DM Gestão

DM Gestão Privacy Policy

This policy explains how BomLabs, which develops and runs DM Gestão, handles the personal data of the system: the data of the people who use it (the teams of the clinics) and the data that the clinics register about their patients.

It follows the Brazilian General Data Protection Law (LGPD, Law nº 13.709/2018).

Who is responsible for the data

  • Patient data: each clinic (company) that uses DM Gestão is the controller of the data of its patients, and decides what it registers and why. BomLabs is the processor: it stores and processes these data only to provide the system to the clinic, following its instructions.
  • Data of the users and of the clinics: for the accounts of the people who use the system, the registration of the clinics and their subscriptions, BomLabs is the controller.

Data the system processes

  • Accounts: e-mail (the login), password (stored only as a PBKDF2 hash), second factor of the login (authenticator app secret, encrypted, or passkeys) and the devices trusted to skip it.
  • Team members of a clinic: name, job, professional council and registration, CPF (for the digital signatures) and permissions.
  • Clinics: name, CNPJ, address, phone, WhatsApp and logos.
  • Patients: identification (name, social name, CPF, RG or passport), contact, address, birth date, gender, dependents and guardians.
  • Health data of the patients (sensitive data): anamnesis and clinical alerts, health records, prescriptions, body map findings, photos and attachments, care, documents and the requests made under the LGPD.
  • Finances of the clinic: payments of each care and the stock of materials.
  • Audit trail: who accessed or changed what, when, from which IP address, country and browser.

Why the data is processed

The data is never used for advertising, never sold and never used to build profiles of the patients.

  • To provide the system to the clinics: schedule, care, health records, prescriptions, documents, finances and stock.
  • To send the e-mails of the system: invitations, password and second factor resets, the confirmation of a scheduled care and its reminder on the day before.
  • To keep the system secure: login, sessions, access by role, the audit trail and the prevention of abuse.
  • To charge the subscription of the clinics.
  • To meet legal obligations, like the retention of the health records.

How the data is protected

  • Personal and health data of the patients are encrypted at rest (AES-256-GCM) in the database.
  • Each clinic only reaches its own data; patient data is reserved to the healthcare professionals of the clinic, and administrators only reach the settings.
  • Every access to patient data is recorded in the audit trail, which the administrators of the clinic can review.
  • The clinic can require a second factor (authenticator app or passkey) on every login of its team.
  • Finished health records and prescriptions are locked against changes, and can be signed with the ICP-Brasil certificate of the professional.
  • All the traffic uses HTTPS.

Service providers

BomLabs uses these providers to run DM Gestão. They only process the data needed for their part of the service:

  • Cloudflare: hosting of the system, database, file storage, sessions, sending of the e-mails, PDF generation and the technical logs of the requests (privacy policy).
  • Stripe: payment of the subscriptions of the clinics. The card data is entered on Stripe and never reaches DM Gestão (privacy policy).
  • Lacuna Software (RestPKI): digital signature of the health records and prescriptions with ICP-Brasil certificates, only when the professional signs a document.
  • IBGE: the lists of countries, states and cities of the address forms come from the public IBGE service; no personal data is sent to it.

International transfer

Cloudflare and Stripe may process data on servers outside Brazil. These transfers follow article 33 of the LGPD, with providers that offer appropriate safeguards for the protection of the data.

How long the data is kept

  • Health records, prescriptions, attachments, anamnesis and body map are kept for 20 years after the last entry of each patient, as required by Law nº 13.787/2018. They are not deleted before that.
  • The other data of a clinic is kept while it uses the system, and can be exported by the clinic at any time.
  • The audit trail is kept to prove who accessed the data, including after the end of the use.
  • Sessions last up to 30 days, and so does a device trusted to skip the second factor.

Cookies and browser storage

DM Gestão only uses the cookies it needs to work: the session (encrypted, up to 30 days) and, when you choose it, the trusted device of the second factor. It has no advertising or analytics cookies.

To show the schedule when the network fails, the app keeps in the browser the open care of the next 7 days (time, patient name, treatment, workplace and professional, never clinical data). It is removed on logout and when the clinic is changed.

Rights of the data subjects

The LGPD gives the data subjects the right to confirm and access their data, correct it, know with whom it is shared, and other rights of its article 18.

  • Patients exercise their rights with the clinic where they were treated, which is the controller of their data. The system has a complete flow for these requests, with the export of all the data of the patient.
  • Users can update their account and leave a clinic in their profile, and can contact BomLabs about their account data.

Security incidents

If a security incident may bring relevant risk or damage to the data subjects, BomLabs informs the affected clinics, so they can notify the patients and the ANPD as the LGPD requires.

Changes to this policy

When this policy changes, the new version is published on this page with a new update date, and relevant changes are informed to the administrators of the clinics.

Contact

You can also write to contact@bomlabs.com.br.