Privacy policy

This policy explains how VYKA, operated by Novigo Tecnologia, handles personal data on the video care platform, in accordance with Brazil's General Data Protection Law (Law No. 13,709/2018, the LGPD). Health data is sensitive personal data and receives extra care.

Who is responsible for your data

For registration and platform usage data, Novigo Tecnologia is the controller.

For clinical information recorded during care, the professional or institution that treats you, such as a health consortium, a city hall or a clinic, decides how it is used. In that case, VYKA acts as processor and handles the data only to provide the service, following that party's instructions (LGPD, arts. 5 and 39).

The data protection officer can be reached at [email protected].

What data we collect

We collect only what is necessary for care, as required by the necessity principle (LGPD, art. 6, III).

• Registration: name, CPF or e-mail, date of birth, phone and municipality.
• Care: date, time, professional, specialty and booking status, plus the documents and notes the professional records.
• Access: IP address, date and time, device and browser type, and the accessibility preferences you set.
• Contact: what you write in the site forms.

What we use it for and the legal basis

Each use has a legal basis provided for in the LGPD.

• Provide care and keep the history of your treatment: health protection, in a procedure carried out by health professionals (art. 11, II, f), and performance of a contract (art. 7, V).
• Send confirmations, reminders and service notices: performance of a contract.
• Maintain security and prevent fraud in identification and access: art. 11, II, g.
• Comply with legal and regulatory obligations, such as keeping access records: art. 7, II.
• Exercise rights in judicial, administrative or arbitration proceedings: art. 7, VI.
• Situations that depend on your consent: we will ask clearly, and you can withdraw it at any time.

We do not sell personal data and do not use it for advertising.

Video consultations

The consultation is not recorded. The conversation takes place between you and the professional, and image and audio travel encrypted between the participants and the consultation server.

The professional may record in the medical record whatever is necessary for your care, as required by the rules of each profession and the rules on telemedicine (CFM Resolution No. 2,314/2022).

Recording or sharing the consultation is only allowed with the authorization of all participants.

Com quem compartilhamos

• With the professional who treats you, for your care.
• With the institution responsible for the care, such as a consortium or city hall, within the limits of the contract and, whenever possible, in aggregate form without identifying people.
• With technology providers, such as hosting, content delivery network and e-mail sending, who process data as processors, under contract and a duty of confidentiality.
• With authorities, when the law or a court order requires it.

We do not share your health data with companies for commercial purposes.

Transfer to other countries

Some technology providers we use, such as hosting and content delivery network, may process data outside Brazil. When that happens, we follow art. 33 of the LGPD and require adequate safeguards.

Por quanto tempo guardamos

• Registration data: as long as your account exists and for the time needed to meet legal obligations.
• Application access records: for at least six months, as required by the Brazilian Internet Civil Framework (Law No. 12,965/2014, art. 15).
• Medical record and care documents: for the periods set by the health rules that apply to the professional or institution. Law No. 13,787/2018, for example, provides for at least 20 years from the last entry before any deletion.

You can ask for your data to be deleted. When the law requires retention, we keep only what is necessary and explain why.

Your rights

The LGPD (art. 18) guarantees you, at any time, the right to:

• confirm that we process your data and have access to it;
• corrigir dados incompletos, inexatos ou desatualizados;
• request anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
• request data portability;
• know with whom the data has been shared;
• know that you may refuse consent and what the consequences are;
• withdraw consent and request deletion of data processed on that basis;
• request review of decisions made solely by automated processing (art. 20).

To exercise any right, write to [email protected]. When the request involves clinical information, we may direct you to the professional or institution responsible. You may also complain to the National Data Protection Authority (ANPD).

Children and teenagers

Care for children and teenagers takes place with the participation of a parent or legal guardian, and data processing observes the best interest of the child or teenager (LGPD, art. 14).

How we protect data

We adopt technical and administrative measures to protect data against unauthorized access and accidental or unlawful situations (LGPD, art. 46), such as HTTPS-protected connections, one-time code access, separation between institutions and profile-based access. When the technical team needs to access data to keep the service running, access is limited and logged. See more on the Security page.

If an incident occurs that may cause relevant risk or harm, we notify the ANPD and the people affected, as required by art. 48 of the LGPD and the ANPD's incident reporting regulation (CD/ANPD Resolution No. 15/2024).

Cookies and browser storage

We only use essential cookies, to keep your session and access secure, and we store your accessibility preferences in your browser. We do not use advertising cookies.

Fundamentos legais

• Federal Constitution, art. 5, X and LXXIX: privacy, private life and protection of personal data, the latter added by Constitutional Amendment No. 115/2022.
• Lei nº 13.709/2018 (LGPD).
• Law No. 12,965/2014 (Brazilian Internet Civil Framework) and Decree No. 8,771/2016.
• Law No. 14,510/2022 (telehealth) and CFM Resolution No. 2,314/2022 (telemedicine).
• Law No. 13,787/2018 (electronic medical record).
• Consumer Protection Code (Law No. 8,078/1990), where applicable.

The Federal Supreme Court recognized personal data protection as an autonomous fundamental right (ADI 6387, 2020), which reinforces the care required when processing health data.

Changes to this policy

We may update this policy. When a change is relevant, we will notify you through the platform's channels. The date of the last update appears at the top of this page.