Privacy Policy

This website is maintained by Jaqueline Baiocchi, a physiotherapist specializing in lymphedema, lipedema and oncology, with appointments at Clínica Fisioonco, Rua Alceu Wamosy, 302, Paraíso, São Paulo/SP, Brazil. For this policy, Jaqueline Baiocchi is the controller of personal data processed through this site.

For questions about privacy and data protection, email clinicabaiocchi@gmail.com or use the other contact channels listed on the website.

We may collect the following types of personal data:

• Data provided voluntarily: name, email, phone number and messages sent by email, WhatsApp or other contact channels listed on the website.
• Mentorship application data: when applying to the Lymph Expert Mentorship, we collect your name, CPF or identity document, email, phone/WhatsApp, city selected through autocomplete (including state/region, country, country code, approximate city coordinates and public locality identifier), professional information (education, institution, clinical experience, courses previously taken with the professional and format) and confirmation of acceptance of this policy. The document is used only to identify and organize your application in the selection process.
• 30-Day Challenge data: to provide the material, we collect first name, last name, email, phone/WhatsApp, profile, profession where applicable, authorization for contact about the Challenge and delivery of the material under this policy, and a record of the download.
• Access and members area data: when you sign in with Google or Apple, we process your account identifier, verified email and basic data made available during authentication, such as name and profile photo. Member registration requires name, email, phone, Instagram username, CPF for people in Brazil or an identity document for people in other countries, postal code, street, number, neighborhood, city, state or region and country. We also record account status, creation and update dates, and confirmation of consent to this policy when registration is completed.
• Enrollment and administration data: courses granted, enrollment status and dates, and records needed to identify who granted, changed or revoked administrative access.
• Technical access data: IP address, browser information, authentication records and timings, temporary technical identifiers and session cookies may be processed to maintain access, diagnose failures, record security events and prevent misuse. We do not use analytics, advertising or behavioral tracking cookies.
• Communication data: records of contact through WhatsApp, email or social media.

Registration and application forms do not request diagnoses, medical records or clinical history. The public screening questionnaire collects health signs and history with specific authorization, as described above. In the 30-Day Challenge form, the profile provided and campaign context may indicate a personal or professional interest in a health-related topic. This data is processed only to provide the material and make the contacts authorized in the form. Do not include clinical information in registration fields.

Clinical information voluntarily sent through contact channels is processed only to respond to the request and, where professional care is provided, is subject to applicable professional confidentiality.

We use the collected data for the following purposes:

• Responding to contact and appointment requests;
• Assessing mentorship applications and responding about selection;
• Providing the requested material and contacting you about the 30-Day Challenge in accordance with the authorization displayed in the form;
• Processing the city selected in the form to organize applications and validate the document provided;
• Providing information about treatments, courses and services;
• Authenticating previously authorized users, maintaining member profiles, administering enrollments and providing classes, materials and readings linked to their access permissions;
• Recording relevant administrative operations for access control, security and accountability;
• Maintaining and improving browsing and site content without tracking or audience measurement cookies;
• Meeting applicable legal and regulatory obligations.

Your personal data is processed on the legal bases provided by Brazil's LGPD, as applicable to each purpose. Delivering requested materials, assessing applications, creating accounts, managing enrollments and providing access are based on performance of a contract or preliminary steps requested by the data subject. Consent is used when requested in forms, including contact about the 30-Day Challenge and delivery of material. Legitimate interests may support responses to user-initiated contact, proportionate administrative records and protection against misuse, following an assessment of necessity and impact. We also process data to meet legal or regulatory obligations and exercise rights.

Health information is sensitive personal data. When received in the context of professional care, it is processed only in the circumstances permitted by Article 11 of Brazil's LGPD, particularly for health protection by a healthcare professional or service, compliance with legal or regulatory obligations, exercise of rights or, when necessary, with specific, explicit consent.

This website does not use analytics, advertising or tracking cookies, or audience measurement tools. For visitors who only browse, we do not store our own tracking cookies. The administrative and members areas use session cookies strictly necessary for sign-in. Third-party technical cookies may arise when you open the appointment panel containing the clinic map or play an embedded class. The video player loads with the provider's available do-not-track option. Details and controls are described in our Cookie Policy.

We do not sell your personal data. We may share it only as needed to operate the site, respond to requests, process applications, provide materials, manage authorized contacts, meet legal obligations or comply with orders from a competent authority.

In practice, the main third parties involved are:

• hosting, cloud infrastructure and database providers used to maintain the site, forms, administrative dashboard and members area;
• Google or Apple, when you choose to sign in with the respective account, to confirm identity and the email associated with access;
• OpenStreetMap/Nominatim, used for city autocomplete and verification in mentorship and members area forms. The server sends only the search text or public locality identifier; CPF, identity documents, phone numbers and other registration data are not sent to the geocoding provider;
• ViaCEP, consulted by the server to fill in street, neighborhood, city and state based on the postal code provided in member registration;
• Google Maps, loaded when you open the appointment panel containing the clinic map;
• Vimeo, loaded only for authenticated members when a video class is opened, with do-not-track enabled;
• WhatsApp, email, social media and partner course platforms (Lipe Ensino and OncoExperts), when you choose to access or communicate through these channels.

Some providers may process data outside Brazil. International transfers must occur only through a valid mechanism, such as an adequacy decision, standard contractual clauses or another instrument permitted by Brazil's LGPD and Resolution CD/ANPD No. 19/2024. Selecting and contracting providers must take security, transparency and protection of data subjects' rights into account.

Under Brazil's LGPD, you have the right, upon request, to:

• Confirm whether your data is being processed;
• Access, correct or update your data;
• Request anonymization, blocking or deletion of unnecessary data;
• Withdraw consent at any time;
• Request deletion of data processed on the basis of consent, subject to legal retention provisions;
• Obtain information about entities with whom your data has been shared;
• Request data portability where applicable.
• Know when consent is optional and the consequences of not providing it;
• Object to processing without consent where it fails to comply with Brazil's LGPD;
• Submit a petition to ANPD or consumer protection bodies.

Exercising these rights is free of charge. We may request sufficient information to confirm the requester's identity and prevent improper disclosure or changes to another person's data. If a measure cannot be taken immediately, we will explain the applicable reasons.

We take reasonable technical and organizational measures to protect your data against unauthorized access, loss or alteration. Data is retained only as long as needed for its collection purposes, to exercise rights or as required by law.

Mentorship application data (including CPF or identity document) is processed exclusively for selection and for the period needed to complete the cohort and respond to the applicant. Unsuccessful applications will be reviewed for deletion or anonymization within 12 months after selection closes. If an application leads to a contractual relationship, some records may be retained for applicable statutory periods.

30-Day Challenge data will be reviewed for deletion or anonymization within 12 months after the last download. Authorization for contact may be withdrawn at any time. A minimum record of authorization or withdrawal may be retained for accountability and the exercise of rights.

Members area data is retained while the account or access relationship is active and afterward for the period needed to meet legal obligations, exercise rights, maintain security and document enrollments and permissions granted. Suspended or archived accounts lose access, but minimum records may be retained where there is a legal basis or an audit need.

Session cookies expire within eight hours; temporary sign-in diagnostic identifiers expire within 15 minutes. Technical security and access records are reviewed according to their usefulness and applicable legal obligations, with access restricted to authorized staff.

Deletion requests are assessed according to each item's purpose and legal basis. Deletion does not cover information whose retention is required or authorized by law.

Application, campaign and member registration forms on this site are intended for people aged 18 or older. Minors must not submit data through these forms. If we identify data submitted by a child or adolescent without valid participation by a legal guardian, we will take appropriate steps to stop processing and delete the data, subject to legal retention and protection provisions.

Information needed for healthcare for minors is processed outside these forms, in the appropriate care setting, with the legal guardian's participation and the child's best interests observed.

This policy may be updated periodically. The latest update date appears at the top of this page. We recommend reviewing it periodically to stay informed about how we process your data.

To exercise your rights or ask questions about this policy, email clinicabaiocchi@gmail.com or use the WhatsApp contact listed on the site.