This policy explains which personal data the Criarti website collects, what it is used for and what you can do about it, under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018).
It covers the website and the contacts you make through it, on WhatsApp or by e-mail. Clinics' use of the Criar Clinic system is governed by the contract signed with each of them.
Who is responsible for your data
The data controller is Criar Tecnologia e Inovação.
Contact for our data protection officer (DPO): contato@criarti.com.br. Use this contact for any privacy matter, including exercising your rights.
What data we collect
- When you submit a form: your name, WhatsApp number and/or e-mail, the subject you chose and your message.
- When you talk to us on WhatsApp or by e-mail: your number or address and the content of the conversation.
- Along with each message: the page it was sent from, the IP address and the browser, to protect the form against spam and abuse.
- Only if you accept analytics cookies: the pages visited, clicks on contact buttons and technical data about your device, collected by Google Analytics. What you type into the forms is never sent to it.
The site never asks for your CPF (tax ID), health data or any other sensitive data.
Do not include patient data or health information in your message: the site is not a channel for that, and anything received this way is deleted.
What we use it for
- To reply to you and prepare the proposal, quote or demo you asked for.
- To protect the forms against bots and mass submissions.
- To understand, in aggregate, how the site is used so we can improve it — only with your consent.
We do not sell your data and we do not use it for advertising.
Legal bases
- Contact messages and conversations: legitimate interest in replying to those who reach out to us and in preventing fraud and abuse (LGPD art. 7, IX). You can object to this processing at any time.
- IP address, date and time of each submission: compliance with a legal obligation (art. 7, II), because Brazil's Internet Civil Framework (Law No. 12,965/2014, art. 15) requires these records to be kept for 6 months.
- Analytics cookies: your consent (art. 7, I), which you can withdraw at any time. Declining changes nothing in how the site works.
Cookies
| Name | Type | Purpose | Duration |
|---|---|---|---|
criarti_idioma |
First-party, functionality | Remembers the last language you browsed in, so the site opens in it on your next visit. It involves no third parties and is based on legitimate interest. | 1 year |
_ga, _ga_* |
First-party, set by Google, analytics | Google Analytics: tells visitors and sessions apart. It is only set if you click “Accept”. | Up to 2 years |
Your choice is stored in your own browser and is not sent to us. You can change it whenever you like, and we will ask again if this policy changes significantly.
Who we share it with
- Hostinger, which hosts the site, the database and our e-mail.
- Google, as the processor behind Google Analytics, only with your consent. Google may process this data outside Brazil, under the safeguards set out in its terms.
- Meta, when you choose to talk to us on WhatsApp: the conversation is also subject to WhatsApp's privacy rules.
- Public authorities, when required by law or by court order.
International transfer
The site and the database run on servers in Brazil. Data only leaves the country in two cases:
- Google Analytics, only with your consent: the data is processed in the United States and in other countries where Google operates, under the contractual safeguards set out in its terms (LGPD art. 33).
- E-mail and WhatsApp: messages may be stored on the providers' servers outside Brazil, under each provider's rules.
How long we keep it
- Messages sent through the site: 24 months from submission; after that they are deleted automatically.
- IP address and browser: 6 months, the period set by the Internet Civil Framework; after that they are erased automatically.
- WhatsApp and e-mail conversations: also 24 months.
- Google Analytics data: 14 months, as configured in our account.
If the contact turns into a contract, the data then follows the contract's rules. You can ask for deletion before these periods end, subject to legal obligations.
Your rights
The LGPD (art. 18) gives you the right to:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of data that is unnecessary or processed unlawfully;
- portability, and information about who we share it with;
- objection to processing based on legitimate interest;
- information about the option not to consent and the consequences of refusing;
- withdrawal of consent and deletion of the data processed on that basis;
- lodge a complaint with Brazil's National Data Protection Authority (ANPD).
To exercise any of them, write to contato@criarti.com.br. We may ask you to confirm your identity before acting on a request, so we never hand your data to someone else. We reply within 15 days.
Minors
The site is aimed at businesses and professionals and is not intended for anyone under 18.
Security
The site uses an encrypted connection (HTTPS), the forms are protected against bots and access to messages is restricted to the Criarti team.
Changes to this policy
We may update this policy when the site changes. The date at the top shows the version in force, and the cookie notice reappears whenever a change is significant.