LGPD: Brazil
Health and biometric data are sensitive personal data under the LGPD. The clinician must establish the legal basis for the actual treatment and inform patients. Maestra’s role as operador does not replace those controlador duties.
Current measures and boundaries
Section titled “Current measures and boundaries”Sensitive stored patient, clinical, financial, transcript, biometric speaker, assistant, and retrieval values are encrypted on-device. Readable account and structural metadata remains available for service coordination. Necessary plaintext passes transiently through the relay and contracted processors.
The counsel-reviewed ROPA records executed DPAs, international-transfer safeguards, the Article 37 processing record, incident response, and the designated Encarregado. Modal tasks include transient processing in the United States under the recorded DPA and equivalence basis. Eden follows the documented EU path. Maestra does not claim Brazil-only processing.
Version 3 export supports patient-access workflows but excludes finance data and reusable templates. Account deletion removes Maestra-held records and wrapped key material. It does not erase exports, user backups, or other-device copies.
Controller responsibilities
Section titled “Controller responsibilities”Clinicians must establish the sensitive-data basis, give the required information, answer Article 18 requests, complete an RIPD when appropriate, follow professional retention duties, and assess the disclosed processors and transfers.
For statutory privacy matters, contact Diogo Carpanedo do Carmo at [email protected].