Data agreement

Data Processing Agreement (DPA)

Version 1, in force since October 16, 2026. · Versão em português

In the NAVSTEC System, the client business decides about its contacts’ data. We handle that data only to provide the service, the way the client instructs. This agreement says what we may and may not do with it, how we protect it, who helps us, what we do in an incident and how it all ends. It is part of the NAVSTEC System Terms.

1. Parties and roles

• Processor: NAVS TECNOLOGIA E CONSULTORIA LTDA, owner of the NAVSTEC brand, Brazilian company registration (CNPJ) 69.476.914/0001-20, Av. Raja Gabaglia, 1617, sala 501, Luxemburgo, Belo Horizonte, Minas Gerais, Brazil, ZIP 30380-435 (“NAVSTEC” or “we”).
• Controller: the business that subscribes to the NAVSTEC System (app.navstec.com and the “NAVSTEC Sistema” Meta app), the “client”.

The roles follow Brazil’s General Data Protection Law (LGPD, Law 13,709/2018). The controller is the person “to whom the decisions regarding the processing of personal data belong” (art. 5, VI). The processor is whoever “carries out the processing of personal data on behalf of the controller” (art. 5, VII). We call a subprocessor any company we hire that handles the client’s data to help us provide the service (section 7). Quotations from Brazilian law in this English version are our translations.

This agreement is part of the NAVSTEC System Terms and applies from the moment the client accepts the proposal, signs the contract or starts using the system. On personal data, this agreement prevails over the Terms. The signed contract may add rules; it only changes this agreement if it says so expressly.

For the data of the people who use the system (login, security, support and billing), NAVSTEC is the controller, as explained in the Privacy Policy. That data is outside this agreement.

2. Subject matter and instructions

We handle the client’s personal data only to provide the NAVSTEC System (CRM, Conversations and Dashboard) and support, and only as the client instructs. That is what the LGPD says: “The processor shall carry out the processing according to the instructions provided by the controller” (art. 39).

2.1 What counts as the client’s instructions

• the contract, the Terms and this agreement;
• what the client configures and does in the system: connecting or disconnecting channels (WhatsApp, Instagram, Messenger, Lead Ads), sending messages, importing, exporting and deleting contacts, choosing roles and permissions, turning on the Conversions API, the health form or artificial intelligence;
• written requests from the account administrator to [email protected].

2.2 An instruction that seems unlawful

If an instruction seems to us to breach the LGPD or another law, we tell the client and may hold off on it until the client clarifies.

2.3 What we never do with the client’s data

• sell or rent it;
• use it in our own ads or anyone else’s;
• use it to train artificial intelligence;
• combine it with other clients’ data;
• read the conversations, except in support approved by the account owner (section 5) or when the law requires.

2.4 Requests from authorities

If an authority or a court orders us to hand over the client’s data, we tell the client before doing so, unless the order forbids it, and we hand over only what the order asks for.

3. What data, about whom and why

Purpose: to provide the NAVSTEC System and support to the client. Nature: receiving (through the integrations and the screens), storing, organizing, showing to the client’s team, sending messages, exporting and deleting.

Data subjects: the client’s contacts, leads and customers; in health accounts, the patients; and the people mentioned in conversations and files.

Category	What it is
Identification and contact	Name, phone number, e-mail, profile photo (when the platform provides it) and each platform’s identifiers (WhatsApp, Instagram, Messenger).
Conversations	Text, photos, audio, videos, documents, reactions and delivery and read status. They may contain sensitive data people write on their own, such as about health.
Sign-ups	Answers to Lead Ads forms and to the client’s website forms, with the campaign, ad and form they came from.
CRM records	Deals, pipeline stages, amounts, tasks, notes, appointments and tags.
Measurement	Only if the client turns it on: conversion notices to Meta (Conversions API), with e-mail, phone number and country as a code (SHA-256 hash) and the identifiers created by Meta. Never names, messages or notes. Off by default in health accounts.
Health form	Only in accounts with the form turned on: medical history, consent form, signature, signature trail, before-and-after photos and the image-use consent. This is sensitive personal data (Annex II).

The LGPD calls sensitive, among others, “data concerning health or sex life, genetic or biometric data, when linked to a natural person” (art. 5, II).

4. Duration

This agreement lasts as long as the contract and, after it, until the data has been returned and deleted (section 12). Confidentiality, the records the law requires us to keep and the retention rules of Annex II continue to apply after the end.

5. NAVSTEC’s duties

• Follow the instructions in section 2 and handle only the data that is needed.
• Team confidentiality: only people who need the client’s data for the service have access to it, and each person commits in writing to confidentiality before the first access. The LGPD requires anyone involved in the processing to ensure security “even after it ends” (art. 47).
• Support only with approval: NAVSTEC staff are not members of the clients’ accounts. They only enter an account when the owner approves, for up to 8 hours at a time, read-only, and each entry is logged. Support never reads the health form: the database itself denies it.
• Record of operations: the system logs the important actions (logins, exports, permission changes, deletions, support entries), as the LGPD requires: “The controller and the processor must keep a record of the personal data processing operations they carry out” (art. 37).
• Help the client comply with the law: with the information we have for the impact report (art. 38), for answers to the ANPD and to data subjects, and for risk assessments.
• Tell the client if we cannot comply with this agreement.

6. Security

The LGPD requires agents to adopt “technical and administrative security measures able to protect personal data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any form of improper or unlawful processing” (art. 46). These are the measures the system has today:

• Data in Brazil: the server and the database are on AWS in São Paulo. Only the disaster recovery copy and whatever goes through the features and platforms the client turns on leave the country (section 8).
• Each business sees only its own data: the isolation is done in the database itself (PostgreSQL row-level security, enabled and forced on every table with client data). The system connects to the database with a user without administrator powers, which cannot bypass that rule. Before each release, an automatic check tries to read one account’s data from another and, if it succeeds, the release stops.
• Encryption: the database is encrypted with our own key, managed in the AWS key service (KMS), and the backups are encrypted too. Meta access tokens and two-step login secrets are encrypted a second time, each with its own key (envelope encryption), bound to the client’s account: copied to another account, they do not open. Files from conversations and from the health form are encrypted one by one, in the same way.
• Login: passwords are stored only as an irreversible code (Argon2id). Two-step verification is mandatory for everyone, with an authenticator app and recovery codes, and with a passkey when available. After several wrong attempts, login is locked for a while. A session ends after 60 minutes idle or 12 hours in total. Exporting and changing permissions ask for the password and the code again.
• Permissions by role: the administrator chooses what each role sees and does (for example, seeing phone numbers, exporting, seeing health forms), and the database enforces the rule.
• Access and action logs: each login is logged with date, time and IP address, for at least 6 months (Brazil’s Internet Civil Framework, Law 12,965/2014, art. 15). The action log only accepts new lines and each line carries the code (hash) of the previous one, so a hidden change shows up.
• Network and technical access: the database has no public address and only accepts connections from the system’s server. Technical access to the server is by key only and only from authorized addresses. Everything travels over a protected connection (HTTPS).
• Technical logs without personal data: server logs carry no names, phone numbers, e-mails or messages and are deleted after 30 days.
• Backups: automatic, with recovery to any point in the last 35 days, and a copy in another AWS region for disasters.

Certification and external audit: a certification (such as ISO 27001 or SOC 2) and a penetration test by an outside firm go into the security report (section 11) once they are done. No system is invulnerable; that is why section 9 exists.

7. Subprocessors

The list of subprocessors, with what each one does, the country and the transfer basis, is in Annex I. The client authorizes the use of that list by accepting this agreement.

• We only use subprocessors that have written data protection terms, and we give them only what they need for the service they provide.
• Optional features (artificial intelligence, websites we host) only send data to the subprocessor when the client’s account turns the feature on.
• We answer to the client for what the subprocessors do in the service they provide to us, within the limits of section 13.

7.1 How we announce changes

• 30 days’ notice: before a new subprocessor receives the client’s data, we e-mail the account administrator 30 days in advance and update Annex I and the version history.
• Right to object: the client may object in writing within 15 days of the notice, with a reason related to data protection. We look for a solution (for example, not using the new subprocessor in that account). If there is none, the client may end the contract, or only the affected part, without penalty.
• Emergencies: if a subprocessor has to be replaced suddenly, to protect the data or keep the service running, we notify as soon as possible, and the right to object still applies.

7.2 What is not a subprocessor

The platforms the client connects with its own accounts (Meta’s WhatsApp, Instagram, Messenger, Facebook and ad accounts) and the integrations the client chooses to turn on are a direct relationship between the client and that provider, under that provider’s terms. The system only sends and receives data through them because the client instructed it to. They are listed separately in Annex I so the client knows where the data travels.

8. International transfers

The system’s data is kept in Brazil. The LGPD only allows personal data to be transferred to another country in the cases listed in art. 33. For businesses, there are two common routes: a destination the ANPD has recognized as offering “adequate” protection (art. 33, I) and the ANPD’s “standard contractual clauses” (art. 33, II, “b”).

8.1 Where the rules stand today

• European Union: adequate. “The European Union is recognized as an international organization that provides a degree of personal data protection adequate to that provided for in Law No. 13,709 of August 14, 2018, for the purposes of international data transfer” (ANPD Board Resolution CD/ANPD No. 32/2026, art. 1). It also covers Iceland, Liechtenstein and Norway.
• United States: no adequacy decision. Sending data there requires another mechanism, usually the ANPD standard clauses.
• ANPD standard clauses: the text is Annex II of ANPD Board Resolution CD/ANPD No. 19/2024 and only works with “the full adoption, without alteration, of the text made available in Annex II, through a contractual instrument signed between the exporter and the importer” (art. 16). Between two processors (us and a subprocessor), the option “exclusive to international data transfers carried out between processors” applies, with the client named as “Third-Party Controller”.
• Other countries’ clauses are not enough: the ANPD may recognize foreign clauses as equivalent (Res. 19/2024, art. 18), but so far it has recognized none, not even the European standard contractual clauses found in providers’ contracts.

8.2 What is possible today and what is not

• Possible: sending data to the European Union, based on adequacy; and to the United States, when the provider signs the ANPD standard clauses.
• Not possible: forcing a large provider to sign a text it does not offer; using the European clauses as if they were Brazilian; or adopting the ANPD clauses only “by reference”, without an instrument signed by both companies.
• Our rule: no client data leaves Brazil for a destination without a valid basis. Every transfer in Annex I has its basis. Where there is none, the data stays in Brazil or the European Union, or the feature stays off.

8.3 What leaves Brazil

• Disaster recovery copy (AWS): today it is kept in an AWS region in the United States (Northern Virginia). AWS does not offer the ANPD standard clauses: its data processing addendum only includes the European Union, United Kingdom and Swiss clauses. And the database’s automatic copy from São Paulo can only go to the United States. So, before the first client puts data into the system, the disaster recovery copy will be made in an AWS region in the European Union (an adequate destination) or kept only in Brazil. Client data does not go to the copy in the United States.
• Artificial intelligence (when it exists and the client turns it on): the planned providers (Anthropic and OpenAI, in the United States) do not offer the ANPD clauses either. AI is only turned on in a client account with a valid basis: the ANPD standard clauses signed by the provider, processing in the European Union, or a provider that processes the data in Brazil. Until then, it stays off.
• Forms on websites we host (Cloudflare, when hired): Cloudflare does not offer the ANPD clauses either. We only host client forms with the forms database stored in the European Union.
• Meta’s platforms (WhatsApp, Instagram, Messenger): on the WhatsApp API, Meta is the client’s processor, and its terms already incorporate the ANPD standard clauses, with the client as exporter and Meta Platforms, Inc. as importer. Meta also uses some data as a controller, for the safety and integrity of its platform.
• Google and TikTok (when the client turns them on): the data goes through the client’s direct relationship with each of them (section 7.2).

8.4 Transparency

The controller must publish, in Portuguese and in plain language, information about international transfers, such as the destination country and the purpose (Res. 19/2024, art. 17, § 2), and give any data subject who asks “the full text of the clauses used” (art. 17), within 15 days. This section and Annex I provide that information, and the client may point to this page in its own privacy policy. If a data subject asks for the clauses, we send the client the copy within 5 business days.

9. Security incidents

For the ANPD, a security incident is “any confirmed adverse event related to a breach of the confidentiality, integrity, availability and authenticity properties of the security of personal data” (ANPD Board Resolution CD/ANPD No. 15/2024, art. 3, XII).

9.1 We notify the client within 24 hours

We notify the account administrator within 24 hours of the moment we learn of an incident affecting the client’s data, even before we have every detail. The deadline is short on purpose: the client is the one who notifies the ANPD and the data subjects (LGPD, art. 48), and its deadline is “three business days” (Res. 15/2024, art. 6), counted “from the controller’s knowledge that the incident affected personal data” (art. 6, § 1). The same deadline applies to notifying data subjects (art. 9). The ANPD advises that the processor inform the controller “without undue delay” and give it all the information it needs.

9.2 What the notice contains

What we know of each item the ANPD requires in the notification (Res. 15/2024, art. 6, § 2), and the rest as soon as we know it:

• a description of the incident and its main cause, if it can already be identified;
• the date it happened, when it can be determined, and the date we learned of it;
• the nature and category of the personal data affected;
• the number of data subjects affected, with children, adolescents and elderly people listed separately, when known, and the total number of data subjects in the account;
• the security measures used before and after the incident;
• the risks and possible impacts on data subjects;
• what we have done and will do to contain the incident and reduce its effects;
• our identification as processor and the contact of whoever is handling the case.

9.3 What we do next

• Contain and preserve evidence: we cut off the improper access, rotate the keys involved and keep the logs, without exposing more personal data.
• Complete: we send new information as soon as we have it, in time for the client to complete its notification to the ANPD, which it may do “within twenty business days from the date of the notification” (Res. 15/2024, art. 6, § 3).
• Help notify data subjects: the notice must be in “simple language” and made “directly and individually, if it is possible to identify them” (art. 9, § 1). We help the client with the list of those affected and the text.
• We do not speak for the client: we do not notify the ANPD or data subjects on the client’s behalf, unless the client asks in writing or the law requires us to.
• Record: we record every incident, including those that need no notification, for at least 5 years, and give the client what it needs for its own record, which the ANPD requires “for a minimum period of five years” (Res. 15/2024, art. 10).

10. Data subjects’ rights

Under the LGPD (art. 18), data subjects may ask, among other things, for confirmation of and access to their data, correction, anonymization, blocking or deletion, portability and withdrawal of consent. The client, as controller, is the one who answers. We help like this:

• The system has the tools: view, correct, export and delete a contact. Deleting moves the contact to the trash for 30 days, to undo a mistake; after that it is gone for good.
• Requests that reach us: we forward them to the client within 2 business days and do not answer on the client’s behalf, unless asked to.
• What the system does not do on its own, we do at the client’s request within 5 business days, so the client can meet the legal deadline: the full statement to the data subject must be given “within up to 15 (fifteen) days from the date of the data subject’s request” (art. 19, II).

11. Audits

• Report and questionnaire: once a year, or after an incident, we give any client who asks a security report (measures, subprocessors, incidents and checks performed) and answer a reasonable security questionnaire within 30 days.
• Inspection: if the report is not enough, the client, or its auditor bound by confidentiality, may inspect compliance with this agreement, with 30 days’ notice, during business hours, at most once a year, except after an incident or by order of the ANPD. The inspection gives no access to other clients’ data or to security keys and secrets.
• Cost: each party pays its own cost of the inspection. If it shows that we breached this agreement in a relevant way, we also pay the client’s reasonable cost.
• ANPD: we cooperate with Brazil’s National Data Protection Agency (ANPD) when it asks for information about the processing we do for the client.

12. End of the contract: return and deletion

• Export: at the end of the contract, for any reason, the client has 30 days to export its data (contacts, deals and conversations, in open-format files such as CSV or JSON; in health accounts, also the forms, as Annex II says), through the system itself or with our help.
• Deletion: after those 30 days, we delete the client’s data within another 30 days.
• Backups: they stay encrypted and the data leaves them as each copy expires (the database’s automatic backups, within 35 days). Until then they are not used, except to recover the system from a disaster; if that happens, we delete again what had already been deleted.
• What remains: only what the law requires us to keep, such as access logs (6 months, Internet Civil Framework, art. 15), the action and incident logs and tax documents. The LGPD allows keeping data for “compliance with a legal or regulatory obligation” (art. 16, I).
• Statement: if the client asks, we provide a written statement that the data has been deleted.

13. Liability

• Each party is liable for the damage it causes by breaching the LGPD or this agreement (LGPD, arts. 42 to 45).
• The client is responsible for the legal basis of each processing, for informing data subjects, for the content it puts in the system and for the instructions it gives.
• NAVSTEC is responsible for the security it promises here and for following the client’s lawful instructions. The LGPD says that “the processor is jointly liable for the damage caused by the processing when it breaches the obligations of the data protection legislation or when it has not followed the controller’s lawful instructions” (art. 42, § 1, I).
• Whoever pays damages to a data subject may recover the other party’s share (art. 42, § 4).
• Limit between the parties: NAVSTEC’s total liability to the client under this agreement is limited to the amount the client paid NAVSTEC in the 12 months before the event, except for wilful misconduct, gross negligence or where the law does not allow a limit. The limit applies only between the parties: it does not reduce data subjects’ rights or ANPD sanctions.

14. Governing law and venue

This agreement is governed by the laws of Brazil, in particular the LGPD and the ANPD resolutions. The courts of Belo Horizonte, Minas Gerais, Brazil, are chosen, without prejudice to consumer rights provided by law. This English version is a translation of the Portuguese version; if they differ, the Portuguese version prevails.

15. Contact

• Data protection officer and any matter in this agreement: [email protected]. It is the same channel as in the Privacy Policy.
• Incidents: the same e-mail and WhatsApp +55 31 97557-1835, starting with the word “Incident”.
• Do not send contacts’ or patients’ data by e-mail or WhatsApp: e-mail goes through Google (Gmail) and WhatsApp through Meta. To show us a case, use the system itself or give only the contact’s identifier.

Annex I. List of subprocessors

I.1 NAVSTEC’s subprocessors

Subprocessor	What it does	Country	Transfer basis
Amazon Web Services (AWS)	Server (EC2), PostgreSQL database (RDS), encryption keys (KMS), system secrets (Secrets Manager), system e-mails (SES), technical logs and alerts (CloudWatch) and, when turned on, file storage (S3).	Brazil (São Paulo)	No international transfer.
Amazon Web Services (AWS): disaster recovery copy	Encrypted copy of the database backups, to recover the system if the São Paulo region fails.	Today, United States (Northern Virginia). For client data, European Union or Brazil.	European Union: adequacy (LGPD, art. 33, I; Res. CD/ANPD No. 32/2026). United States: AWS does not offer the ANPD standard clauses, so the copy there does not receive client data (section 8.3).
Cloudflare	The system’s domain names (DNS), without routing the data through it (no proxy): it receives no personal data from the system. Only when NAVSTEC hosts the client’s website: that website’s forms (Worker and D1 database).	United States (company) and worldwide network	DNS: no transfer of system data. Forms: database in the European Union (adequacy); Cloudflare does not offer the ANPD standard clauses.
Anthropic	When the client turns it on; not yet available. Text artificial intelligence: summaries, reply suggestions, tags and agents. Never the health form.	United States	Only with a valid basis (section 8.3); without one, AI is not turned on.
OpenAI	When the client turns it on; not yet available. Audio transcription. Never the health form.	United States	Only with a valid basis (section 8.3); without one, transcription is not turned on.

When artificial intelligence or website hosting is launched, the 30-day notice in section 7.1 applies before any client data goes to those providers.

I.2 Platforms and integrations the client connects (not NAVSTEC subprocessors)

Platform	What for	Country	Relationship
Meta Platforms	WhatsApp (official API), Instagram, Messenger and Lead Ads: where messages and sign-ups come in and go out. Conversions API, only if the client turns it on.	Several countries	Meta’s terms with the client, which already incorporate the ANPD standard clauses (section 8.3).
Google	When the client turns it on; not yet available. Google Ads and Google Analytics 4 (conversions), Google Calendar (appointments) and Google Drive (files the client chooses). Details in the Privacy Policy, item 3.8.	Several countries	The client’s direct relationship with Google.
TikTok	When the client turns it on; not yet available. Marketing API and Events API (conversions and ad results). Details in the Privacy Policy, item 3.9.	Several countries	The client’s direct relationship with TikTok.

Annex II. Health data addendum

This addendum completes the agreement in accounts with the health sector turned on: clinics and professionals who use the health form (medical history), the consent form and before-and-after photos. Turning on the health form turns on the account’s health sector and, after that, it does not turn off. In case of conflict, this addendum prevails over the rest of the agreement.

II.1 Legal basis

• The form handles sensitive personal data (LGPD, art. 5, II). The clinic, as controller, chooses the legal basis.
• To care for the patient, the basis is usually art. 11, II, “f”: “protection of health, exclusively, in a procedure carried out by health professionals, health services or health authorities”. It only applies when whoever provides care is a health professional or service.
• Otherwise, the clinic must use the consent in art. 11, I: “when the data subject or their legal guardian consents, in a specific and highlighted way, for specific purposes”.
• For children, the “specific and highlighted consent given by at least one of the parents or by the legal guardian” applies (art. 14, § 1).
• Using photos on social media, in ads or in a portfolio is another purpose and requires a separate consent (II.7).

II.2 What is kept in the system

Item	What we keep
Form (medical history)	The template’s questions, in the version used, and the person’s answers, encrypted.
Consent form	The exact text of the version the person read. Each template version is frozen, with the code (SHA-256 hash) of the questions and of the consent text.
Signature	The drawing made with the finger or the name typed by the person.
Trail	When the link was sent, opened (with IP address and browser), filled in, the consent read, the code checked (if used) and the form signed, always in server time, and the destination WhatsApp number.
Final document	A PDF of the signed form and the document’s SHA-256 code: any change after signing changes the code.
Before-and-after photos	The photos, by procedure and by day.
Paper form	The photo or PDF of the form signed on paper, attached by the clinic.
Image use	Whether or not the person allows the photos to be used outside care, with the date.
Clinical alert	Only a sign that there is an alert (for example, a marked allergy), without its content, for the care team to see.

II.3 Who can see it

• The account administrator and whoever the administrator authorizes with the “See health forms” permission. It is not turned on in any new role: the administrator has to grant it on purpose.
• Whoever only has the “Send forms” permission (the front desk, for example) sends the link and follows the status (sent, signed) without seeing the answers.
• Every read is logged: answers, consent, photos and PDF. The administrator sees who read whose form and when.
• NAVSTEC support never reads the form, not even with the owner’s approval. Meta’s review account has no access either. The database itself denies it.

II.4 What never leaves the system

• Pixel and Conversions API: nothing from the form goes to Meta. In health accounts, conversion notices are off by default. If the clinic turns them on, only the closed list in section 3 goes, never anything from the form, and the clinic is responsible for following Meta’s rules on health.
• Artificial intelligence: the form’s content never goes to AI. In health accounts, AI is off by default. If the administrator turns it on for conversations, a filter on our server blocks, before it leaves, any text that looks health-related.
• WhatsApp: only the form’s link (and the code, if on) goes through WhatsApp. The questions and answers open on a page of ours, outside WhatsApp.
• Exports and reports: the form is not part of the contacts export or the Dashboard. It leaves only as each form’s PDF, for whoever has the permission, and in the return at the end of the contract (II.6).
• The person’s copy: whoever signs receives their own copy through a download link that works once and is valid for 24 hours.

The LGPD forbids “the communication or shared use between controllers of sensitive personal data concerning health with the purpose of obtaining an economic advantage”, except in the cases it lists (art. 11, § 4). The form is not for ads.

II.5 Electronic signature

How the person signs (the clinic chooses per template):

• Link on WhatsApp: the person receives on their own WhatsApp a link that works only once and expires in 72 hours (the clinic chooses from 1 hour to 30 days). They open it, answer, read the consent text to the end and sign with a finger or by typing their name.
• Link + code: the same, plus a 6-digit code sent to the same WhatsApp at signing time. The code is valid for 10 minutes and allows up to 5 attempts.
• On arrival: on the clinic’s phone or tablet; the link is valid for 2 hours.
• On paper: the person signs the paper and the clinic attaches the photo or PDF.

What the law says, in plain words. Between the clinic and the patient, an electronic signature the parties accept as valid is valid. Provisional Measure 2,200-2/2001 says that the Brazilian public key infrastructure (ICP-Brasil) “does not prevent the use of another means of proving the authorship and integrity of documents in electronic form, including those using certificates not issued by ICP-Brasil, provided it is accepted by the parties as valid or accepted by the person against whom the document is used” (art. 10, § 2). Law 14,063/2020 gives three levels (art. 4):

• simple: “one that allows its signatory to be identified”;
• advanced: one that, accepted by the parties, “is uniquely linked to the signatory”, uses data the signatory can, “with a high level of confidence, operate under their sole control” and is linked to the document “in such a way that any subsequent change is detectable”;
• qualified: one that uses an ICP-Brasil digital certificate.

Where the form fits (our reading): with the link only, it is a simple signature, with the evidence trail. With the link + code, it has the three features of an advanced signature: only the person receives the link and the code on their WhatsApp, and the SHA-256 code shows any change. For this to hold, the consent text should say that the person agrees to sign electronically and recognizes that signature as valid. The form is never a qualified signature, because it does not use an ICP-Brasil certificate.

Professionals’ documents follow another rule. The form is signed by the patient. Electronic prescriptions for controlled medicines and electronic medical certificates are only valid with the professional’s qualified signature (Law 14,063/2020, art. 13), and other documents signed by health professionals require an advanced or qualified signature (art. 14). The system does not issue prescriptions or medical certificates.

Paper: keep the original. The attached photo does not replace the paper. To destroy the original, Law 13,787/2018 requires digitization using a “digital certificate issued under the Brazilian Public Key Infrastructure (ICP-Brasil) or another legally accepted standard” (art. 2, § 2) and review by a records review committee (art. 3). The system does not perform that certified digitization.

II.6 Retention and deletion

• The legal period: “After the minimum period of 20 (twenty) years from the last entry, patient records on paper and digitized records may be deleted” (Law 13,787/2018, art. 6), and this also applies to documents “originally generated and kept in electronic form” (art. 6, § 5).
• In the system: each signed form and each photo is kept, by default, for 20 years from signing (or from the photo upload). The clinic can change the period in the form settings. The law counts the 20 years from the last entry in the patient record: if the person keeps being seen, the clinic should keep the older forms for longer.
• No deletion before the period ends: not even the administrator can delete a signed form. If the contact is deleted, the form stays and only the administrator can see it. After the period, the form is not deleted automatically: only the clinic decides to delete it.
• A patient’s request to delete: the clinic assesses it. Legal retention prevails, because the LGPD allows keeping data for “compliance with a legal or regulatory obligation by the controller” (art. 16, I).
• End of the contract: within the 30 days of section 12, we give the clinic an export of all forms (each one’s PDF, with the trail, the consent texts, the photos and the paper files). From then on, keeping them for the legal period is up to the clinic. After that, we delete everything as section 12 says, unless there is a written agreement for us to keep storing them.

II.7 Image-use consent

• Before-and-after photos serve patient care. Using them outside care (social media, ads, portfolio) requires a separate consent, which the system records as “allows” or “does not allow”, with the date. The most recent record is the one that applies.
• The person may withdraw consent at any time: “Consent may be revoked at any time by express statement of the data subject, through a free and easy procedure” (LGPD, art. 8, § 5).
• Image is also protected by the Brazilian Constitution (“intimacy, private life, honor and image of persons are inviolable”, art. 5, X) and by the Civil Code (art. 20).
• The system does not publish photos anywhere. The clinic is the one who publishes, and only with a valid “allows”.

II.8 The clinic’s duties

• choose and record the legal basis (II.1) and tell patients, in its own privacy notice, that it uses the NAVSTEC System;
• include acceptance of the electronic signature in the consent text (II.5) and review the ready-made templates before using them;
• grant the “See health forms” permission only to those who need it and remove access for anyone who leaves the team;
• not write health data outside the form (notes, tags, stage or campaign names);
• follow its professional council’s rules on patient records and confidentiality;
• appoint a data protection officer (LGPD, art. 41) and prepare the impact report when the ANPD asks (art. 38).

Professional councils’ rules. The legal floor is 20 years from the last entry (Law 13,787/2018, art. 6). Some councils have their own rules. The Federal Council of Dentistry (CFO), for example, sets “the minimum period of 10 (ten) years from the last entry” for paper records and “permanent retention” for records kept electronically (Resolution CFO-91/2009, arts. 8 and 7). The Federal Council of Medicine (CFM) repeats the 20 years for paper (CFM Opinion No. 19/2026). That is why the system keeps 20 years by default; if your profession’s rule asks for longer, increase the period in the form settings. The same CFO resolution only allows digitized paper to be destroyed with a system at “Security Assurance Level 2 (NGS2)” and an ICP-Brasil certificate (arts. 3 and 5). The NAVSTEC System does not have that certification: keep the original paper.

II.9 Incidents involving health data

Section 9 applies, with the same notice period. Health data is sensitive, which weighs in the risk assessment. We help the clinic notify each affected patient individually when notice is due.

Version history

Version	Date	What changed
Version 1	October 16, 2026	First version of the agreement, with Annex I (subprocessors) and Annex II (health data addendum).

Changes that reduce data protection are announced to each account administrator 30 days in advance. Earlier versions are available on request.

Version 1 — 16/10/2026 (October 16, 2026)