and is not a medical device. It does not diagnose and does not prescribe. The readings and the AI assistant's responses are educational — you must always confirm with your doctor. To help you prepare for your appointment, the educational reading may explain the meaning and context of your findings (the mechanism, what clinical practice generally investigates, and what is worth bringing to your specialist), but it remains educational information: it never defines your diagnosis, your management, your work-up, or your treatment — that is your doctor's decision.
• Vaccination reminder (minor profiles). For a dependent minor's profile, the educational reading may, based on the recommended immunization schedule (WHO / your country's reference) and the vaccines you have recorded, informatively flag that a vaccine may be pending. It is only an educational reminder to the guardian: the absence of a record in the app does NOT mean the vaccine was not given (it may have been administered elsewhere), it is not a demand nor an individual immunization recommendation, and it must be confirmed on the vaccination card, with the pediatrician, or at the immunization service.

The full text below details all of this and describes your legal rights.

1. Who we are (the Controller) and the DPO

The party responsible for processing your personal data ("Controller" under the LGPD; "Controller" under the GDPR) is:

BAS AI — BAS ARTIFICIAL INTELLIGENCE LTDA

CNPJ: 64.106.409/0001-70

Website: www.bas-ai.com

Address: Rua Gomes de Carvalho, 911, Vila Olímpia, São Paulo/SP, ZIP 04547-003, Brazil

In this document, "MyHealth", "we", or "the app" refer to this Controller.

Data Protection Officer (DPO)

For any privacy and data protection matter, contact our Officer (LGPD Art. 41 / Data Protection Officer, GDPR Art. 37):

Email: dpo@bas-ai.com

Officer's name: Guilherme Kaschny Bastian

Mailing address: Rua Gomes de Carvalho, 911, Vila Olímpia, São Paulo/SP, ZIP 04547-003, Brazil

We adopt the GDPR standard as our global baseline of protection (the most protective standard, applied to all users), even though the launch does not offer the service in the European Union/EEA or in the United Kingdom.

2. To whom this Policy applies

This Policy applies to everyone who uses the MyHealth app, in any country. The app is global and multi-language (Portuguese, English, and Spanish).

The initial launch focuses on Brazil, but, where the law of your country is more protective, it prevails. We treat the LGPD (Law No. 13.709/2018, Brazil) and the GDPR (Regulation (EU) 2016/679) as our minimum standard of protection everywhere, applied to all users. The app is distributed worldwide, except in the European Union/EEA and the United Kingdom, which are outside the launch.

Users in the United States: US-specific supplementary disclosures — the California Privacy Notice (CCPA/CPRA) and the Washington Consumer Health Data Disclosure (My Health My Data Act) — form part of this Policy as supplementary documents, published at https://www.bas-ai.com/myhealth/legal and prevailing, for residents of those jurisdictions, where they are more specific.

Children and adolescents: self-registration is intended for people 18 or older. Data of minors may only be included by a legal guardian, who manages the dependent's profile (see Section 11).

3. What data we collect

We collect only what is necessary for the app to work (the minimization principle). Below is what we collect and where it is stored.

3.1 Identity data (PII) — encrypted in a vault

The following data identifies you directly and is stored in an identity vault (identity_vault), encrypted field by field with authenticated (AEAD), deterministic encryption (the pgsodium library, AES-256), physically separated from the clinical tables. It is decrypted only by a secure function, under your own identity:

• Name (or display name);
• Email;
• Phone;
• Identification document (for example, the CPF/tax ID).

The clinical tables do not contain this data — they refer to you only by a profile code (pseudonym). In the pseudonymized profile we keep only the clinical-demographic minimum needed to interpret the data correctly (for example, biological sex and date of birth/age, important for lab reference ranges).

3.2 Health / sensitive data (PHI)

This is sensitive personal data (health) and receives maximum protection. We collect, as you record or import it:

• Lab results and laboratory markers (values, units, reference ranges, dates);
• Conditions and body systems ("head to toe" line);
• Medications (item, dose, indication, period, prescriber, active/inactive status);
• Allergies and intolerances (substance, category, reaction, severity);
• Vaccines;
• Appointments / encounters;
• Vital signs and bioimpedance — weight, body fat percentage, lean mass, circumferences, blood glucose, blood pressure, heart rate, saturation, temperature;
• Symptoms and complaints;
• Physical activity;
• Documents and reports (PDFs, photos, and text files — lab results, prescriptions, reports, records you submit);
• Family history of health;
• Care team (professionals, area, institution, reason);
• Card / emergency information (blood type, allergies, emergency contact);
• Notes, questions, and messages that you write in the app (including the chat with the AI assistant and the messages you send to our support through the app), to the extent they contain health data.
• Device events — events that your device records: ECG classification (sinus rhythm / atrial fibrillation / inconclusive) with the average heart rate, irregular rhythm and high or low heart rate notifications, atrial fibrillation burden, fall detection, and — when your device offers them — possible-hypertension and low-cardio-fitness notifications. We store the event's classification and metadata — never the raw ECG trace (waveform), which stays only on your device and is not sent to the AI.
• Menstrual cycle and reproductive health — menstrual flow, intermenstrual bleeding, ovulation tests, cervical mucus quality, and pregnancy tests, when you record or import them. Correlated signals, such as basal body temperature, may be imported as vital signs. If you are female and 40 years old or older, the app may, optionally, ask your phase in relation to menopause (still menstruating, in transition, or already in menopause — with the option not to answer); this information is self-declared by you, not imported from Apple Health, and helps the AI better interpret your hormones (for example, FSH, LH, and estradiol). We do not import sexual activity records. This is sensitive data with the same maximum protection as the rest of the health data.
• Lifestyle habits you provide — data you declare, optionally, in the app's cards: smoking (and cigarettes-per-week range), alcohol consumption (and drinks-per-week range), physical activity level, and your perception of your sleep. When you authorize AI Processing (Section 6), these habits are part of the context sent to the AI.

Daily records of sensitive habits (special category). Beyond what you submit, the app may ask, occasionally and optionally, about habits that devices do not measure: a day's alcohol drinks (substance-use data) and what shaped a shorter night — including the options "Stress" (mental-health data) and "Alcohol". Because they involve a substance and a mental state, we treat these records as sensitive / special-category personal data. This is different from the weekly range of smoking/alcohol you declare at registration (the "Lifestyle habits you provide" item, above), which is part of the AI context when you authorize it: here we mean the daily, point-in-time records, which stay on your device and in your health record and are not sent to the AI.

We only collect them after YOUR specific and prominent consent (the daily_journal purpose, which you turn on in Profile › Privacy & consents), separate from accepting the Terms and from the general clinical consent. It is OFF by default — nothing is recorded until you turn it on —, it is blocked on the server until the consent exists, and it is UNAVAILABLE on minors' profiles and managed profiles (blocked in the app and on the server). Declining it does not reduce any other feature of the app.

Mood/wellbeing distinction. The mood check-in ("how you woke up") is handled separately, as health data under the general clinical consent (it does not fall into the sensitive-habit category above) and — like the rest of the health record — may be part of the context sent to the AI under that same clinical consent. The distinction: a day's alcohol drinks and point-in-time stress carry greater stigma and so receive their own consent and stay out of the AI; the mood, a low-granularity aggregated self-report (1–3), follows the general clinical treatment.

Other non-sensitive daily contexts. Occasionally and optionally, the app may also ask about lifestyle and wellness contexts that devices don't measure — for example coffee/caffeine, energy levels, hydration, how your workout felt (light/normal/hard), and routine changes during the week (e.g., travel, a new workout, changes in diet or sleep). Like the mood check-in, these are health data under the general clinical consent and are stored in your health record. When you authorize AI Processing and International Transfer (Sections 6 and 9), these contexts are included in the context sent to our AI provider (Anthropic, USA — Section 9) only in weekly aggregated form, as day counts — for example, "low hydration on 3 days of the week" or "3+ coffees on 2 days"; for routine changes, only the category you reported that week (e.g., "travel") — never the individual daily entry, never free text, limited to recent weeks. The sole purpose is to correlate, in an educational and descriptive way, your habits with your sleep, activity, and exam data — never diagnosis or treatment. Entries in the sensitive health diary (alcohol and stress/evening context) are not included: they remain outside the context sent to the AI and under their own separate consent, and any future AI use of them would require new explicit consent.

When this data refers to a minor in your care, the same protections apply (see Section 11).

3.3 Locality and language (optional, in clear text)

Optionally, to adapt the experience and prepare future features (such as recommending professionals by city), we may store country, state/province, city, and the preferred language. We do not collect a full address, latitude/longitude, or precise location. These locality fields are kept in clear text because the "city" granularity is not, in itself, sensitive data, and they are protected by the same access rules as your account. When you authorize AI Processing (Section 6), your profile's country is part of the context sent to the AI, only to regionalize, in an educational way, emergency guidance and vaccination-calendar guidance (state/province and city are not sent to the AI).

3.4 Account, session, and security data

• Account and authentication: technical account identifiers and session tokens, to keep you securely signed in; two-factor authentication (MFA/2FA via TOTP), when enabled by you.
• Account number (account_ref): a short pseudonymous identifier of 8 random, non-sequential digits, generated by us (not collected from you), shown in your Profile and used by support to locate your account — including when you use "Hide My Email" in Sign in with Apple. It is erased upon account deletion.
• Notifications (push): when you turn on notifications, we store a technical token that your device generates, used only to deliver the app's notices (e.g., when your analysis is ready). It is a delivery identifier — it is not used for tracking, does not train AI, and is not shared with third parties (it only travels through Apple's push service). You control this in the iOS notification permission and in the Notifications button inside the app, and the notice's content is generic, with no health data. One type of notice — "Something new in your data" (optional, off by default) — is triggered when your data (e.g., sleep, resting heart rate, variability) records a new finding; even so, the content stays generic and with no health data whatsoever (the data never travels in the push, and never suggests abnormality or urgency), at most one per day, and never for minors' profiles.
• Access and audit logs (access_log): metadata about who accessed what and when (action, table, origin, source IP address) — metadata only, never the clinical content.
• Consent records (consent_events): which purpose you authorized, the legal basis, the Policy version, and the moment — in an immutable way (see Section 5).
• AI usage and billing: we record metadata of the use of the AI features (function, model, number of tokens) and your usage-quota balance and consumption (pages and prompts) and add-on packs, to operate billing and prevent abuse. These records do not contain the analyzed health content.

3.5 De-identified usage data

We collect minimal stability and diagnostics data (telemetry) — crashes, errors, performance — in a de-identified way and without any health content, to keep the app safe and working (see Section 13). This is internal processing: we do not use analytics SDKs or third-party tracking. As a self-limited minimization measure, we retain this telemetry for up to about 12 months (see Sections 12 and 13).

3.6 What we DO NOT collect / DO NOT do

• We do not sell your data.
• We do not run targeted advertising based on your health, nor do we use third-party trackers that see your health data.
• We do not collect precise location, phone contacts, or microphone. The camera and gallery are accessed only at the exact moment you decide to upload a document (just-in-time permission).

4. Purposes and legal bases

Every processing activity has a legal basis. Because we process sensitive health data, we are especially rigorous: each sensitive purpose is recorded in our consent record with the corresponding legal basis and Policy version.

Legal basis of the clinical core — clarification. The primary basis for processing your health record is your specific and prominent consent (LGPD Art. 11, II, "a" / GDPR Art. 9(2)(a)), consistent with the "sovereign health record" positioning: you authorize, and you may revoke. We reserve a subsidiary basis only for what consent does not cover — information security, data integrity, compliance with a legal obligation, and the very operation of account deletion —, supported by LGPD Art. 7, II and Art. 10 and by GDPR Art. 6(1)(c) and (f). We do not adopt the health protection ground (LGPD Art. 11, II, "f" / GDPR Art. 9(2)(h)): under the GDPR, Art. 9(3) conditions this ground on the presence, in the flow, of a health professional bound by a duty of confidentiality, and there is no doctor in the loop of MyHealth.

5. Consent and how to revoke it

When you authorize a sensitive purpose, that consent is:

• Freely given — the app works in its essentials even if you do not authorize the AI;
• Informed — we explain the purpose on the spot, in plain language;
• Specific and prominent — each sensitive purpose has its own request (not a generic "accept all"), as the LGPD requires for health data;
• Revocable at any time — you can withdraw an authorization in the settings, without losing access to what you have already organized.

Our system only executes an operation if the corresponding consent is active. For example: if you do not authorize "AI Processing", the app does not send anything to the AI — this check happens automatically, on the server (the has_active_consent function), on every operation.

How the record works: each authorization or revocation is recorded as an immutable event in our consent record (consent_events), with the purpose, the legal basis, the language, and the Policy version in effect. Revoking does not erase the consent history — it records a new event that halts future processing of that purpose.

Revocation does not make unlawful processing already lawfully carried out, but it halts the future use of that purpose. You do not lose access to the health record you had already organized.

Sensitive health journal. The daily sensitive collection (alcohol, stress/what shaped the night) has its own consent (daily_journal), off by default: nothing is recorded until you turn it on, and the server blocks writes of these items without the consent active. You may withdraw at any time, just as easily, in Profile › Privacy & consents. When you withdraw: (1) we immediately stop collecting new records; and (2) we delete the alcohol/stress records already collected in those categories.

6. How Artificial Intelligence (AI) processes your data

AI is a central piece of MyHealth (assistant and extraction of data from documents), so we explain it with full transparency. Our AI provider is Anthropic, which acts as a subprocessor.

6.1 The AI receives the clinical content of your health record, without your direct identifiers

• The content sent to the AI is the user's own and is processed only upon your consent (ai_processing).
• The clinical content we send to the AI, without sending your direct identifiers (name, tax ID, email, phone) — replaced by sex, age, and your year of birth (without day/month) and, when available, by your country (only to regionalize, in an educational way, emergency guidance and vaccination-calendar guidance — never the city or precise location) — and without your emergency contacts — may include: lab markers and trends, measurements and bioimpedance, medications, vaccines, allergies, symptoms, appointments and notes, family history, physical activity, sleep data and wearable scores, device events (ECG classification, irregular rhythm, fall, possible hypertension signs, low cardio fitness), menstrual cycle and reproductive data (including the menopause phase, when you provide it), lifestyle habits you provide (smoking and years of use, alcohol, activity, and sleep), the non-sensitive daily contexts in weekly aggregated form (coffee/caffeine, energy levels, hydration, and workout perception, as day counts, and the week's routine-change category — never the individual daily entry, never free text; see §3.2), the blood type and the observations from your emergency card, and the document itself (photo/PDF) when you request AI extraction — before sending, the app attempts to cover (redact), directly on your device, your name, tax ID, email, and phone number printed on the document, and you can cover areas manually; the original file remains intact in your health record and the version sent to the AI is the redacted one, when generated. This automatic redaction is best-effort: it may fail on low-quality photos or handwriting and is not a guarantee of complete removal. We do not send the contacts from your emergency card (name, phone, relationship). Free-text notes written by you or by professionals may, occasionally, contain names — which is why we recommend not entering identifying data in text fields. In the chat with the assistant, the context may additionally include the conversation history itself and the location and the professional recorded in your appointments — items that do not enter the longitudinal analysis of the health record.
• Web search exists only in the assistant chat, for general clinical knowledge. We instruct the model to use only generic clinical terms, without including your values, dates, age, names, or identifiers. This protection is applied by instructing the model and not by an infallible technical filter; the search is run by Anthropic's infrastructure. The health-record analysis and document-extraction functions do not perform web search.

6.2 We DO NOT use your data to train AI

• Under Anthropic's commercial terms, your data (inputs and outputs) is not used to train or improve models and is retained for a limited period and then deleted (as a rule, within 30 days), except for retention required by law or to prevent abuse. This relationship is supported by a DPA + SCC (Modules 2/3, UK IDTA, Swiss addendum) in effect through Anthropic's Commercial Terms.

6.3 Technical safeguards

• Traffic with the AI uses an encrypted (TLS) connection.
• We apply safeguards against prompt injection and minimization of the content sent.
• The AI does not make automated decisions about you within the meaning of GDPR Art. 22 / LGPD Art. 20: it organizes and describes, it does not decide, diagnose, or prescribe. You review and confirm the information, and the readings come marked as content to confirm with your doctor.
• The AI does not detect, monitor, or diagnose the risk of suicide, self-harm, or psychiatric crisis, and does not alert anyone on your behalf. If you are in crisis, seek immediate help (in Brazil, CVV 188, 24h, free; outside Brazil, the national prevention line). See Section 3.5 of the Terms of Use.

6.4 Open standards and vocabularies (LOINC® / UCUM)

So that the same test coming from different laboratories (with different names, abbreviations, and languages) is recognized as a single parameter and produces a coherent timeline, MyHealth normalizes markers using the open vocabulary LOINC® (Logical Observation Identifiers Names and Codes) and standardizes units of measure based on UCUM. These standards are licensed reference content embedded in the app — they work like a dictionary and receive none of your personal data (Regenstrief Institute is not a sub-processor and nothing from your record is sent to it).

This product includes content from LOINC® (loinc.org). LOINC is copyright © 1995–2024, Regenstrief Institute, Inc. and the LOINC Committee, and is available at no cost under the LOINC license (loinc.org/license). LOINC® is a registered trademark of Regenstrief Institute, Inc.

6.5 Organizing medications and supplements (derived data, AI-assisted)

To organize your record, the AI may produce, from the medications and supplements you log, a derived organizational datum: the decomposed active ingredients (a compounded formula is split into its label ingredients) and a general category; the canonical vaccine, the disease prevented, and the dose in the series (consolidating the same vaccine under different names); and the normalized allergen and its class. This datum is generated from what you already provided (we collect nothing new from you) and serves to relate, for example, an active ingredient to the corresponding marker in your lab test. It is educational and AI-assisted — you can review and correct it, and it is not a clinical classification, a prescription, or interaction checking (see the Medical Notice, item 5.2). AI processing details follow Sections 6.1–6.3.

6.6 Document awaiting available quota/usage

When billing is active and you do not have enough available quota or usage at the moment of upload, a document already redacted (after the on-device redaction described in 6.1) may be stored, without analysis, until subscription quota or an add-on pack becomes available — and is then analyzed automatically. The document waits in your own health record, under the same security and access protections as your account; nothing is sent to the AI while the AI Processing consent (ai_processing) is not active and there is no available usage.

6.7 AI-assisted support

When you talk to our in-app support (Profile › Support) and an agent uses AI assistance to draft the reply, the text of your support conversation — which may contain health data you write — may be sent to the AI (Anthropic, United States) only to prepare a draft reply, which a human agent reviews before sending. The support AI does not access your health record. This sending occurs under the same safeguards as the rest of AI Processing (SCC/DPA, no use for training, retention of about 30 days) and only when your AI Processing (ai_processing) and International transfer (intl_transfer) consents are active — if they are not, the agent replies without AI assistance. Unlike documents, the support text is not redacted automatically — so avoid including unnecessary data (name, ID document, contacts) in your support messages.

6.8 The Sensitive Health Journal is NOT sent to the AI

The Sensitive Health Journal is NOT sent to the artificial intelligence. Your alcohol and stress/what-shaped-the-night records stay on your device and in your health record and are not part of the context sent to our AI provider (Anthropic, United States). Any future use of these records by the AI would require a separate, explicit consent ("include my daily records in the AI analysis"), which does not exist in this version. This differs from the non-sensitive daily contexts (coffee/caffeine, energy levels, hydration, workout perception, and routine changes), which are part of the AI context only in weekly aggregated form — day counts and the routine-change category — as described in §3.2.

6.9 Progress reports and follow-up decisions

When you record the evolution of a tracked item as your own report (Terms, Section 9.7), we store in your health record the report text, the decision (keep or close follow-up), the date, and the version of the text you confirmed, in an immutable trail (correcting = a new entry). These reports become part of the context sent to the AI explicitly marked as a patient report — the AI is instructed to treat them as a report ("you reported that…"), never as a documented clinical fact, and it is technically prevented (server-side validation, not just an instruction) from closing or superseding an item based on a report without your express decision. All of this operates under the already-active Clinical Processing, AI Processing, and International Transfer consents; the copy sent to the AI follows the same identifier-redaction pipeline as the rest of your record.

Minimization: to record a report, professionals' names are optional — the report works equally well without identifying who made the assessment; we recommend including only what is necessary.

Export and deletion: reports and decisions are part of your health record — they are included in the export and erased upon account deletion, through the same dual-track process of Section 12.

Minors: on minors' profiles, entries are made by the legal guardian, in representation, and the entry identifies the guardian who made it; relevant closures are communicated to the other guardians linked to the profile.

7. Family sharing (opt-in, read-only, revocable)

MyHealth lets you share your health record with a family member, in a controlled way:

• It is opt-in: nothing is shared unless you initiate and authorize it (family_sharing).
• Access is read-only and to the entire health record (all or nothing — it is not possible to share only parts): the family member can view, but cannot edit or delete.
• The link is created by a single-use invitation code, which expires in 7 days if not used.
• You can revoke the link at any time, ending the access.

The family member must also be a user of the app. This sharing is between you and the person you choose — it is not sharing with third parties or for commercial purposes.

7.1 Item-by-item sharing of hereditary conditions

In addition to the read-only link above, you may choose, item by item, to offer health conditions tracked in your record (for example, a diagnosis and its year of onset) to linked family members, so they can add them to their own family history. How it works:

• Double authorization: the item is only offered if you enable it, and it is only incorporated if your family member expressly accepts it, item by item (never in bulk).
• Minimization locked in code: only the condition, the period (year of onset), and the status are transmitted — never exams, documents, values, medications, free text, attachments, or routine. The database rejects any content beyond these fields.
• Permanence notice: at the moment you enable each item, we show the named item, who can receive it, and the notice that, if you deactivate it later, what a family member has already accepted remains in their record. We log your consent (who, when, and the version of the text displayed).
• Permanence rule (ex nunc revocation): revocation takes effect from that moment on and does not affect incorporations already accepted by your family members, which become health data of their respective subjects (family history) — as if they had noted it from memory. Deactivation immediately removes the offer for all linked family members, in one tap, free of charge and with no justification required.
• Deletion by the recipient: the family member may delete the incorporated item at any time, and it is included in the family member's own data export and erasure.
• De-identification upon the source's erasure: if the source requests erasure of their data or deletes their account, we remove from the family member's record every reference to the source's identity and account, keeping only the degree of kinship, condition, and period (LGPD art. 18, VI; GDPR art. 17).
• Minors: minors' profiles do not participate as a source by their own decision; the management of minors' data follows the legal-guardian mechanism.

Legal basis: processing based on your specific, highlighted consent (LGPD art. 11, II, "a"; GDPR art. 9(2)(a)) and, where applicable, upon a valid authorization under the My Health My Data Act (Washington/USA). The incorporated item is treated as sensitive data of the recipient themselves throughout the pipeline (including AI, export, and erasure), under the recipient's own active consents.

7.2 Manager authorized by you (delegation by an adult)

Upon your specific, highlighted consent (LGPD art. 7, I and art. 11, I; GDPR art. 9(2)(a); for Washington/USA residents, the separate consent required by the MHMDA), an adult you designate (the "Manager") may access and record data in your health record. How this processing works:

• Consent on your device, with reinforced identity: the authorization can only be granted by you, on your device, after reinforced identity confirmation; we log who consented, when, and the version of the text displayed.
• Legal basis: your consent, revocable at any time with immediate effect, in one tap, free of charge and without justification; the Manager only learns that the link changed, never the reason. Revocation immediately ends the management powers; the read-only link remains until you also remove it (both options are shown side by side in the app).
• Strictly personal acts technically blocked: the Manager cannot change your consents, delete your account, create/change/remove sharing or links, change your credentials, make purchases on your behalf, or bulk-export your record — the block on consents, account deletion, links, and credentials is enforced server-side (database access rules); the block on purchases and bulk export is enforced technically in the app.
• Audit trail: we keep an immutable authorship record of everything the Manager creates or edits in your record and show it to you, plus an in-app summary of their activity, which the Manager cannot turn off. These records are retained for the same period as the health record.
• Ownership: what the Manager records is your data and remains in your record after revocation, under your consents and rights (access, export, erasure).
• Minors: minors' profiles cannot appoint a Manager; the management of minors' data follows exclusively the legal-guardian mechanism.

8. Apple Health (HealthKit)

MyHealth lets you import measurements from Apple Health (HealthKit) — weight, height, body composition, blood glucose, blood pressure, heart rate, saturation, and temperature, plus day-to-day metrics when your device offers them, such as sleep breathing disturbances, time in daylight, and mindfulness sessions — and, when you authorize them in the iOS permissions, also menstrual cycle and reproductive health data (menstrual flow, intermenstrual bleeding, ovulation tests, cervical mucus quality, and pregnancy tests) into your health record. We do not import sexual activity records.

Cycle patterns (its own opt-in, off by default). If you turn it on in Profile › Privacy, the app can show your logged cycle days alongside your charts (sleep, heart) and observe local, descriptive patterns (for example, how your sleep behaves on logged menstruation days). It is a composition, on your device, of data you already see: none of it becomes a notification, nothing is sent to the AI beyond what you already authorized, and the app never calculates or predicts fertility/ovulation. Unavailable on dependents' profiles; revocable at any time (the pattern simply stops being shown).

• The import is optional and happens only with your explicit authorization, granted in the iOS permissions. Access is read-only — MyHealth does not write data to Apple Health.
• Data coming from Apple Health is used exclusively to enrich your own health record within the app.
• In compliance with Apple App Store Guideline 5.1.3, Apple Health data is NEVER used for marketing/advertising, is NEVER shared with third parties for advertising purposes or data mining, and is NEVER used to train AI models.

Connecting smart bands and rings (Oura and WHOOP)

In addition to Apple Health, you may, optionally and revocably, connect third-party wearables, with specific consent per provider (wearable_sync_oura, wearable_sync_whoop):

• Oura Ring: sleep and sleep stages, daily scores (sleep, readiness, activity, stress, resilience), temperature deviation, steps, calories, distance, sedentary time, SpO2, sleep breathing disturbance index, VO2max, cardiovascular age, workouts, and meditation sessions.
• WHOOP: recovery score, resting heart rate, heart rate variability (HRV), SpO2, skin temperature, strain, sleep, and workouts.

The authorization uses OAuth: the access tokens are encrypted (AES-256-GCM) on our server and are not accessible by the app. Oura operates in Finland (European Economic Area) and WHOOP in the United States; connecting these services involves an inbound international transfer, under the safeguards in Section 9.1. Oura and WHOOP act as data sources (independent controllers of their own platforms), not as our subprocessors, and do not receive data from your health record.

When you disconnect a wearable:

• WHOOP: to comply with the WHOOP API's terms of use and as a matter of the privacy standard we adopt, we request the revocation of access at WHOOP and permanently delete all data originating from WHOOP already synced (sleep, scores, measurements, activities, and events). We recommend exporting beforehand if you want to keep a copy.
• Oura / Apple Health: we revoke access and delete the encrypted tokens we hold. Data already synced remains in your health record, unless you request its deletion.

Data imported from wearables and from Apple Health is always recorded in your own health record (account holder) and never in a dependent's profile, even if you are viewing a minor's profile.

9. Subprocessors and international transfers

We do not sell your data. To operate the service, we use a minimal set of vendors ("subprocessors"/"processors"), each under a data processing agreement (DPA) in effect, confidentiality, and security, processing data only under our instructions. The three subprocessors below have DPAs/SCCs in effect: Supabase (signed 2026-06-18), Anthropic (via Commercial Terms, 2026-06-17), and Resend (via EU-US DPF + SCC, 2026-06-17).

Oura and WHOOP do not appear in this table: they are data sources that you connect (Section 8), acting as independent controllers of their own platforms, and not as our subprocessors. Apple acts as an independent controller for distribution, HealthKit, push, and payments. The DPAs and Standard Contractual Clauses (SCC) of our three subprocessors (Supabase, Anthropic, and Resend) are in effect, as indicated in the "Safeguards" column. We maintain a public subprocessors page kept up to date at https://www.bas-ai.com/myhealth/legal/subprocessadores. We will give notice before adding a relevant new subprocessor.

9.1 International transfers

Your health record is stored in Brazil (São Paulo) — that is the rule. Transfers outside Brazil occur in a limited way and with your authorization (intl_transfer): in AI processing (Anthropic, United States — Section 6), in which we send the clinical content without your direct identifiers (in document extraction, the file itself — after a best-effort on-device automatic redaction that attempts to cover name, tax ID, email, and phone; identifiers not located may remain in the file); in the connection of wearables (Oura, in Finland/EEA; WHOOP, in the United States — Section 8); and in distribution by Apple (United States). When there is an international transfer, we adopt the required safeguards:

• LGPD (Art. 33): transfer based on specific consent and/or on adequate contractual guarantees (standard clauses), as regulated by the ANPD.
• GDPR (Art. 44–49): Standard Contractual Clauses (SCC) and/or other adequate guarantees for transfers outside the EEA, with a transfer impact assessment where applicable.

We may also disclose data when required by law (court order or competent authority), always limited to what is strictly necessary and, where legally permitted, notifying you.

10. Information security

The confidentiality of your health data is our number one control. The main measures:

• Separation between identity and clinical data: who you are (name, email, phone, document) stays in an encrypted vault (identity_vault) with authenticated (AEAD), deterministic field-level encryption (pgsodium, AES-256), separated from the clinical tables, which refer to you only by a code.
• Controlled decryption: PII is decrypted only by a secure function, under your own identity, with an audit record.
• Encryption at rest and in transit: encrypted database and storage; communications over TLS.
• Row-level access control (RLS) per verb: the database ensures that only you (or an authorized guardian/family member) access your data — and the read and write permissions are separated.
• Two-factor authentication (MFA/2FA via TOTP): available to strengthen access to your account.
• Versioned consents and an immutable audit record (access metadata only, never the clinical content).
• AI safeguards: removal of the direct identifiers (name, tax ID, email, phone) from the context sent, non-sending of the emergency card's contacts, content minimization, and protection against prompt injection.

We seek alignment with the best international practices for health information security. No system is 100% immune; that is why we maintain incident response plans (see Section 14).

11. Data of children and adolescents (minors)

The protection of children and adolescents follows the Statute of the Child and Adolescent (Law 8.069/1990), Law 15.211/2025 (Digital ECA), Art. 14 of the LGPD, and Art. 8 of the GDPR (EEA).

• Self-registration is intended for people 18 or older (or the country's age of civil majority, if higher).
• The minor has no account or email of their own: they exist only as a managed profile within an adult guardian's account (the managed_by field), who declares this condition.
• The profile may have more than one guardian: the primary guardian invites another adult by an invitation code with an expiration date. Each invitee receives a role: guardian (views and edits) or companion (read-only). Every authorization is verified on the server, on each operation.
• The consent relating to the minor is recorded identifying which adult granted it, observing the best interest of the child and adolescent (LGPD Art. 14).
• Paid AI features require the guardian role and are charged to the primary guardian (the profile's paying holder), regardless of which guardian triggered them; the usage record remains linked to the minor's profile for audit purposes.
• We apply the same maximum protection to this data (identity vault, RLS, AI non-training). We do not target advertising to minors. Wearable data never follows a minor's profile.
• The guardian may, at any time, export the dependent's data and, as the primary guardian, permanently delete the dependent's profile and all associated data (exams, documents, and records) — this deletion is permanent.

We adopt, in any country, a single 18-year-old threshold for a self-owned account. This requirement refers to account ownership and is not to be confused with the GDPR's age of autonomous digital consent (Art. 8, between 13 and 16 years old depending on the country). Below 18, data processing only occurs through a profile managed by an adult guardian.

Users in the United States (COPPA): MyHealth does not offer accounts to minors and does not collect data directly from children. Any minor's data is entered and controlled by a responsible adult, who exercises verifiable parental consent.

Sensitive journal unavailable to minors. The daily sensitive collection (alcohol, stress) is not performed on minors' profiles or on profiles managed by a guardian — blocked on the client and on the server. It is a feature exclusive to adult account holders (18+). Under no circumstances do we collect alcohol/stress records from minors.

12. Retention and disposal

We adopt the minimization principle: we keep each category of data only for as long as needed for its purpose or required by law. Because MyHealth is distributed worldwide, we apply the most protective standard among the applicable laws: by default, deletion erases your identity, and retention is the exception, triggered only when a concrete law requires it.

12.1 Retention periods

How identity is protected when retained: when there is a transaction and tax law requires retention, we keep the name and email encrypted (the same protection as the identity vault), in an isolated table, accessible only by the internal service (RLS, no user access), and we delete it automatically at the end of the period. We do not keep your email in readable text.

Retention of the sensitive journal. While the consent is active and the account exists, the Sensitive Health Journal records (alcohol, stress/what shaped the night) remain in your health record. When you withdraw the consent, they are deleted; when you delete the account, they follow the dual-track deletion (Section 12). There is no tax retention of this data.

12.2 Permanent account deletion (right to erasure — LGPD Art. 18, VI / GDPR Art. 17 / local equivalents)

Deletion is available directly in the app, under Profile › Privacy › Delete my account (an Apple requirement). Upon confirmation, we execute the permanent cascade removal — an immediate operation — of all of your clinical health record (lab results, conditions, medications, vaccines, documents, measurements, history, appointments, conversations with the AI, wearable data) and of the files in storage, we revoke the wearable connections, and we close your access account.

Managed dependents and guardianship migration. Deleting your account also erases the data and files of the dependents you manage (minor profiles in your care). Before completing, if a minor has another guardian already linked, the app offers to migrate that minor's guardianship to the existing co-guardian — so the minor's profile survives with them, instead of being erased. If you choose not to migrate, the dependent's profile is removed together with your account. In any case, we never retain the minor's name or email for tax reasons (see below).

The backups may, for a short period, still contain data already deleted: they are overwritten in our processor's normal cycle (Supabase, around 14 days — well within the 6 months), and the data processing agreements (DPAs) with Supabase and Anthropic govern the disposal of any residual copies. (We do not claim "key destruction" or instant backup purging.)

The deletion of your identity depends on whether or not you made a purchase:

• If you never made any purchase (subscription or packs): we also erase your name and your email upon deletion. We do not create any identity record that survives. For you, deletion is the actual cessation of the processing of your identity.
• If you made at least one purchase: the tax/accounting law of your country requires us to keep the transaction record for a period (in Brazil, 5 years). For that, we keep a minimum accounting record and, where it is indispensable to link it to you, your encrypted name and email — isolated, accessible only upon a judicial request or that of a competent authority, and deleted automatically at the end of the legal period.

Deletion receipt (accountability — LGPD Art. 6, X): we can confirm the completion of the deletion upon request to the DPO. The deletion is not total — the minimum records below remain, by legal requirement.

What always remains after deletion, for any user:

• A minimum deletion record, without any personal data and with your identity replaced by an irreversible code (which does not allow re-identifying you), only to prove that the deletion occurred.
• Access logs for the 6-month retention period (12.1), provided only upon a judicial request or that of a competent authority.
• Consent records de-linked from your profile (we replace the identifier with a pseudonymous code, separated by a key that is not kept in the database), kept only as proof of lawfulness for the limitation period. We treat this as pseudonymized data, not as irreversibly anonymous data.
• Optional — research: if, and only if, you authorize it at the moment of deletion, we keep your markers in a pseudonymized way — without a name, without a profile identifier (profile_id), without free text, and without an exact date, keeping only sex, age range, and the year, in random cohorts. We treat this as pseudonymized data, and not as irreversibly anonymous data: re-identification is unlikely, but we do not declare it impossible. You may decline and still delete the account.

Dependent profiles (minors): when deleting a minor's profile, we never retain the minor's name or email for tax reasons — the tax obligation, if any, belongs to the paying guardian, not to the minor's profile. For the minor, erasure of the identity is the rule; only the minimum deletion record by irreversible code remains.

Users in jurisdictions with a reinforced right to deletion (e.g., Washington — My Health My Data Act): we treat the request as deletion of consumer health data — we erase the identity (without invoking the tax period against anyone who did not transact), and the disposal of residual copies at the processors occurs within 6 months, in accordance with the respective data processing agreements (DPAs).

12.3 Death of the data subject

The LGPD and the GDPR protect living persons and, as a rule, do not reach the deceased (ANPD, Technical Note No. 3/2023; GDPR, Recital 27). Even so, a deceased person's health record involves personality rights that survive death (Civil Code, Art. 12, sole paragraph) and matters of succession.

• The heir does not inherit access to the content of the health record. The Superior Court of Justice (REsp 2.124.424/SP) treated health records as a non-transferable existential asset — tied to the person's intimacy, and not to their estate.
• For this reason, we do not carry out total deletion at the request of third parties (the access logs for 6 months and the tax records for 5 years still remain — 12.1), nor do we hand over the clinical content to heirs as if it were an inheritance.
• Requests related to the death of a data subject (for example, to cease processing, or measures provided for in Art. 12, sole paragraph, of the Civil Code by someone with standing) must be directed to our DPO (Section 1), upon proof of the death and of the standing of the requester. We assess each request in light of the applicable law.

12-A. Notifications and reminders (opt-in)

MyHealth may send reminders on your iPhone — about medication, a wellbeing check-in, a weekly check-in (optional, off by default, once a week — a neutral, fixed-text invitation to log what the app can't see on its own, such as activity, symptoms, or energy; it never carries health data or inference), your schedule (appointments/tests/follow-ups/vaccines), and a few server-side notices (when an analysis is ready, when one of your exams is updated, when a follow-up appointment is approaching, when support replies to your message, and when your data — e.g., sleep, resting heart rate — brings something new). Key points:

• Local notifications vs. remote push. Many notifications are LOCAL, scheduled on your own device (medication, wellbeing check-in, weekly check-in, and schedule reminders) — for those we use no push server. Others are delivered by remote push (Apple's APNs) because the event happens on the server, in five cases: (a) an analysis is ready; (b) one of your exams was updated (a marker that was out of range received a new result); (c) a follow-up appointment is coming up; (d) support replied to your message; and (e) your data (e.g., sleep, resting heart rate) recorded something new (optional, off by default — "Something new in your data"; the body never suggests abnormality or urgency) — a generic, fixed-text notice, with no PHI ("Support replied to you — tap to read"; "There's something new in your data — tap to see"), which you can turn off in Profile › Notifications. For remote push we store a technical delivery token from your device (see Section 3.4) and the notice's content is generic, fixed text, with no health data ("One of your exams was updated", "You have a follow-up appointment") — never the test name, marker, value, or doctor. The token is a delivery identifier — it is not tracking, does not train AI, and is not shared with third parties beyond Apple's push service. To avoid bothering you, we cap this at one interruptive notice per day and respect your quiet-hours window; each category can be turned off separately in Profile › Notifications.
• Granular, revocable opt-in. Each type is off by default (medication and check-in) or controlled by you in Profile › Notifications, where you choose what to receive, the times, and the quiet-hours window. You can turn everything off at any time (in the app or in iOS Settings). The legal basis is consent (LGPD Art. 7, I and Art. 11, I; GDPR Art. 6(1)(a) and Art. 9(2)(a)).
• Minimized lock-screen content. By default, the notification never shows lab values, a diagnosis, a disease name, a medication name, a vaccine name, a specialty, or the AI summary. It only says that something exists and where ("Did you take your medications today?", "Your analysis is ready. Tap to view in the app.", "Tomorrow: Appointment", "Tomorrow: Vaccination"). The only exceptions are the medication name (in medication reminders) and the vaccine name (in vaccine reminders) — and only if you turn on the options described below. All other clinical content stays inside the app only. Optional notices derived from your data (e.g., the "daily headline") use a closed list of fixed phrases that may name the data's domain (e.g., "Your night brought new data", "your weekly activity goal") — never the value, the direction, a comparison with your usual, or any judgment. Remember the lock screen can be seen by others and read aloud by Siri — that's why iOS lets you hide previews (Settings › Notifications › Show Previews: When Unlocked).
• Medication name on the lock screen (optional, off by default, per device). By default, medication reminders are neutral and never show the item's name or dose. You can choose to display the name and dosage in notifications ON THIS device — for example, "Losartan 50 mg · breakfast". This is your explicit choice: it is off by default, applies only to YOUR OWN medications, is set separately on each of your devices (turning it on on one iPhone does not turn it on on another), and can be turned off at any time, effective immediately — when off, already-scheduled reminders return to neutral. The text shows only what you entered — name, dose, and the moment/label — and NEVER the purpose, the drug class, the condition treated, interactions, or any clinical or urgency judgment. Because this displays HEALTH DATA on a surface others can see, that Siri can read aloud, and that can be mirrored to your other devices (Apple Watch, CarPlay, speakers, notification history), it relies on its own separate, highlighted consent, distinct from the clinical consent, and is not part of "Accept and continue". You'll find it in Profile › Notifications and can additionally hide previews in Settings › Notifications › Show Previews: When Unlocked. Legal basis: specific, explicit consent (LGPD Art. 11, I; GDPR Art. 9(2)(a)). Reminders from DEPENDENT (minor) profiles and from MANAGED profiles NEVER show the name or dosage on the lock screen, even when this option is on — for them the notice stays generic ("Reminder for a dependent").
• Vaccine detail in the reminder (optional, off by default — your own adult profile only). In Profile › Notifications you may enable "Show the vaccine detail in the reminder" so that your vaccine reminders — and only those — show the vaccine name and dose on the lock screen (e.g., "Tomorrow: Influenza · annual dose"). Even when on, the reminder stays an echo of your own record (the name and dose you saved): it is never a booster recommendation, an individual due-date calculation ("overdue", "due in X"), or an urgency alert, and it never shows the doctor, the location, or the reason. No other notice changes — exams, analyses, medication, and appointments stay neutral. Because a vaccine name is health data (special category / sensitive data) and can reveal a sensitive context, and because the lock screen can be seen by others and read aloud by Siri, this option is off by default, relies on your specific, prominent consent, separate from accepting the Terms (legal basis: GDPR Art. 6(1)(a) and Art. 9(2)(a); LGPD Art. 7 I and Art. 11 I), and can be turned off at any time, effective immediately; iOS still lets you hide previews. Minor and managed profiles are excluded: a dependent's vaccine reminder always stays generic ("Reminder for a dependent") and never exposes the vaccine name or the minor's name — in the child's best interest (LGPD Art. 14; GDPR Art. 8).
• Reply right from the notification. You can answer certain reminders in the notification itself (e.g., "Took all" / "So-so"). Those answers are health data (medication adherence, wellbeing) stored in your record with the same protection as your other health data; none of it appears on the lock screen.
• Minors and managed profiles: when the reminder is for a dependent's profile or for another person you manage, the notice on your device is always generic ("Reminder for a dependent") and never exposes that person's name, dosage, or any health data. The options to show a medication name or a vaccine detail on the lock screen apply only to your own records and never to those of dependents or managed profiles — this applies to vaccine reminders as well, which never display a dependent's vaccine name.
• Refill / low-stock reminder (opt-in, off by default). If you record the quantity on hand of an item in your routine (a medication or supplement), the app can tell you, on your own device (a LOCAL notification, with no sending server), that an item in your routine is running low — so you can restock whenever you like. This is inventory logistics, computed on your device from data you already recorded (the quantity) and your dose schedule: we collect nothing new and it is not a clinical recommendation — it does not claim that running out is risky, suggests no abnormality, and does not tell you to restock urgently. The body is neutral, fixed text ("An item in your routine is running low"): it never includes the item name, dose, quantity, or "days remaining" — the detail (which item, how much is left) stays inside the app only. It runs under the same consent as medication notifications (opt-in, off by default) and fires only while that consent is active; it can be turned off in Profile › Notifications, with the same cap of one interruptive notice per day and the same quiet-hours window. Legal basis: consent for a notice derived from health data (LGPD Art. 7, I and Art. 11, I; GDPR Art. 6(1)(a) and Art. 9(2)(a)), like the other medication reminders. On dependent profiles the minors rule applies: the notice on the guardian's device is generic ("Reminder for a dependent") and never reveals the minor's name, which item, or that it is a medication/supplement.
• Recheck and update reminders are educational and universal. Some reminders flag that it may be time to repeat a routine test, update a record (e.g., weight), or check a follow-up/device. They are based only on generic reference intervals (e.g., routine tests are usually repeated periodically) and on the dates of your own records — we collect nothing new, and the app does not compute an individual interval from your result. They are not an individual clinical recommendation: the right interval should be confirmed with your doctor.

13. Cookies, telemetry, and tracking

MyHealth is a native iPhone app (not a website), so it does not use browsing cookies in the traditional sense.

• De-identified technical telemetry: we collect minimal stability and diagnostics data (crashes, errors, performance), without health content, to keep the app safe and working. This is internal processing: we do not embed any analytics SDK or any third-party tracker. As a self-limited minimization measure, we keep this telemetry for up to about 12 months (see Section 12).
• No third-party trackers with access to health data and no sale of data. We do not track across apps/sites for advertising purposes.
• App Store privacy labels: our App Store declarations reflect what is described here.

Today we do not use any third-party analytics or tracking tool; if that changes, we will update this Policy and the subprocessors page before activation, with a new notice — also reviewing the App Store privacy labels and the need (or not) for App Tracking Transparency (ATT).

14. Security incidents and notification

We maintain incident response plans. In the event of a security incident that may create relevant risk to you:

• LGPD (Art. 48): we will communicate to the National Data Protection Authority (ANPD) and to you, within a reasonable period, indicating the nature of the incident, the data affected, the measures adopted, and the recommendations for you to protect yourself.
• GDPR (Art. 33–34): we will notify the competent supervisory authority, as a rule within 72 hours, and we will communicate to you when there is a high risk to your rights and freedoms.

15. Your rights

You are the owner of your data and have rights guaranteed by the LGPD (Art. 18) and the GDPR (Chapter III):

How to exercise: many rights are exercised directly in the app (review, export, delete, revoke consent). For the others, or if something does not work, write to our DPO (Section 1). We respond within the legal period (as a rule, up to 15 days for confirmation of existence or access, under the LGPD; up to 30 days under the GDPR, extendable where the law permits).

Complaints: if you believe we process your data improperly, you can complain to the competent authority — in Brazil, the ANPD (https://www.gov.br/anpd); in Europe, the data protection authority of your country. We ask, however, that you talk to our DPO first — we want to resolve it directly with you.

16. MyHealth is NOT a medical service

• MyHealth is a tool for organizing and educating about your own health, which prepares you for the appointment with health professionals and offers a supportive educational reading by AI.
• It does NOT diagnose, does NOT prescribe treatment, and does NOT replace the assessment of a doctor or qualified health professional.
• The readings and the AI assistant's responses serve to bring questions and information to your doctor — you must always confirm with your doctor before any decision.
• MyHealth is not a medical device (it is not "SaMD") and must not be used as one.
• In an emergency, seek medical care immediately — do not use the app for that.

17. Changes to this Policy and versioning

We may update this Policy to reflect changes in the app, in vendors, or in the law. The Policy has a version (policy_version):

• The app collects your acceptance at registration, tied to the version in effect;
• We update the version and the date at the top when there is a change;
• We notify you in the app and/or by email; and, when the change requires it, we will ask for a NEW acceptance — the app requires a new acceptance when the version changes — recording it immutably in our consent record.

The version history is published at https://www.bas-ai.com/myhealth/legal/versoes; each accepted version remains archived.

18. Contact us

Questions, requests, or complaints about your data:

• Officer/DPO: dpo@bas-ai.com
• In-app support: Profile › Support — the channel for usage questions, technical issues, and requests about your account.
• Account number: you can find it under Profile; give it to support so we can locate your account faster (including if you use "Hide My Email" in Sign in with Apple).
• Controller: BAS ARTIFICIAL INTELLIGENCE LTDA — CNPJ 64.106.409/0001-70 — www.bas-ai.com — Rua Gomes de Carvalho, 911, Vila Olímpia, São Paulo/SP, ZIP 04547-003, Brazil
• Subprocessors page: https://www.bas-ai.com/myhealth/legal/subprocessadores

MyHealth — your health record, sovereign and private. This Policy was drafted in Portuguese as the basis for translation into the app's other languages (at least PT/EN/ES). In case of divergence between versions, the Portuguese prevails.