Privacy Policy

This Policy describes how LM Zello ("Zello", "we") collects, uses, stores and protects personal data when providing its relationship and service platform for clinics (the "Platform"). We process data in compliance with the Brazilian General Data Protection Law (Law No. 13.709/2018 — LGPD).

01 Who is the data controller

The client clinic is the controller of the personal data of its patients, contacts and leads entered into or received on the Platform. Zello acts as a processor, handling this data on behalf of the clinic and following its instructions. With respect to the clinic users' own account data (registration, authentication, billing), Zello acts as the controller.

02 Data we collect

Account and usage data

• Name, email and authentication data of the clinic's users;
• Organization (clinic) data, preferences, language and settings;
• Access and usage records (logs, IP address, date/time) for security and auditing;
• Billing and subscription data processed by our payment provider.

Data entered by the clinic

• Registration of contacts, leads and patients (name, phone, email, notes);
• Content of conversations, tasks, files and other operational information;
• Any sensitive health data entered by the clinic — processed exclusively under the responsibility and instruction of the controlling clinic.

03 Integration with WhatsApp and Meta

The Platform may connect to the clinic's WhatsApp Business account through Meta's WhatsApp Business Platform (Cloud API), including coexistence mode. When the clinic authorizes this connection:

• We receive and process messages sent and received on the connected WhatsApp line, including those sent from the app on the clinic's phone, in order to mirror and organize them on the Platform;
• We may sync contacts and conversation history (up to 6 months) when the clinic chooses to share them during the connection;
• We exchange with Meta only the data necessary to send, receive and authenticate messages, in accordance with Meta's terms.

Use of WhatsApp is also subject to the WhatsApp Privacy Policy and Meta's policies. The clinic is responsible for obtaining the consent of its contacts for communication through this channel. WhatsApp Privacy Policy

04 How we use the data

• Operate, maintain and improve the Platform and its features;
• Authenticate users, ensure security and prevent fraud;
• Centralize service, organize conversations and automate the clinic's workflows;
• Process messages through artificial intelligence features (summaries, suggestions, translations) within the limits configured by the clinic;
• Provide support, send operational communications and comply with legal obligations.

05 Sharing

We do not sell personal data. We share data only with:

• Meta/WhatsApp, to enable sending and receiving messages;
• Infrastructure providers and subprocessors (hosting, storage, email, payments and AI models), under contractual obligations of confidentiality and security;
• Authorities, when required by law or court order.

06 Legal bases (LGPD)

We process data on the following grounds: performance of a contract, compliance with a legal obligation, legitimate interest (security and service improvement) and, where applicable, the data subject's consent. Sensitive health data is processed under the clinic's responsibility for the protection of health and the provision of the service.

07 Retention

We keep data for as long as necessary for the purposes described, for the duration of the relationship with the clinic and for the applicable legal periods. Once the account is closed, data is deleted or anonymized within a reasonable period, except where a legal retention obligation applies.

08 Data subject rights

Under the LGPD, the data subject may request:

• Confirmation that processing exists and access to the data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary data;
• Portability and information about data sharing;
• Withdrawal of consent and deletion of data processed on that basis.

Requests regarding patient and contact data should be directed to the controlling clinic. For account data, contact contato@cistecnologia.com.br.

09 Data deletion

You can request deletion of your data at any time. We offer a self-service path and an email channel, depending on who is making the request:

Data subject with a Zello account (clinic owner or user)

• Go to Settings → Account → Danger zone and choose Deactivate (a reversible pause — nothing returns until you confirm with the phrase "Reactivate my account" on your next login) or Delete permanently (irreversible).
• Permanent deletion goes through a high-friction confirmation flow (password, code sent by email, typing a phrase and a safety wait). At the end, your email is immediately freed for a new account and the data is erased within minutes.
• Only the owner can delete the entire organization (clinic) — which cascades to remove members, contacts, conversations and the connected WhatsApp line, and automatically disconnects the link with Meta/WhatsApp.

Data subject without an account (e.g. patients and contacts)

Patient and contact data is controlled by the clinic, which acts as the controller. To request deletion, contact the clinic you interacted with, or write to contato@cistecnologia.com.br — we forward the request to the responsible clinic. Response time: up to 30 days.

What is erased and what is anonymized

Deletion permanently removes your personal data and the clinic's content (contacts, conversations, messages, WhatsApp line). Billing records required by tax law are anonymized (personal identifiers removed) and kept only for the legal period — they are not stored in an identifiable form.

10 Security

We adopt technical and organizational measures to protect data, including encryption in transit, role-based access control and isolation between organizations. No system is completely immune to incidents; in the event of a relevant incident, we will act in accordance with the LGPD.

11 Cookies

We use strictly necessary cookies for authentication, security and preferences (such as language). We do not use cookies for third-party advertising.

12 Changes

This Policy may be updated from time to time. Relevant changes will be communicated through the Platform's channels, and the "last updated" date at the top will be revised.

13 Contact

Questions about this Policy or about data processing: contato@cistecnologia.com.br.