Privacy Policy

1. Data controller

Legal name

Auramedical Tecnologia da Informação Ltda

CNPJ

58.107.486/0001-41

Address

São Paulo, SP — Brasil

DPO

dpo@aura.med

General support

suporte@aura.med

2. Personal data we collect

We only collect what's necessary to deliver our telemedicine and preventive-care service. Four categories:

3. Sensitive health data

As a regulated health application, we process sensitive data per LGPD (Art. 5, II) definition. Categories:

• Intake and medical record: medical history, symptoms, habits, current medications, allergies, past surgeries. Generated by your use of the application and by consultations with our physicians.
• Apple HealthKit: metrics you authorize at connection time (heart rate, sleep, activity, weight, optional glucose, optional menstrual cycle). Aura never reads categories you have not explicitly authorized. Revocation is done in iOS Settings > Privacy > Health at any time.
• Garmin Connect: equivalent metrics — plus activities and workouts — received through the Garmin Connect Developer Program APIs, within the OAuth permissions you grant. Revocable at any time in the app or in your Garmin Connect account. The full lifecycle of this data is described in section 4.
• Lab results: results you upload to the app (photos taken with the in-app document scanner (camera), or images/PDFs from your photo library) or that integrated lab partners (future) send with your authorization.
• Consultation content: medical summary (not raw audio), digitally-signed prescriptions and chat messages with your physician.

Access to this data is restricted to you and the physician(s) treating you. Every view is logged in an audit trail.

4. Garmin data

This section describes, in one place, what data Aura Med receives from Garmin, which Garmin APIs we request and why, how that data is processed and stored, and who else has access to it — including third-party AI processing. It applies only to users who choose to connect a Garmin account. Direct link to this section: aura.med/en/privacidade#garmin.

4.1 How the connection works

• • The connection is always initiated by you, inside the Aura Med app. Aura Med never accesses a Garmin account that its owner has not explicitly authorized.
• • Authorization uses OAuth 2.0 with PKCE, on Garmin's own login screen. Aura Med never sees, receives or stores your Garmin username or password.
• • Garmin issues an access token and a refresh token to the Aura Med backend. Both are encrypted at rest with AES-256-GCM under a key held only by our server, are never sent to the mobile app, and are never written to logs.
• • Once connected, Garmin delivers data to a dedicated HTTPS endpoint on our backend through push (webhook) notifications. We also issue backfill requests so that your history is available from day one.
• • We request only the permissions required by the uses described in 4.2. The permissions actually granted are recorded per user, and Garmin notifies us whenever you change or revoke them — we act on that notification immediately.

4.2 Which Garmin APIs we use, and what for

Health API. What we receive: daily summaries (steps, distance, floors climbed, active and basal energy, active time, resting, average, maximum and minimum heart rate, moderate and vigorous intensity minutes); sleep (total duration, deep, light, REM and awake stages, naps, sleep score, and whether the night was measured by the device or estimated); heart-rate variability; stress and Body Battery; user metrics (VO₂ max and fitness age). What we use it for: this is the daily baseline of the app — it is what lets us show you your sleep, recovery and activity trends over time, and it is the input to the Aura Score, the single number the app uses to summarise how your week is going.

Activity API. What we receive: activity summaries and activity details — activity type, start time and time zone, duration, distance, calories, heart-rate and pace/speed data, elevation, laps and samples — and the corresponding activity files. What we use it for: daily totals cannot tell strength training from a tennis match, and step counts are blind to both. We need the named activity and its intensity in order to show you what you actually trained, to weigh training load against recovery instead of guessing at it from steps alone, and to keep the assistant described in 4.4 from reading a hard training day as a sedentary one. Activity files are read for their metric content; we do not republish them anywhere.

Workout API. What we send: structured workouts that you create or accept in Aura Med are pushed to your Garmin account so that they reach your device. What we use it for: so a session planned in the app can be executed on your watch without being retyped there. This is the only flow that moves data toward Garmin; it collects nothing about you.

Account linkage. Alongside the above we store the opaque Garmin user identifier issued to us, the permissions you granted, and connection and last-sync timestamps. We do not receive your Garmin account name, e-mail address or credentials.

We do not use Garmin data for advertising, for profiling on behalf of third parties, or for credit, insurance or employment decisions. We do not sell it, and we do not share it with data brokers.

4.3 How Garmin data is processed and stored

• • In transit: TLS 1.3 on every leg — Garmin to our backend, and our backend to the app (with certificate pinning).
• • At rest: a PostgreSQL database hosted on Supabase, encrypted with AES-256. Garmin records are stored per calendar day and tagged with their source.
• • Access control: row-level security means you are the only person who can read your rows. Every access is written to an immutable audit log with timestamp, user and IP.
• • Processing: we normalise Garmin payloads into daily metrics, convert units, and compute the indicators described in 4.2. We do not attempt to re-identify anyone, and we do not enrich or cross-reference Garmin data with datasets obtained from third parties.
• • Where it runs: our application server is hosted on Render and the database on Supabase, both US-based providers. This international transfer follows LGPD Art. 33 — see section 7.

4.4 Third parties and AI processing

Garmin data is shared with a closed list of subprocessors, each acting on our instructions and only for the purposes in 4.2:

• • Supabase — database and file storage.
• • Render — hosting for the application server that receives and processes Garmin push notifications.
• • Anthropic (Claude) — the language model behind Aura+, under the conditions stated immediately below.

Explicit statement on third-party AI processing. Aura+ is an AI assistant built on Anthropic's Claude API. When — and only when — you have given a separate, explicit and auditable opt-in for AI processing of your health and fitness data, a snapshot is sent to Anthropic's API to generate the assistant's answer. That snapshot includes Garmin-derived metrics (for example resting heart rate, HRV, sleep stages and score, steps, intensity minutes, VO₂ max, stress, Body Battery, and the count, duration and named type of your activities) together with your display name, age, biological sex and the biometrics you entered yourself. It does not include your Garmin OAuth tokens, your Garmin user identifier, your government ID, or your payment data.

This consent is checked before every single request and fails closed: if it is absent, revoked or cannot be verified, no Garmin-derived data is sent to any AI provider and the feature does not run. Anthropic acts as our subprocessor under its commercial API terms and does not use the data to train its models. You may withdraw the consent at any time in the app, which stops all further AI processing.

No other third party receives Garmin data. It is never sent to advertising networks, marketing intermediaries, analytics products or data brokers, and it is never used to train any AI model — ours or anyone else's.

4.5 Your control: disconnect, revoke, delete

• • Disconnect in the app: we call Garmin's deregistration endpoint, mark the connection inactive, delete the stored tokens and stop every sync. No further Garmin data reaches us.
• • Revoke at Garmin: you can also remove Aura Med's access from your Garmin Connect account. Garmin notifies our backend and we stop processing on receipt of that notification.
• • Delete your account (app → You → Account → Delete account): this erases your Garmin connection, its tokens and every Garmin-derived metric we hold about you.
• • Deletion on request: you can also write to dpo@aura.med and ask us to erase your Garmin data without deleting your account. We do it within 5 business days, free of charge.
• • While you stay connected, Garmin-derived metrics are retained so that the app can show you your own history and trends, within the window set out in section 8.

5. Purpose and LGPD legal basis

We process your data on the basis of LGPD Articles 7 and 11:

• Express consent (Art. 11, I): for processing health data, wearables integration, optional marketing. Revocable at any time.
• Contract performance (Art. 7, V): to deliver the medical consultation, process payment, issue prescription.
• Legal/regulatory obligation (Art. 7, II and Art. 11, II "a"): medical-record retention for 20 years (CFM 1.821/2007), tax documents, compliance with CFM 2.314/2022.
• Health protection (Art. 11, II "f"): use of assistive AI (Aura+) to support the physician's clinical decision.

6. Sharing with third parties (data processors)

We share strictly necessary data with the following processors. Each one has a Data Processing Agreement (DPA) preventing use for any other purpose:

We do not sell your data. We do not share it with advertisers or marketing intermediaries. We do not use your data to train third-party AI models.

7. International data transfer

Some processors listed in section 6 are headquartered outside Brazil (mostly in the US). The transfer follows LGPD Art. 33 via standard contractual clauses and processor-specific guarantees (SOC 2, ISO 27001 where applicable).

The medical-record server (Supabase) runs on infrastructure with configurable residency; the telemedicine video (Agora.io) uses Brazil data residency to comply with CFM 2.314/2022.

8. Data retention

We apply the following retention matrix:

Intake and medical record

20 years (CFM Resolution 1.821/2007)

Prescriptions and reports

20 years (same basis)

Wearable metrics

5 years rolling (most recent)

Clinical chat messages

20 years (part of the medical record)

Navigation and security logs

12 months

Access audit logs

5 years

Financial data (invoice, receipt)

5 years (Brazilian tax law)

After the retention period, data is securely deleted or irreversibly anonymized for statistical research.

9. Technical security

Technical and organizational measures we apply:

• • Encryption in transit (TLS 1.3) with certificate pinning in the iOS app to prevent man-in-the-middle interception.
• • Encryption at rest in the Postgres database on Supabase (AES-256).
• • Row-level security — you can only read/write your own data; physicians can only access patient data during an active consultation.
• • Apple's App Attest to verify device authenticity before any sensitive request.
• • Short-lived authentication tokens (JWT) with automatic rotation.
• • MFA mandatory for the administrative team and physicians.
• • Immutable audit logs — every view of the medical record is recorded with timestamp, user and IP.

10. Your LGPD rights and how to delete your data

You have all LGPD Article 18 rights: confirmation, access, correction, anonymization, portability, deletion, consent revocation and information about sharing.

How to delete your account and data

The fastest way is directly in the app:

1. Open the Aura Med app on your iPhone.
2. Tap the You tab.
3. Tap Account, then Delete account.
4. Confirm with Face ID/Touch ID.

Deletion immediately removes your account data, settings and wearable metrics. The medical record (intake, consultations, prescriptions) remains archived for the 20 years required by CFM 1.821/2007 — after which it is automatically deleted. During that period, access is restricted to you (on request for a copy) and to competent authorities in case of legal proceedings.

If you can't access the app

Email dpo@aura.med. Response within 5 business days.

Other rights

To access, correct, port or anonymize your data, or to revoke consent for specific integrations (Apple HealthKit, Garmin), use the same DPO email. We do not charge a fee.

11. Apple Privacy Labels and changes

Our App Privacy declarations on App Store Connect faithfully reflect what is described above. Declared categories:

• • Health & Fitness: wearables and medical-record data.
• • Contact Info: full name, email, phone (account).
• • Identifiers: internal user ID, App Attest device ID.
• • Diagnostics: technical crash reports for bug fixing and anonymized performance metrics.
• • User Content: intake, clinical chat messages.
• • Photos or Videos: ID document and selfie photos for KYC verification (via Didit); photos of lab results you upload via the in-app document scanner (camera) or the photo library.

We do not declare: Browsing History, Search History, precise Location, Sensitive Info beyond the health scope, cross-app Tracking. Aura never invokes Apple'sApp Tracking Transparency prompt (we don't ask for tracking permission because we don't track).

Policy changes

Material updates (purpose change, new processor, new data type) are communicated in the application 30 days in advance and require new consent. Editorial updates or minor corrections are published here without individual notification.

Contact

DPO: dpo@aura.med
Support: suporte@aura.med

You may also file a complaint directly with the Brazilian Data Protection Authority (ANPD) at www.gov.br/anpd.