This is a courtesy translation. In case of any discrepancy, the Portuguese version prevails. Read the original in Portuguese.
Privacy for subscribing clinics
Version 2026-09-07 · in force since 7 September 2026.
In one sentence: your patients' data remains yours. SOLONEXA is a tool: it processes that data on your instructions, does not use it for any other purpose and returns all of it whenever you ask.
This document is for the clinic. If you are a patient, the text that applies to you is the Patient Portal Privacy Policy.
1. Who we are
The platform is offered under the SOLONEXA brand. The legal name, CNPJ (Brazilian company registration number) and address of the responsible company appear in the licence agreement signed by the clinic and on the invoices, and are provided before signing to anyone who asks. For any data protection matter: contato@solonexa.com.
2. The roles: this is what matters most
Under Brazil's General Data Protection Law (LGPD, Law 13.709/2018), the clinic is the controller of the data processed in its environment, and SOLONEXA is the processor: we process that data only as instructed by the clinic and within the scope of the agreement.
In practice, the clinic is responsible for the legal basis of care, for informing its patients and for answering data subjects. We provide the system and technical support; we do not decide for you.
Besides patient data, we process data about the clinic itself: registration details, technical director, system users, billing and access logs. We do so to provide the service, give support, invoice and keep things secure, and for nothing else.
3. Security and who the data passes through
Encryption in transit and at rest, role-based access defined by the clinic, isolation between customer environments (one clinic cannot reach another's data), access logging, daily backups and confidentiality required of everyone who works with us.
We do not sell data, we do not hand over data and we do not use patient data for advertising. Data is only shared with the suppliers the system cannot work without:
| Supplier | What for | Where it processes |
|---|---|---|
| Supabase | Database, files and functions | São Paulo, administered from the USA |
| Fly.io | Hosting of the applications and the messaging engine | Guarulhos/SP, administered from the USA |
| Cloudflare | DNS, edge and email routing | Distributed network |
| Meta (WhatsApp Business) | Messaging on the official channel | International |
| AI model provider | Transcription, summaries and assisted reading | International |
| Transactional email provider | Notices and access links | International |
Part of the processing takes place outside Brazil, under art. 33 of the LGPD, with data protection clauses agreed with each supplier. Where a Brazilian region is available, that is the one we use. A change of supplier, or a new one, is announced to the clinic 30 days in advance.
Nothing that passes through SOLONEXA trains an artificial intelligence model, neither ours nor anyone else's. The provider is contracted on an enterprise plan, with an express contractual ban on using the data for training and with zero retention or retention limited to processing. Its identity is not public because it is competitive information, and it is disclosed to the clinic in writing within 5 business days whenever the clinic needs it to meet its own obligations.
4. Security incidents
If there is an incident with significant risk, we notify the clinic within 48 hours of becoming aware of it, with the information required by art. 48 of the LGPD, contain the problem and support the notification to the ANPD (National Data Protection Authority) and to data subjects. By law, that notification belongs to the clinic, as controller.
5. The data is yours, and comes back whenever you want
- During the agreement: full export at no cost, at any time, in an open format (a PDF per patient and a structured file).
- After the agreement ends: the data remains available for export for 60 days, also at no cost.
- After that, if no export was requested and no custody was contracted, it is permanently deleted from our environments and backups.
Keeping medical records for 20 years is the obligation of the clinic and its technical director (Law 13.787/2018; Brazilian Federal Council of Medicine Resolutions 1.638/2002 and 1.821/2007). SOLONEXA is a technology supplier and is not the legal custodian of medical records. Keep your own copy.
6. Rights and changes
A data subject request that reaches the clinic is answered by the clinic, with our technical support; a request that reaches us is forwarded to the clinic. We may update this text and will let the clinic know when the change is significant. The version in force is the one on this page, with the date at the top. If this summary and the signed agreement differ, the agreement prevails.
← Back to home