Privacy Policy

1. Who processes data

Alexandre Simoes, responsible for GoAgentic, acts as processor for end-customer data handled on the customer business’s instructions. The clinic or other business serving you is the controller of those conversations. For user accounts, security and management of GoAgentic’s own relationship, Alexandre Simoes acts as controller. Address: Rua Arujá, 72, Guarulhos/SP, postal code 07020-240, Brazil. Contact: suporte@goagentic.pro.

No formally appointed data protection officer has been reported for this version. The privacy channel receives requests without assigning that role fictitiously. The email address still needs to be activated and tested before the pilot receives real data.

2. Data and purposes

We may process name, email, phone, organization, permissions, document acceptance, authentication data and access/security records to operate accounts, authenticate users, provide support, meet obligations and protect the service. Passwords are managed by the authentication provider and are not displayed to the team in readable form.

On business instructions, we process WhatsApp messages, contact identity and phone, timestamps, delivery status, attachments, audio and transcripts; approved business knowledge; requests and appointments; opt-in, opt-out, intervention history and verification traces. Purposes include administrative assistance, organization, responses, authorized follow-up, scheduling, auditing and usage/cost measurement.

A person may spontaneously send health or other sensitive data. The business must avoid unnecessary collection, explain the purpose and establish the specific legal basis. GoAgentic does not convert this information into clinical advice or authorize its use for marketing. Do not request medical records for administrative assistance.

3. Legal bases and limitations

When processing for a business, the controller determines and documents the applicable legal basis, including a basis under article 11 of Brazil’s LGPD for sensitive data. A business user’s acceptance and WhatsApp authorization do not constitute end-customer consent for every processing purpose.

For GoAgentic’s own purposes, applicable bases may include contract performance and preliminary steps, legal obligations and assessed legitimate interests in security and abuse prevention. Consent is used when required, not as blanket authorization. Each purpose, particularly health data and transfers, must be reviewed before the pilot.

4. Providers and sharing

Meta/WhatsApp and Zernio transport messages, media and account events. Google Gemini processes minimum necessary context for generation, verification and transcription. Google Calendar, when connected, supplies availability and receives administrative event data such as name, contact and time; clinical content is not sent through this feature.

Supabase provides authentication, database and storage; Vercel hosts the application and processes requests and technical logs; Firecrawl reads designated public sources for business knowledge. Support access is restricted. Resend is outside this pilot; future email activation through that provider requires updating configuration and applicable information.

Providers may process data outside Brazil, including in the United States. Each flow requires contractual safeguards and a transfer mechanism under the LGPD and ANPD rules. Actual regions, subprocessors and retention cycles must be confirmed in contracts and environment configuration. Listing a provider does not declare certification or legal adequacy.

5. Google data and AI

Google connection is optional and revocable. Permissions include listing calendars, checking availability and reading/editing events; the application operates on the selected calendar. The Google grant may cover other calendars in the account even when not selected in the application. Revocation stops future access and removes operational connection credentials; previously created events remain in your calendar until deleted.

Use and transfer of information received from Google APIs comply with the Google API Services User Data Policy, including Limited Use. Google data is not sold, used for advertising, or used to develop, train or improve generalized AI models. Use is limited to visible features authorized by the user.

Conversations are not sold or used for GoAgentic advertising. We do not claim that every AI provider has zero retention or identical conditions: terms, service tier and settings need assessment. Data sent to AI must be minimized.

6. Retention periods

Conversations, transcripts and attachments: up to 180 days. Original audio: up to 30 days. Appointments: 180 days after the end or cancellation. Content-bearing logs and traces: up to 180 days. Business knowledge: while necessary for the contract. After termination, export and operational deletion within 30 days of request validation, except for a specifically identified legal obligation.

Minimum security, acceptance and opt-out records are kept separately for a necessary and justified period for each purpose. Contact suppression retains only the minimum needed to avoid contacting the phone again for the same business. Legal review must define specific evidence and statutory retention periods before exceptional retention.

Backups are not deleted instantly; they follow the contracted cycle, which must be confirmed before real-data use. Deletion requests are recorded to prevent data reintroduction after restoration. Real-data use requires authorized activation of the validated routine, operational export when requested and review of external copies. In the app, business or phone requests require confirmation; local erasure and external review have separate states. Minimal content-free evidence is retained separately.

7. Rights and requests

You may request confirmation and access, correction, information about sharing, anonymization, blocking or deletion where applicable, portability under applicable rules, and information about consent and withdrawal. You may challenge unlawful processing, seek review of solely automated decisions affecting your interests and petition Brazil’s ANPD. Each right is applied according to legal conditions and third-party security.

End customers should contact the business serving them; GoAgentic assists as processor. GoAgentic users may write to suporte@goagentic.pro. If we receive a request meant for the controller, we will help direct it securely. Requests receive human review, proportionate identity verification and a record; we do not require indiscriminate submission of sensitive documents.

Data needed for a legal obligation or protection of rights may be retained in a limited way, with purpose and grounds explained. Revoking Google access is different from deleting conversations or events: request each operation as needed.

8. Security, children and incidents

We use access controls, organization isolation, credential protection and technical records. These controls reduce risk but do not guarantee absence of incidents. GoAgentic notifies the controller of incidents without undue delay and cooperates with appropriate measures and notifications.

The business service is not intended for children to register independently. If a conversation contains a child’s or adolescent’s data, the business must assess necessity, best interests and applicable rules, including consent where required. Assistance should not request unnecessary sensitive data.

9. Cookies and updates

The application uses session mechanisms and preferences, including language and theme, for authentication and operation. Adding nonessential technology, advertising or further analytics requires its own assessment and transparency; this policy is not blanket consent to tracking.

This version is identified on the page and in account acceptance. Material changes will be communicated; consent or renewed acceptance requirements will be respected where applicable. For the pilot, a functioning contact channel, retention/deletion procedure and review of provider safeguards are prerequisites for real data.