PRIVACY & DATA PROTECTION

Privacy Policy

How ArchiMeds protects your personal data and your study information, in compliance with the LGPD.

Last updated: August 6, 2026

This policy complies with Brazil's General Data Protection Law (LGPD — Law 13.709/2018).

Who we are

ArchiMeds is an artificial intelligence platform specialized in Brazilian medical education. Our tools are built for medicine — and also used by students in other health sciences programs.

Data we collect

Personal data

  • Full name and email
  • School and program
  • Academic year/term

Usage data

  • Conversations with the AI (to improve the service)
  • Study history and progress
  • Materials you upload (lectures, texts)
  • Browsing and usage data

How we use your data

  • Provide and personalize our AI services
  • Improve our medical learning algorithms
  • Send important communications about your account
  • Provide specialized technical support
  • Comply with legal and contractual obligations

Data sharing

We do not sell your personal data. We may share information only in the following situations:

  • With the technology processors listed below, who process data on our behalf and only under our instructions
  • When required by law or by competent authorities
  • In the event of a merger, acquisition, or sale of assets (with prior notice)
  • With your explicit consent

Processors that handle data on our behalf. This is the complete list of third-party services currently in operation, what each one is for, and where they process the data. We update this list whenever it changes.

Google Analytics (GA4)Google LLC · United States

Measuring site audience and performance — pages visited, traffic source, browsing events.

Meta Pixel / Conversions APIMeta Platforms, Inc. · United States

Measuring and optimizing advertising campaigns on Instagram and Facebook, including custom audiences and remarketing.

Umami Analyticsour own instance, hosted on Railway · United States

Aggregate, cookieless usage analytics, as a lower-impact alternative for privacy.

Vercel Analytics and Speed InsightsVercel Inc. · United States

Site hosting, content delivery, and technical performance measurement (Core Web Vitals).

SupabaseSupabase, Inc. · United States

The platform's database — account, study data, uploaded materials, and messages sent through this site's forms.

RailwayRailway Corp. · United States

Application infrastructure that processes part of the platform's requests.

HotmartHotmart B.V. / Hotmart Brasil · Brazil and the European Union

Processing payments and issuing subscription billing.

StripeStripe, Inc. · United States

Processing subscription payments. Full card data is handled directly by Stripe and never reaches our servers.

Each of these processors operates under contract and handles data only for the purposes listed above. You can request information about any of them by emailing our Data Protection Officer, listed at the end of this policy.

Your rights (LGPD)

Under the LGPD, you have the following rights:

  • Access: Know what data we have about you
  • Correction: Update incorrect or incomplete data
  • Deletion: Request removal of your data
  • Portability: Receive your data in a readable format
  • Objection: Object to specific data processing
  • Information: Know who we share your data with

Data protection

We implement appropriate technical and organizational measures to protect your data, including encryption, access controls, regular audits, and team training. All data is stored on secure servers with international certifications.

Data retention

We keep your data only for as long as necessary to fulfill the purposes described in this policy or as required by law. Data from AI conversations is anonymized after 24 months for service-improvement purposes.

Cookies and similar technologies

This is the complete list of cookies and identifiers this site stores in your browser, along with the purpose and lifespan of each. The advertising cookies below are set when you arrive at the site through an ad.

attribution_session_idEssential90 days

Links your visit to the site to your account in the app, so we know how you found us.

_ref, _infEssential90 days

Stores the referral or ambassador code you arrived with, so credit is attributed correctly.

_ga, _ga_*Analyticsup to 24 months

Google Analytics — distinguishes visitors and sessions to measure site audience and performance.

_fbp, _fbcAdvertising90 days

Meta — identifies the browser and the ad click, to measure and optimize campaigns on Instagram and Facebook.

_gclidAdvertising90 days

Google Ads — identifies the ad click to measure campaign conversions.

_ttclidAdvertising90 days

TikTok Ads — identifies the ad click to measure campaign conversions.

utm_* (local storage)Analyticsuntil you clear your browser

Stores your first-visit campaign parameters in browser storage, not in a cookie.

themeEssentialuntil you clear your browser

Remembers whether you prefer light or dark mode. Stored in browser storage, not in a cookie.

Umami, our main analytics tool, does not set cookies or create persistent identifiers. You can block or delete any of the cookies above in your browser settings — the essential ones affect site functionality, the rest don't.

Data security

We implement rigorous security measures to protect your personal data:

  • Encryption of data in transit and at rest
  • Data access restricted to authorized personnel only
  • Continuous security monitoring
  • Regular, secure backups
  • Regular security audits

International data transfer

Your data is transferred outside of Brazil. The infrastructure behind the platform — database, hosting, application, and measurement tools — is operated by vendors based in the United States, as listed in section 04. This means personal data is stored and processed on servers located in that country.

The transfer is made under Article 33 of the LGPD, based on the performance of the contract we have with you and your legitimate interest in using the service. To ensure it:

  • We maintain a contract with each processor that includes data protection clauses equivalent to the LGPD standard
  • Processors handle data only under our instructions and for the stated purposes
  • Data travels encrypted and is stored encrypted at rest
  • You can request information about any specific transfer by emailing the Data Protection Officer

Changes to this policy

We may update this policy from time to time. Significant changes will be notified by email or through a notice on our platform. The most recent version will always be available on this page.

CONTACT & EXERCISING YOUR RIGHTS

Want to exercise your rights or ask a question?

Talk to us — we respond within 15 business days.

Email

privacidade@archimeds.co

Data Protection Officer (DPO)

dpo@archimeds.co

Response time

Within 15 business days