Privacy policy

For account, billing and website usage data, acolá (Costa e Vieira Tecnologia da Informação Ltda., CNPJ 64.146.166/0001-01) is the controller.

For patient data, including clinical records, the controller is the professional or clinic treating the patient. acolá is the processor: it stores and processes that data on the professional's behalf and on their instructions. Patient requests about clinical content are forwarded to the responsible professional.

Professionals and staff: name, e-mail, phone, password (stored only as a hash), council registration, specialty, subscription billing data and access logs.

Patients, entered by the professional: name, contact details, date of birth, legal guardian (for minors), emergency contact, health plan, session schedule and session financial data.

Clinical content: intake assessment, progress notes, private notes, diagnostic hypotheses, prescriptions, issued documents, clinical attachments and approved AI summaries.

Patient portal: daily mood entries (scale and free text), medication reminder confirmations and notification preferences.

Website: essential cookies and, only with your consent, aggregated analytics. See the Cookie policy.

Health data is processed for the protection of health, in procedures carried out by health professionals (LGPD art. 11, II, “f”), and to meet legal and regulatory obligations to retain clinical records (art. 11, II, “a”).

Account and billing data is processed to perform the subscription contract (art. 7, V) and to meet tax obligations (art. 7, II).

Access logs and the audit trail serve service security and fraud prevention, based on legitimate interest (art. 7, IX) and the mandatory retention of access logs under Brazil's Internet Civil Framework (Marco Civil da Internet).

Using the AI assistant for a patient depends on that patient's consent, recorded in the system (art. 11, I). Analytics cookies also depend on consent. You can withdraw consent at any time, without affecting what was done before.

Access to clinical content is enforced by the database: each clinic is isolated from the others and only the responsible professional opens their patient's record. The database, backups and files are encrypted at rest by the infrastructure provider (AES-256), and all traffic uses TLS 1.2 or higher.

The record opens after the responsible professional confirms with a passkey or the authenticator code, and closes by itself after a period of inactivity (15 minutes by default) or when switching patients. Signing in as someone who accesses clinical content requires two-step verification.

On top of that, acolá encrypts clinical content before storing it (intake, progress notes, private notes, clinical documents and their PDFs, record attachments, session recordings and their transcripts, and the patient's mood notes), with AES-256-GCM and a data key of each clinic's own. The data keys are stored encrypted by a master key that is not kept in the database, only in the application's runtime environment; so a copy of the database or of a backup, on its own, does not reveal that content. Operational access to the master key is restricted to a few people, under dual custody. The application needs the key to show the record to whoever is entitled to it, so the encryption protects against leaks of the database and the backups, and does not replace the access control described above. We plan to move the master key to a dedicated key management service (KMS).

Access follows each user's role: admin, professional, receptionist, finance and patient. Only the responsible professional opens their patient's record. Receptionists and finance never see clinical content. Patients see their own portal, not the professional's notes.

Our team's access to the infrastructure is restricted and protected by two-step verification. The audit trail logs sign-ins, every record opening, exports, sensitive changes and every use of the AI.

The assistant is enabled only for patients who have consented, and only inside a record opened with TOTP. Before sending, the patient's name and identifying data are replaced with pseudonyms.

The AI provider acts as a sub-processor under a zero-retention contract: data is not stored after the response and is not used to train models. The result comes back as a suggestion and enters the record only if the professional approves it.

Recording session audio is optional and only happens with the patient's consent, recorded in the system. The audio is kept isolated in acolá and only the responsible professional can listen to it, with the record open. By default it is deleted automatically 30 days after the recording started (the clinic can adjust this period), or earlier if the professional deletes it or the patient withdraws consent.

Transcription into text depends on its own consent and is requested by the professional, one recording at a time. To transcribe, the audio is sent to AssemblyAI, which acts as a processor for acolá on servers in Europe. This is an international data transfer, which follows the hypotheses of art. 33 of the LGPD. Once the transcription is done, the copy at AssemblyAI is deleted and the text is kept in acolá.

The transcription is generated automatically, may contain errors and is not part of the clinical record.

We do not sell personal data or use it for advertising.

We share the minimum necessary with vendors that help us provide the service: infrastructure, the AI provider, subscription payment processing and delivery of e-mails and push notifications. All operate under contract, with confidentiality and security obligations consistent with the LGPD.

We may also disclose data when required by law or court order, limited to what is requested.

If a vendor processes data outside Brazil, the transfer follows the cases in LGPD art. 33, such as standard contractual clauses approved by the ANPD (Brazil's data protection authority).

Psychology records are kept for at least 5 years, under CFP (Federal Council of Psychology) Resolution 001/2009. Medical records, such as psychiatric ones, are kept for 20 years from the last entry, under Law 13,787/2018. For psychoanalysts, the default period is 5 years, adjustable by the professional.

During those periods, a deletion request becomes a block: the data stays blocked and unavailable for ordinary use. When the period ends, it is deleted or anonymized.

Account and billing data is kept while the account is active and then for the period of tax obligations. Access logs are kept for at least 6 months, as required by the Internet Civil Framework.

Under the LGPD, you can ask for confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, and withdrawal of consent.

Professionals and staff exercise these rights through the data protection officer's e-mail. Patients should first contact the professional or clinic, which controls the clinical record; if they contact us, we forward the request.

We respond within 15 days. If you are not satisfied, you can file a complaint with the ANPD.

Data of underage patients is processed in their best interest, with the consent and involvement of the legal guardian registered by the professional. Minors' access to the patient portal depends on the guardian's authorization.

If an incident occurs that may cause significant risk or harm, we notify the affected controllers and the ANPD within the regulatory deadlines, stating what happened, which data was affected and what was done to contain it.

acolá's data protection officer (encarregado) handles requests from data subjects and the ANPD. Contact: encarregado@acola.com.br.

To speed things up, include your name, your role (professional, staff or patient) and what you need.

When this policy changes materially, we let you know by e-mail and inside acolá before the change takes effect. The date at the top of the page shows the version in force.