Terms of Use and Privacy Policy

1. Identification of the Data Controller

Data Controller: Ominia Tecnologia Ltda. — Company registration (CNPJ) in process
Platform: Ominia — AI-powered clinical management system
Data Protection Officer (DPO) Email: privacidade@ominia-ai.com
Address: Available upon request via the email above.

2. Purpose and Nature of the Service

Ominia is a SaaS (Software as a Service) platform designed to support the management of clinics and medical practices, offering:

• Patient management and electronic medical records;
• Transcription and analysis of clinical appointments using generative artificial intelligence (Google Gemini);
• Automated generation of clinical documents (SOAP notes, reports, PDFs);
• Clinical communication and email notifications;
• Secure storage of clinical and administrative data.

The platform is provided as a clinical decision-support tool and does not replace the judgment of a licensed healthcare professional. All clinical responsibility remains with the healthcare professional using the platform.

3. Terms of Use and Eligibility

3.1. Authorized User

Access to the platform is restricted to:

• Healthcare professionals legally licensed by their respective professional boards;
• Managers and staff of duly registered healthcare establishments;
• Legal entities in the healthcare services industry with an active contract.

3.2. User Obligations

The user agrees to:

• Use personal, non-transferable access credentials and never share them;
• Enter patient data only with proper consent or an established legal basis;
• Immediately report any suspected unauthorized access to their account;
• Comply with all legislation applicable to the exercise of their professional activity;
• Refrain from reverse engineering, scraping, or any attempt at unauthorized access to the system;
• Not use the platform for unlawful purposes or purposes contrary to professional ethics.

4. Personal Data Collected

4.1. System User Data

• Identification: full name, professional email, access level;
• Authentication: encrypted password (bcrypt), session tokens;
• Activity: IP address, access date/time, user agent (browser);
• Settings: theme preferences, clinic logo.

4.2. Patient Data (Sensitive Data — Art. 11 LGPD)

Patient data entered into the platform is classified as sensitive personal data under Art. 5, Item II of the LGPD, and includes:

• Identification data: name, date of birth, national ID numbers, gender, marital status, occupation;
• Contact data: phone number, email, full address;
• Health data: medical history, records, clinical history, diagnoses, prescriptions;
• Appointment records: audio transcriptions (when authorized), SOAP notes;
• Basic financial data: insurance information, where applicable.

5. Legal Bases for Processing

The data processing carried out by the platform is based on the following legal bases provided for in the LGPD:

• Contract performance (Art. 7, V): processing necessary for the provision of the contracted services;
• Consent (Art. 7, I / Art. 11, I): for patients' sensitive health data, obtained by the professional users;
• Health protection (Art. 11, II, f): for health data processed in a care context;
• Protection of life (Art. 7, VII): in situations involving risk to the patient;
• Legitimate interest (Art. 7, IX): for platform security and fraud prevention purposes;
• Compliance with a legal obligation (Art. 7, II): for responding to requests from competent authorities.

6. Purposes of Data Processing

The data collected is used exclusively for:

• Authentication and access control to the platform;
• Provision of the contracted clinical management services;
• Processing of AI transcriptions and analyses to support the professional;
• Generation of clinical documents and reports;
• Sending service-related communications (alerts, password resets);
• Security: detection of unauthorized access, fraud and attack prevention;
• Improvement and development of the platform, in anonymized form;
• Compliance with legal and regulatory obligations.

Express prohibition: Data will not be sold, transferred, or shared with third parties for commercial or advertising purposes.

7. Sharing Data with Third Parties

Data may only be shared in the following situations and with the following parties, always under confidentiality and data protection agreements:

• Google LLC (Gemini AI): clinical transcriptions and texts are processed through the Google Gemini API to generate analyses. This processing is governed by Google's Privacy Policy and API Terms of Service for enterprise use;
• Hosting provider: servers where the application is hosted, limited to infrastructure access;
• Email provider (Hostinger): for sending the system's transactional notifications;
• Public authorities: pursuant to a court order or request from a competent authority, to the extent legally required.

8. Data Subject Rights (Art. 18 of the LGPD)

Every data subject has the right, upon request to our DPO, to:

• Confirmation of the existence of processing of their data;
• Access to the data we hold about them;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of the LGPD;
• Portability of data to another provider, upon express request;
• Deletion of personal data processed with consent, except in legally required retention cases;
• Information about public and private entities with which we share data;
• Withdrawal of consent at any time, upon express request;
• Objection to processing based on other legal bases in case of non-compliance.

To exercise your rights, contact us at: privacidade@ominia-ai.com. We will respond within 15 (fifteen) business days.

9. Data Retention and Disposal Period

Data is retained for the following periods:

• Account data: for the duration of the contract, plus 5 (five) years after termination;
• Clinical records and data: a minimum of 20 (twenty) years, in accordance with CFM Resolution No. 1,821/2007;
• Access logs: 6 (six) months, in accordance with Art. 15 of the Marco Civil da Internet;
• Session data: 24 (twenty-four) hours after the session ends;
• Security records: 1 (one) year, for incident prevention and investigation purposes.

After the legal retention period, data will be securely deleted or irreversibly anonymized.

10. Data Security

We adopt the following technical and organizational measures to protect your data:

• Encrypted transmission via HTTPS/TLS 1.3 across all communications;
• Password encryption with bcrypt (high cost factor);
• Session tokens stored server-side (MySQL), with automatic expiration;
• HTTP security headers (HSTS, CSP, X-Frame-Options, etc.) via Helmet.js;
• Login attempt rate limiting and IP-based blocking;
• Protection against XSS, CSRF, SQL Injection, HPP, and Path Traversal;
• Role-based access control (Admin, Master, User);
• CSRF tokens on all forms;
• Auditing of suspicious access with automatic blocking;
• Regular backups with encryption at rest.

In the event of a security incident that may pose a relevant risk or harm, we will notify the ANPD (Brazilian National Data Protection Authority) and affected data subjects within a maximum of 72 (seventy-two) hours, in accordance with Art. 48 of the LGPD.

11. Use of Artificial Intelligence

The platform uses the Google Gemini generative AI model to process audio transcriptions and text from clinical appointments. Regarding this processing:

• Data is transmitted to the Google API securely via HTTPS;
• Processing is carried out for clinical support purposes, not for training third-party AI models (in accordance with Google's API terms for enterprise use);
• The professional must obtain the patient's consent before making recordings and transcriptions;
• AI-generated analyses are advisory and do not constitute a definitive medical diagnosis;
• All AI-generated content must be reviewed by the professional before being incorporated into the official medical record.

12. Cookies and Session Technologies

We exclusively use cookies that are essential to the platform's operation:

• ominia_sid: HttpOnly, Secure, SameSite=Lax session cookie — stores the authenticated user's session identifier. Required for the system to function. Expires after 24 hours of inactivity.

We do not use tracking, analytics, or advertising cookies.

13. International Data Transfer

Data processed by the Google Gemini API may be temporarily transferred to servers in the United States of America. This transfer is based on the Standard Contractual Clauses (SCCs) adopted by Google and complies with Art. 33 of the LGPD, which permits international transfers to countries or international organizations that provide a level of personal data protection adequate to that set forth in Brazilian law.

14. Limitation of Liability

Ominia Tecnologia is not responsible for:

• Clinical decisions made based on AI-generated analyses;
• Data entered incorrectly or without a legal basis by the professional user;
• Service unavailability resulting from force majeure, fortuitous events, or third-party infrastructure failures;
• Unauthorized access resulting from user negligence (weak passwords, credential sharing).

15. Changes to This Document

We may update these Terms at any time, with prior notice to the user by email or platform message, at least 15 (fifteen) days in advance. Continued use of the platform after the changes take effect constitutes acceptance of the new terms. Previous versions will remain available for consultation upon request.

16. Data Protection Officer (DPO)

Pursuant to Art. 41 of the LGPD, we designate the following as our Data Protection Officer:
Email: privacidade@ominia-ai.com
Availability: response within 15 business days for data subject requests.

17. National Data Protection Authority

If you believe that the processing of your personal data violates data protection legislation, you may file a complaint with the Brazilian National Data Protection Authority (ANPD): www.gov.br/anpd

18. Governing Law and Jurisdiction

This document is governed by the laws of the Federative Republic of Brazil. The courts of the user's place of domicile are elected to settle any disputes arising from this instrument, in accordance with Art. 101, Item I, of the Brazilian Consumer Protection Code, except in cases of exclusive jurisdiction provided for by law.