Privacy Policy · Vita Imagem

This translation is provided for your convenience. If there is any difference, the Portuguese version prevails.

1. Purpose

This policy aims to set out, in a simple, transparent and objective way, how your personal data (“Data Subject”) will be collected, used and protected, including when you communicate with Vita Imagem through the website, by phone or on WhatsApp. We recommend reading this document carefully, as it seeks to clarify the reasons for and purposes of the data processing carried out by Vita Imagem. If you have any further questions, please contact our Data Protection Officer:

Data Protection Officer: Legal Department
Email: dpo@vitaimagem.com.br
Phone: (45) 3576-8500
Controller: Rossoni, Piotto & Cia. Ltda. (Vita Imagem), CNPJ 00.384.013/0001-01, Av. Gramado, 580, Vila A, Foz do Iguaçu/PR, ZIP code 85860-460, Brazil.

2. Scope

This Policy is addressed to: (i) all units (hospitals and clinic) and administrative departments; (ii) all professionals who have a relationship with any Vita Imagem unit; (iii) third parties acting on behalf of Vita Imagem; (iv) personal data processing agents that relate in any way to Vita Imagem; (v) data subjects whose data is processed by Vita Imagem, including through its digital service channels (website, WhatsApp and applications integrated with Meta platforms). Compliance by all the recipients mentioned is mandatory, and the Policy must be observed in all processing carried out by the recipients and by Vita Imagem.

3. Definitions

PERSONAL DATA PROCESSING AGENTS: the personal data controller and processor.
ANONYMIZATION: process by which data loses the possibility of being associated, directly or indirectly, with an individual, considering the reasonable technical means available at the time of processing.
CHATWOOT: customer service platform used by Vita Imagem to receive, organize and reply to the messages sent by Data Subjects through WhatsApp.
PERSONAL DATA CONTROLLER: natural or legal person, under public or private law, who is responsible for decisions regarding the processing of personal data.
COOKIES: files sent by the Website server to the Users’ computer, in order to identify it and obtain access data, such as pages browsed or links clicked, thus allowing the Users’ browsing on the Website to be personalized according to their profile.
PERSONAL DATA: any information related to a natural person, directly or indirectly, identified or identifiable, such as: name, CPF, ID card number, photograph, email, phone number, date of birth etc.
SENSITIVE PERSONAL DATA: special category of personal data concerning racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organization, data concerning health or sex life, and genetic or biometric data relating to a natural person.
DATA PROTECTION OFFICER: department appointed by the controller and processor to act as a communication channel between the controller, the data subjects and the Brazilian National Data Protection Authority (ANPD).
Vita Imagem: refers to the company Rossoni, Piotto & Cia. Ltda. itself, registered under CNPJ No. 00.384.013/0001-01.
IP: abbreviation of Internet Protocol. It is a set of numbers that identifies the users’ computer on the internet.
SECURITY INCIDENT: unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication or any form of inappropriate or unlawful processing. They are negative events for information security. In this Policy, the term security incident will be used to cover both security events and incidents.
LOGS: records of user activities carried out on the website.
META: Meta Platforms, Inc. and its affiliates, including WhatsApp LLC, providers of WhatsApp and the WhatsApp Business Platform.
PERSONAL DATA PROCESSOR: natural or legal person, under public or private law, who processes personal data on behalf of the controller.
PERSONAL DATA PROTECTION IMPACT REPORT (RIPD): controller documentation that contains a description of the personal data processing operations that may pose risks to civil liberties and fundamental rights, as well as risk mitigation measures, safeguards and mechanisms.
INFORMATION SECURITY MANAGEMENT SYSTEM (SGSI): system that aims to protect the information managed by the institution, ensuring confidentiality, integrity and availability (CIA), and may include organizational processes.
WEBSITE: means the web address of the Vita Imagem website and its subdomains.
DATA SUBJECT: natural person to whom the personal data refers, such as former, current or potential customers, employees, health plan beneficiaries, contractors, business partners and third parties.
PROCESSING: any operation carried out with personal data, such as: collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction.
THIRD PARTIES: any natural or legal person who has a relationship with Vita Imagem to carry out or help carry out the company’s activities, whether as suppliers of goods or services or as business partners.
USERS: people who access the Website and/or interact with the activities offered on it.
WHATSAPP BUSINESS PLATFORM (OFFICIAL WHATSAPP API): service provided by Meta that allows Vita Imagem to send and receive WhatsApp messages through its own or third party systems, such as Chatwoot.

4. Responsibilities

4.1. Data Protection Management Committee (CGPD)

a)to propose and implement the Privacy and Data Protection Policy, schedules and plans aimed at regulating privacy and personal data protection within Vita Imagem;
b)to assess existing data processing and protection procedures and propose strategies and goals in compliance with the LGPD;
c)to review the Privacy and Data Protection Policy every 2 (two) years at most;
d)to promote awareness actions among its employees, the medical and hospital community and partners on the application of the policy and rules related to privacy and data protection;
e)to plan, coordinate and monitor the implementation of the action plan to address any gaps identified, and the actions and projects needed to comply with the LGPD;
f)to develop training and strategies for the dissemination of the Privacy and Data Protection Policy and its internal adoption, as well as of the regulations in force;
g)to receive reports of non compliance with the rules of the Privacy and Data Protection Policy, prepare them with the elements needed for their analysis and notify those responsible;
h)to coordinate the exchange of information on personal data protection with public bodies and partners;
i)to promote awareness and follow up actions among employees, the medical and hospital community and partners regarding compliance with the approved policies, rules and guidelines;
j)to present the subject to the Executive Board and the Board of Directors at least 3 times a year or whenever necessary;
k)to present the subject to the Company’s Board of Directors annually or whenever the Board so indicates.

4.2. Data Protection Officer

a)to be a point of contact between the Brazilian National Data Protection Authority (ANPD) and the company, under art. 41, §2, II, LGPD;
b)to be a point of contact between data subjects and the company, receiving complaints and communications from data subjects and providing the necessary clarifications, under art. 41, §2, I, LGPD;
c)to advise the company on matters related to personal data protection, guiding “the entity’s employees and contractors on the practices to be adopted regarding personal data protection”, under art. 41, §2, III, LGPD;
d)to have their details published on the controller’s website (art. 41, §1, LGPD), through the email dpo@vitaimagem.com.br.

4.3. Vita Imagem management

a)to adopt and enable the actions needed to bring work processes and systems into line with the LGPD, the Privacy and Data Protection Policy and the guidelines set by the CGPD, in their respective assets;
b)to share information, procedures and instructions in their respective assets;
c)to report on the progress of the implementation of policies and the execution of plans, projects and internal actions of the respective asset, as requested by the CGPD.

4.4. Information security

a)to advise the CGPD in drafting the Information Security Policy in order to ensure the security of the processing of data that circulates digitally, as well as its storage within Vita Imagem;
b)to provide technical support for the research, identification, modeling, development and implementation of tools, procedures and new processes needed to meet the legal requirements related to privacy and data protection.

5. Tables

5.1. Summary table

Processing agent: Vita Imagem (Rossoni, Piotto & Cia. Ltda., CNPJ 00.384.013/0001-01)
Role in processing: Mainly controller.
Nature of the data processed: Personal data provided by the Data Subject and/or collected automatically, of a registration, financial and sensitive nature (article 5, II of Law 13,709/2018), including messages exchanged on WhatsApp.
Main purposes of processing: Vita Imagem may use personal data for registration, in order to provide its products and services, perform exams and procedures, booking, exam confirmations and reminders (including on WhatsApp), sending preparation instructions, billing, opinion, satisfaction and welcome surveys, Wi-Fi access, offering new products, answering questions and requests and providing support, among other activities.
Sharing: Processors and providers of services essential to our activities (including Meta/WhatsApp and the Chatwoot service platform); government authorities and bodies as a result of legal or regulatory obligations.
Data protection: Appropriate technical and administrative security measures.
Your rights: Confirmation that processing exists, access, correction, deletion, portability, withdrawal of consent etc. See items 5.6 and 5.11.

5.2 Data collected from the data subject

5.2.1. Personal data provided directly by the data subject: Vita Imagem will collect all personal data entered or sent voluntarily by the user when registering on its portal, when contacting its service channels (including WhatsApp) or when using its services. The data collected varies according to the type of service the Data Subject is registered for. Below is a non exhaustive list of the services provided by Vita Imagem:

Services	Personal Data
Exam Booking	Name; CPF; Phone; Health plan details; Doctor details; Type of Exam; Clinical data.
WhatsApp Service	Phone number; WhatsApp name and profile photo; content of messages (texts, audio, images and documents sent, such as medical orders and health plan cards); date and time of messages and delivery and read status.
In Person Delivery of Exams	Patient’s official photo ID: RG or CNH (Brazilian ID card or driver’s license).
Billing data	Which usually include registration, financial and health data, among others.
Access to Completed Exams	Login and password to access the portal; Name, CPF, Email, Exam Details; Doctor details.
Surveys	Name; CPF; Medical record data.

5.2.2. In some cases it will be necessary to collect data from children who have a parental relationship with the legal guardian. In these cases, the express consent of the legal guardian will be required to process such data. The legal guardian is responsible for providing correct and up to date information. Vita Imagem will not be responsible for the accuracy or truthfulness of the information provided by the legal guardian, or for the lack of it.

5.2.3. Personal data provided by third parties: As permitted by Law, Vita Imagem may receive personal data from third parties, whether partners, service providers or other independent third party sources, such as public databases of services related to the Data Subject. The data received from such sources enables Vita Imagem to provide its services to the Data Subject and will be processed in accordance with the provisions of this Policy.

5.2.4. Data collected on websites: Vita Imagem may also automatically collect a range of information, such as: characteristics of the access device and browser, IP (with date and time), IP address, information about clicks, pages accessed, search terms typed on our portals, among others. This collection is carried out through some standard technologies, such as cookies, described in item 5.7.

5.3. Use of personal data

Legal basis	Purpose
For the performance of contracts or preliminary procedures. (Item V of Art. 7 of Law No. 13,709/18)	i) Management, administration, provision, expansion and improvement of the Services offered to the Data Subject; ii) For the relationship with and provision of information related to the products and services contracted by Vita Imagem customers; iii) To assess whether certain products or services can be offered and under what conditions; iv) To publish the guide of medical providers and the network of accredited healthcare facilities; v) To receive hospital invoices; vi) To reply to messages sent by the Data Subject on WhatsApp, make bookings and send confirmations, reminders and exam preparation instructions.
When Vita Imagem must comply with a legal or regulatory obligation. (Item II of Art. 7 of Law No. 13,709/18)	i) Keeping medical records for a period of 20 (twenty) years from the last entry, under article 6 of Law No. 13,787/2018; ii) Mandatory reporting in case of suspected child abuse, under article 13 of the Child and Adolescent Statute; iii) Obtaining the patient’s consent for a medical procedure, stating the risks inherent to that procedure, under art. 22 of the Code of Medical Ethics; iv) Sharing data with the Ministry of Health to build the minimum data set, under article 47 of Law No. 8,080/1990 and article 4 of Decree 29/2017; v) Mandatory reporting of diseases, under Law No. 6,259/1975; vi) Keeping Wi-Fi access logs at its Units, under article 13 of the Brazilian Internet Civil Framework (Marco Civil da Internet).
For the protection of health, in procedures that, due to their particular nature, do not require consent. (Item VIII of Art. 7 and paragraph “f” of item II of Art. 11 of Law No. 13,709/18)	i) For example, in medical assessments in which data such as height, weight, eating habits and blood pressure, among other information, is collected; ii) Processing of medical orders and health information sent by the Data Subject to enable the exam to be performed.
In pursuit of Vita Imagem’s legitimate interest, always within the limits of the Data Subject’s expectations, and never to the detriment of their fundamental interests, rights and freedoms: (Item IX of Art. 7 of Law No. 13,709/18)	i) Sending communications for informational purposes; ii) Promoting events or conducting surveys related to Vita Imagem’s activities.
For carrying out activities aimed at preventing fraud. (Item X of Art. 7 of Law No. 13,709/18)	i) Conducting internal investigations.
By means of authorization given by the Data Subject. (Item I of Art. 7 of Law No. 13,709/18)	i) For processing children’s personal data; ii) For contacts involving clinical conditions of interest to the data subject through electronic messages; iii) For sending promotional or informational WhatsApp messages not related to an ongoing service, upon the Data Subject’s prior opt-in.

5.4. Sharing of personal data

5.4.1. Vita Imagem will sometimes need to share your personal data with third parties, in the following situations and within legal limits:

a)With partner companies and suppliers, in the development and provision of services made available to the Data Subject, especially the Health Plan Operators with which the Vita Imagem Units are accredited;
b)With authorities, government entities or other third parties, to protect Vita Imagem’s interests in any type of dispute, including lawsuits and administrative proceedings;
c)In the case of corporate transactions and changes involving Vita Imagem, in which case the transfer of information will be necessary for the continuity of services;
d)Upon a court order or at the request of administrative authorities with legal power to require it;
e)Among its internal departments, with access by designated employees;
f)With contracted entities that in some way need to work together for your best experience and the best service, such as professional councils, educational institutions, leading medical institutions outside Brazil, laboratories, specialized collection companies and law firms;
g)With technology providers that enable the digital service channels, in particular Meta (WhatsApp Business Platform), which transmits the messages, and the Chatwoot service platform and its hosting providers, which store the conversation history, acting as processors on behalf of Vita Imagem.

5.4.2. Where applicable, all Vita Imagem service providers and business partners are bound by strict contracts that prohibit the unauthorized use or disclosure of the personal data to which they have access.

5.4.3. International transfer: Some suppliers, such as Meta, may process and store data on servers located outside Brazil. In these cases, Vita Imagem adopts the safeguards provided for in article 33 of the LGPD, such as contractual clauses and hiring suppliers that offer an adequate level of data protection.

5.4.4. Vita Imagem does not sell, rent or trade the Data Subjects’ personal data.

5.5. Retention of personal data and storage period

5.5.1. Any personal data held by Vita Imagem will be stored in accordance with the security standards and legally required levels to prevent or minimize privacy incidents.

5.5.2. Although Vita Imagem makes its best efforts to preserve privacy and protect the Data Subjects’ personal data, no transmission of information is completely secure, and it is always susceptible to technical failures, viruses or similar actions, so we may suspend our services, partially or entirely, without prior notice in case of a suspected security breach.

5.5.3. In any case, in the unlikely event of episodes of this nature, Vita Imagem guarantees its full effort to remedy the consequences of the event, always ensuring due transparency to you.

5.5.4. The Data Subjects’ data will be stored for the period strictly necessary to fulfill each of the purposes described above and/or in accordance with their respective legal and regulatory periods. The WhatsApp conversation history is kept on the service platform only for as long as needed for the service and to prove the services provided; information that becomes part of the patient’s medical record follows the legal retention period for medical records.

5.6 Rights of the personal data subject and how to exercise them

5.6.1. Under the applicable law (art. 18 of the LGPD), the data subject may at any time request confirmation that processing exists, access to the data concerning them, as well as its correction, anonymization, blocking, deletion or restriction of use of the personal data, the portability of their data, information about sharing, the withdrawal of consent, or object to its processing, except in the cases provided for by law. These rights may be exercised through a written request sent to the email: dpo@vitaimagem.com.br.

5.6.2. The Data Subject may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

5.7. Cookies and similar technologies

5.7.1. Cookies help websites work, or work more efficiently, and “remember” the actions and preferences recorded for future visits. Most browsers accept cookies; however, users can set their browsers to refuse specific cookies and can delete their cookie history at any time.

5.7.2. Below is the list of cookies used by Vita Imagem:

Types of cookies	What do they do?
Necessary	These cookies are essential for the Vita Imagem websites to load properly and allow you to browse correctly.
Performance	These cookies help us understand how visitors interact with the Vita Imagem pages, providing information about the areas visited, the time spent on the website and any problems found, such as error messages.
Functional	These cookies allow the Vita Imagem pages to remember your choices, to provide a personalized experience.
Social Media	These cookies are set by a range of social media services that we add to the website so you can share our content with your friends and acquaintances. They are able to track your browsing across other websites and build a profile of your interests. This may affect the content and messages you see on other websites you visit. If you do not allow these cookies, you may not be able to use or see these sharing tools.
Advertising	These cookies are used to provide more relevant content to you. They may be used to show advertising and allow measuring the effectiveness of an advertising campaign.

5.7.3. When you first access the Vita Imagem website, you will be informed about the types of cookies and the purposes for which they are used.

5.7.4. In addition to Vita Imagem cookies, the website also supports third party cookies, including for indexing the website in search engines. However, to understand the purposes of the data collected by these third party cookies, you need to visit the privacy policies of those companies. The third party cookies supported by our website are: Google Ads, Google Analytics, Facebook Pixel, Cloudflare and RD Station.

5.7.5. These mechanisms are used to check user traffic and behavior on the websites, enable the installation of other monitoring plugins and events on the website, and personalize and improve the content presented to data subjects.

5.7.6. Through its website, Vita Imagem provides links to third party websites, which are subject to independent Privacy Policies. This Data Privacy and Cookie Use Policy does not apply to such websites, and Vita Imagem is not responsible for how data subjects’ data is processed by those third parties.

5.7.7. Vita Imagem uses a software technology called web beacons (also known as web bugs, clear gifs or pixels) to help understand which content is effective, for example by counting the Data Subjects who visited certain pages.

5.7.8. Web beacons are small graphics with a unique identifier, with a function similar to cookies, used to find out whether certain content is viewed. Unlike cookies, which are stored on the Data Subject’s computer, web beacons are invisibly embedded in web pages. Vita Imagem may thus correlate the data collected by web beacons with other data already collected.

5.8 Information security

5.8.1. Vita Imagem strives to protect the privacy of the Data Subject’s Personal Data, but unfortunately cannot guarantee total security.

5.8.2. Unauthorized account access or use, hardware or software failure and other factors may compromise the security of the Data Subject’s Personal Data.

5.8.3. If you identify or become aware of anything that compromises Vita Imagem’s information security, please contact the Data Protection Officer.

5.9 Changes to the privacy and cookie policy

5.9.1. Vita Imagem may change this Data Privacy Policy at any time. These changes will be duly made available and published on the Vita Imagem websites, with the date of the last update.

5.10 WhatsApp service

5.10.1. Vita Imagem uses the official WhatsApp API (WhatsApp Business Platform), provided by Meta, integrated with the Chatwoot service platform, to talk with patients and interested parties. The app registered by Vita Imagem on the Meta developer platform serves exclusively for this integration: it does not offer Facebook login to the public, does not publish content on behalf of users and does not access contact lists, friends or other information from users’ Facebook, Instagram or WhatsApp accounts.

5.10.2. Data processed: phone number, WhatsApp name and profile photo, content of the messages and files you send us, as well as technical message information (date, time and delivery and read status).

5.10.3. Purposes: answering your questions; making, confirming, rescheduling or cancelling bookings; sending reminders and preparation instructions; informing about the availability of exam results and how to access them; handling ombudsman requests; and conducting satisfaction surveys. Promotional messages will only be sent to those who have expressly authorized receiving them.

5.10.4. Health data: medical orders, health plan cards and other health information sent on WhatsApp are treated as sensitive personal data, accessed only by the employees responsible for the service and used only to enable the requested exam. We recommend that you send only the information needed for the service. Vita Imagem never asks for passwords or full credit card details on WhatsApp.

5.10.5. Role of Meta: messages are transmitted through Meta’s infrastructure, which processes this data as Vita Imagem’s processor, under the WhatsApp Business Terms and Business Policy. Your use of the WhatsApp app is also subject to the WhatsApp Privacy Policy.

5.10.6. How to stop receiving messages: you may at any time request to unsubscribe by email at dpo@vitaimagem.com.br or block our number in the WhatsApp app itself. Messages essential to an ongoing service (such as the confirmation of a booked exam) may continue to be sent while that service lasts, unless you object.

5.11 How to request the deletion of your data

5.11.1. You can request the deletion of your personal data, including your WhatsApp conversation history, by email only, to dpo@vitaimagem.com.br. Deletion requests are not accepted on WhatsApp, by phone or in person. The full instructions are on the Data Deletion Instructions page.

5.11.2. Data that Vita Imagem is required to keep by law, such as the patient’s medical record (Law No. 13,787/2018), cannot be deleted before the legal period ends, but will remain blocked for any purpose other than fulfilling that obligation.

Version history

Version	Review date	Description of changes
00	29/11/2022	Initial issue.
01	13/10/2026	Addition of WhatsApp service (official Meta API and Chatwoot platform), international transfer, data deletion instructions and update of the Data Protection Officer contact.

Prepared by: Diego Rodrigo da Fonseca, Information Technology Manager
Validated by: Mariza Karpsak Lopes, General Manager
Approved by: José Glauber Monteiro, Operations Director