This is a courtesy translation. In case of any discrepancy, the Portuguese version prevails. Read the original in Portuguese.
Patient Portal Privacy Policy
Version 2026-10-17 · in force since 17 October 2026.
In one sentence: your test results are yours. We store them to organize them and show them to you, we do not sell them or share them with anyone for advertising, and you can ask for all of it back, or ask us to delete it, at any time.
1. Who is responsible for your data
The data controller is SOLONEXA, which provides the Patient Portal. The legal name and CNPJ (Brazilian company registration number) of the responsible company appear on the contract, on billing and on invoices, and are provided at any time to anyone who asks through the contact below.
For any privacy matter (a request, a question or a complaint) write to contato@solonexa.com. This is the channel of the person in charge of data processing (art. 41 of the LGPD, Brazil's General Data Protection Law).
2. What data we collect
| What | Where it comes from | What for |
|---|---|---|
| Name, WhatsApp and email | you type them when signing up | creating your access, sending your link and recovering your password |
| CPF | you type it when signing up | this Brazilian taxpayer number is what keeps your test results together, even if you change doctor or laboratory. It selects your record; it is not a password and does not open anything on its own |
| Date of birth | you type it when signing up | telling apart two people with the same name and checking your age |
| Country where you live | you choose it when signing up, only if you do not have a CPF | opening an account for people who live outside Brazil without asking for any document: no CPF, no passport |
| Phone number outside Brazil (optional) | you type it, if you wish, when signing up or in “My details” | having a way to reach you. We do not send messages to it: access and password recovery go by email |
| Password | you choose it | signing in. Stored encrypted: not even we can read it |
| Lab reports and the results in them | you upload them, or the Portal fetches them from your laboratory's website when you ask (section 3) | building your history and showing how it changes |
| Username and password for your laboratory's website | you type them when you request the fetch | signing in to the laboratory's website once, downloading your reports and signing out. We do not store them, neither the username nor the password (section 3) |
| Date and time of your visits, and technical error logs | generated by the system | security and fixing faults |
We do not ask for your address, card or bank details. Signing up is free. Some services may be paid; the price is shown before you pay.
About the CPF: it is not your password and is not enough to sign in. What opens the account is the six-digit code sent to the WhatsApp number already saved in your record; the CPF only says which record is yours.
If you live outside Brazil and do not have a CPF, you create the account with your name, date of birth, country and email. This account is for people aged 18 or over only, is always a new account and is not linked to any record opened by a clinic. That is why a clinic cannot send test results to it; results come in through the uploads you make yourself.
3. Health data is sensitive data
A test result is sensitive personal data (art. 5, II of the LGPD). The legal basis for processing it here is your consent (art. 11, I): you decide to create the account and you decide to upload each file. Consent can be withdrawn whenever you want, as described in section 8.
Fetching from the laboratory's website. If you prefer, instead of downloading the PDF and uploading it, you can ask the Portal to fetch your reports directly from the laboratory's website. To do this you type into the Portal the username and password the laboratory gave you. They are used at that moment to sign in to the laboratory's website on your behalf, download the released reports and sign out, and are then discarded: they are not stored in any database, file or log. What is stored is only the trail of the fetch (which laboratory, when, whether it worked and how many reports came back), so you can see on screen if something failed. We only support laboratories on a closed list, and the address of each website comes from that list, never from typed text. If the laboratory requires a step only you can take (a code sent by email or WhatsApp, for example), the Portal stops and tells you so; it does not bypass that step. The downloaded reports enter your history exactly like the ones you upload.
4. Who your data is shared with
We do not sell your data. We do not use it for advertising. We do not hand it over to laboratories, health insurers, employers or insurance companies.
Your data only leaves here in three situations:
- When you send it. If you show or send your history to a professional, you are the one sharing it.
- To the suppliers that make the service work (processors), listed below. They process the data on our behalf and under our instructions, and only for what the service needs.
- By court order or legal obligation.
The suppliers
| Supplier | What for | Where the data is |
|---|---|---|
| Supabase | database and test files | Brazil (São Paulo) |
| Fly.io | application servers | Brazil (São Paulo) |
| Cloudflare | website delivery and attack protection | global network |
| Resend | sending access and password emails | Brazil (São Paulo) |
| Hostinger | server that reads the report (standard reading) | Brazil (São Paulo) |
| Anthropic | advanced reading; and summarising the transcript of your consultation, when your doctor records it | USA |
⚠️ International transfer, stated clearly. The standard reading of the report is done in Brazil. The advanced reading sends the text of your report to an artificial intelligence in another country, under a contract that forbids using it for any other purpose. It happens when you ask for it or, at no cost to you, in the development of our reader.
The consultation transcript takes the same route. When your doctor records the consultation, the transcribed text is sent to an artificial intelligence supplier outside Brazil to be summarised and organised into your record. The audio is not sent: it is transcribed on the computer in the consulting room and never becomes a file. This only happens if your doctor turns the recording on, and they ask for your permission first.
5. Scientific research, only if you authorize it
We want to use test results in scientific studies about health. This only happens if you authorize it, and the authorization is separate from everything else. It is optional: not authorizing changes nothing about your access. If you do not tick it, the answer is no.
What would be included: the test result, your age group, your sex and the month of collection.
What is never included: name, CPF, email, phone, address, exact date of birth, exact date of the test and any text written by you.
You never appear on your own. The data goes together with that of other people, and any group of fewer than five people is discarded.
We do not make money from this. We do not sell or hand over your health data in exchange for economic advantage: the LGPD forbids it (art. 11, §4), and so do we.
You can turn it off whenever you want, in one click, in the Portal. From then on none of your data enters any new study. What has already entered a study in progress does not come back: once mixed and without a name, there is no way to know which row was yours, and that is what guarantees anonymity.
People under 18 are not included in studies, even with a guardian's authorization.
Before any study is published, the project goes through a Research Ethics Committee.
6. How long we keep data
- For as long as your account exists. A history is only useful if it is long; that is the whole idea of the service.
- If you ask us to delete it, we delete it within 15 days, including from backups at the next rotation (daily backups are kept for 30 days).
- Access logs are kept for 6 months, for security.
7. How we protect it
- Everything travels encrypted (HTTPS) and the database is encrypted at rest.
- The password is stored with bcrypt, a one-way lock: not even we can read your password.
- Access to each account is isolated in the database itself, not by a check in the app.
- Daily backup, verified.
- People who work on the system can only reach what they need for their work.
No system is 100% secure. If there is an incident that may pose a significant risk to you, we will notify you, by email, and the ANPD (Brazil's National Data Protection Authority), as required by art. 48 of the LGPD.
8. Your rights
At any time, free of charge, you can request:
- Confirmation and access: find out what we hold about you and receive a copy.
- Correction of incomplete or wrong data.
- Portability: taking your data to another service.
- Deletion: erasing everything.
- Withdrawal of consent, which also closes the account.
- Information about who we share data with and what happens if you say no.
Just write to contato@solonexa.com. We reply within 15 days. We may ask you to confirm that it is really you; this protects you from someone asking for your data while pretending to be you.
You can also complain directly to the ANPD (National Data Protection Authority) at gov.br/anpd.
9. Children and teenagers
Under 12: we do not create Portal accounts, not even with authorization. If we find one, we delete it.
From 12 to 17: only with the authorization of a parent or legal guardian. The guardian must have a Portal account and sign in with their own password to sign this authorization; ticking a box that says "I am the guardian" is not enough. The account belongs to the teenager; the guardian is recorded alongside it, with the date they signed and their relationship.
The guardian can undo it at any time, and the teenager's account stops opening immediately.
From 18 onwards, people create their account on their own.
The health questionnaire also changes with age: questions that are not appropriate for a teenager or a child (those about sexual life, among others) simply do not appear.
This is governed by art. 14 of the LGPD and by the Brazilian Statute of Children and Adolescents. For children under 12 the law requires specific and prominent consent from the guardian; from 12 to 17 it is not explicit, and we have chosen to apply the same requirement.
10. Cookies
We only use what is necessary to keep you signed in. We do not use advertising cookies, we do not track you across other websites and there is no open or click tracking in the emails we send.
Inside the Patient Portal, we record how the screens are used (which tab you opened, which button you tapped and when) to understand what helps and what gets in the way. This record stays in the same database as your data, does not store test values, questionnaire answers or your own text, and is not shared with anyone. When a doctor opens your portal through the link you generated, that is also recorded, so that you know.
11. Changes to this Policy
If something significant changes, we will let you know through the contact channels you gave us and ask you to accept again. The version in force is always the one on this page, with the date at the top.
12. Without a CPF, and U.S. residents
Consent for health data. Without a CPF, the account is only created if you tick a separate box authorizing the processing of your health data. You can withdraw it whenever you want (section 8).
HIPAA does not apply: we are not a U.S. health plan or health care provider.
U.S. residents. The rights in section 8 also apply to you, including in Washington, Nevada and Connecticut. You can complain to your state Attorney General. See also the Consumer Health Data Privacy Policy.
← Back to home