How we take care of your data.

1. Who is responsible for your data

The data controller is Axis360, which decides how the data is used and is accountable for it.

Data protection officer and privacy channel: through the Axis360 WhatsApp, at the same number that sends your access codes.

2. What data

From your account

• WhatsApp number, stored encrypted. To find your account we use a code calculated from the number, not the number itself.
• Phones connected to the app: manufacturer, model, app version and time zone. To recognize the same phone if the app is reinstalled, we keep a scrambled code (hash) of the Android identifier, never the identifier itself.
• Browsers with the dashboard open: only the name of the browser and the operating system (for example, "Chrome · Windows"), without the full IP address.
• Your authorization: the version of the text, the purposes you checked and the date.

Health data, only with your authorization

• Through the Axis360 Conector app, read from Health Connect on your Android phone: steps, active calories, sleep and its stages, exercise, heart rate (resting, and the day's minimum, average and maximum), weight and body composition (fat, lean mass, water, bone mass and basal metabolic rate) and, if your phone or watch measures them and you accept the new version of the authorization, blood oxygen, heart rate variability (HRV), respiratory rate, skin and body temperature, and heart rate during sleep (to show your sleep in the morning summary and send the alerts you choose).
• Through the import of your Samsung Health history (the file you export and send us): the same types listed above.
• The app does not read glucose, blood pressure, food intake or hydration.

From the WhatsApp assistant

• The messages you send to the assistant's number and its replies.
• What you tell it to keep, such as medications, allergies and goals.
• Your WhatsApp profile name (the one shown to people who receive your messages), so the team knows who they are talking to.
• If you connect your Gmail and your Google Calendar: the Google account email and the app password you created, encrypted.
• Calendar and family members: the appointments, reminders and to-dos you ask Fabi for are kept, encrypted, for as long as your account exists. PDF documents, such as the appointment form: the content is kept for as long as the account exists, and the file for 90 days; whatever is sent through WhatsApp also stays in WhatsApp and on the messaging server. With Google connected, the appointment becomes an event in your Google Calendar, with the title, time, place and a link; it stays there even if you delete your Axis360 data. The data of family members that you send to Fabi (name, relationship, date of birth, CPF, health plan, member card and anything else you share) is kept, encrypted, in your account for as long as it exists, so that Fabi can book appointments, reminders and documents in their name. Everything arrives on your WhatsApp, and you can ask to remove someone at any time.
• Booking appointments through your health plan: so that Fabi can book through your health plan, your profile keeps, encrypted, your CPF, health plan, member card and your time preferences (and those of the family members you send). The photo of the member card is not kept: from it, Fabi takes the health plan and the insurer's registration number. To find the insurer's official service channels, Axis360 searches the internet using only the insurer's name, without any of your data. Booking requests are kept, encrypted, and you can ask to cancel a request at any time. To book, cancel or reschedule, Fabi talks to the insurer's customer service through WhatsApp (the automated service or a person there), on your behalf, and provides what the insurer asks for the booking: the CPF of the plan holder, the member card of the person going to the appointment and the appointment details. These conversations are kept, encrypted, together with the protocol number the insurer provides.

Safety through the watch and the family, only if you turn it on

• Location of the watch or the phone: only when you turn on a safety feature (fall, safe zone, beach mode, “me acompanha”, SOS). It goes to the family members you registered when there is an alert, or when one of them, authorized by you, asks where you are.
• Watch alerts: falls and your response, SOS requests, lack of movement, watch off the wrist, and battery.
• QR wristband: when someone scans the code, we receive the location of the scanner's phone (if that person allows it), only to notify your family. The wristband page does not show your name or your phone number.

Technical

• When something fails in the app, it sends a diagnostic: version, permissions and how many records of each type exist. Never health values.
• Like any website, the server logs the IP address, date and time of each access, without health values. This is used for security and to investigate failures.

3. What we use it for

You choose the purposes when you give authorization, in the app or in the dashboard:

• Show your data in your report and in your Axis360 follow-up required
• Receive summaries of this data on your WhatsApp optional
• Let the Axis360 nutritionist see this data to advise you optional
• Let the Axis360 AI use summaries of this data to write your messages optional

The WhatsApp number is also used to send the codes you request: to sign in to the dashboard, connect the app, change the account's number and confirm that you want to delete your data.

To personalize Fabi: within the purposes you checked, Fabi uses what you tell her and the way you use Axis360 (WhatsApp, the app and the dashboard) to choose reminders, tips and the morning summary and to suggest what may help you. This stays within Axis360.

What we do not do: we do not sell your data, we do not use it for advertising and we do not share it with commercial partners, including supplement companies.

4. WhatsApp assistant

Axis360 assistant on WhatsApp. To work, Axis360 receives and keeps the messages you send to this number and the assistant's replies. With them, the assistant answers and remembers what you told it. A person from the Axis360 team may also see and reply to this conversation. Who processes it: the artificial intelligence is provided by AI providers in the United States; if you connect your Google account, Google (calendar and email); WhatsApp messages go through the Axis360 server (Evolution) at DigitalOcean, in the United States. If you give the password to your laboratory's test results portal, it is kept encrypted and is discarded when you ask or when the account is deleted. To book an appointment through your health plan, Axis360 sends your CPF and the specialty to the insurer you indicate. Pix payments go through Axis360's own payment server and are made only after your "sim" (yes). The assistant is not a medical or emergency service. You can delete everything Axis360 has kept whenever you want, in the dashboard, under Your account, or by asking Fabi. It is for people aged 18 and over.

Photos, PDFs and audio: audio is converted to text and is not kept. We keep only the photo or PDF that becomes a record: a meal photo is kept for 90 days; a photo of a test result, a medical order or the glucose meter is kept for as long as the account exists. Other photos are not kept. Files are stored encrypted; when you delete the account, they become unreadable immediately and are removed from the backups within 14 days.

Gmail and Google Calendar (optional): if you connect your Google account with an app password, the assistant reads your calendar and your emails only when you ask. It does not keep the emails and events it read; what stays in the conversation is what it replied, which may quote parts of them. The assistant creates the event and sends the email when you ask, without asking for confirmation, and tells you what it did. To disconnect, send DESCONECTAR GOOGLE or use the dashboard. For the password to stop working, also delete it at myaccount.google.com/apppasswords. It is better to paste the password in the dashboard: if you send the password in the conversation, the message is kept in the assistant's WhatsApp and on its server, like its replies.

Conector alert: if the Axis360 Conector app goes more than one day without sending your data, Fabi notifies you on WhatsApp with a fixed message, without artificial intelligence and without any health data in the text. To stop receiving it, send PARAR LEMBRETES.

Booking services: to book a service you request (barbershop, salon, restaurant…), Fabi talks to the business through WhatsApp on your behalf and provides the first name of the person going (you or the family member in the request) and, when confirming the time or earlier, if the business asks, the full name of the person going and your phone number (also when the booking is for a family member); never CPF, email, address, date of birth or health data. The business's number is kept in your request and in the event in your Google Calendar (if it is connected). The reservation stays in your history for up to 12 months.

For businesses: did you receive a message from Fabi to book a time? The number was provided by the customer who requested the booking. We keep the conversation for 90 days to record their reservation; the number is also kept in the customer's request and calendar event. Reply PARE and we will not write again; ask us to delete and we delete your messages, keeping only a code of the number so we do not write to you again.

Laboratory test results portal (optional): if you give Fabi the login and password for your laboratory's portal, she uses them only to fetch your new reports and notify you. The password is kept encrypted on the server and is discarded when you ask Fabi or when your account is deleted. Downloaded reports are kept like other test results: for as long as the account exists.

Booking appointments through your health plan: when you ask, Fabi talks to the customer service of the insurer you indicate, through her WhatsApp, and sends your CPF and the appointment specialty (and the member card and appointment details, if the insurer asks), as if you were calling yourself. Nothing goes to the insurer without your request.

Pix payments: if you use your Axis360 balance to pay for something (a purchase Fabi made for you, for example), the Pix goes through Axis360's own payment server, and no payment is made before you reply "sim" (yes) to Fabi. We keep the amount, the date and the recipient in your statement; we do not keep your bank details.

Deleting your data: in the dashboard, under Your account, use "Apagar meus dados" (Delete my data). This deletes from Axis360 what we keep about you: the stored conversation, what the assistant noted, your goals, the Axis360 Conector app data and access to the dashboard. You can also ask Fabi, in the conversation, to delete everything: she sends you the dashboard link so you can confirm.

The messages remain in the WhatsApp history, on your phone and on the Axis360 number: what we delete is what Axis360 keeps.

Changed your number? In the dashboard, under Your account, use "Trocar o número" (Change number): we send a code to the new number and your history stays in your account. Other dashboard sessions are ended, the old number receives a notice and can no longer sign in to your account.

5. Legal basis

Health data is sensitive personal data. We process the health data sent by the Conector app only with your specific and highlighted consent, for the purposes you check (LGPD, art. 11, I). We keep the version of the text you accepted, the purposes and the date. You can withdraw your consent whenever you want, at no cost (art. 8, § 5). When the authorization text changes, we ask for your authorization again before we continue showing your data.

In the WhatsApp assistant, you are the one who decides to send the messages. The first reply explains what Axis360 keeps, and you can delete what it has kept whenever you want, in the dashboard, under Your account. In the dashboard, you can see what you sent to Fabi (meals, water, blood glucose readings, blood pressure, weight and measurements, test results, medical orders, the conversation with Fabi and the files you sent) after signing in with the code sent to your WhatsApp.

Account data (number, connected phones and browsers) is used to provide the service you requested and to keep your account secure. Technical logs are used for the security of the service.

6. How long we keep it

• Your health and account data: for as long as your account exists, until you delete it. Disconnecting the phone or removing the permission in Health Connect does not delete what has already been sent.
• Backups: 14 days. We make one copy per day, on the same server, and each one is deleted after 14 days. After you delete the account, your data also disappears from the backups within 14 days.
• Conversation with the WhatsApp assistant: up to 12 months at Axis360 (older messages are removed automatically). What you asked it to keep, such as medications, allergies and goals, stays for as long as your account exists.
• WhatsApp profile name: for as long as your account exists, updated when you change your name on WhatsApp. It is removed when you delete the account.
• Google connection: for as long as it is connected. It is removed immediately when you disconnect or delete the account, and from the backups within 14 days.
• Requests to book appointments through your health plan: up to 12 months after they end, or until you delete the account.
• Fabi's conversations with the insurer's customer service to book your appointments: up to 12 months, or until you delete the account.
• Service requests and reservations (barbershop, salon, restaurant…): up to 12 months after they end, or until you delete the account. Messages from businesses in these conversations: 90 days.
• Sign-in and confirmation codes: up to 24 hours.
• A phone with no contact for 180 days is disconnected automatically (the data it sent remains in your account until you delete it). Technical diagnostics: up to 180 days, or 30 days after the phone is disconnected.
• Browser that signed out of the dashboard: the record disappears within 90 days.
• Technical server logs (IP address, date and time of access): up to 14 days.
• The security log keeps only events and counts (for example, "signed in to the dashboard"). When you delete the account, it no longer has any link to you.
• Laboratory test results portal password: encrypted, for as long as you keep the portal connected; discarded when you ask Fabi or delete the account.
• Pix payments: the statement (amount, date, recipient) is kept for as long as your account exists.
• Location from safety features: 30 days. The location of an alert is kept with the alert, for as long as your account exists.

Technical retention table

The same table from the system plan, item by item (in English, as it appears there):

7. Who we share it with

With no one for their own use. We do not sell, rent or pass on your data. For the service to work, some suppliers process data only on behalf of Axis360 and only for that purpose:

• The server provider: DigitalOcean, in the United States (New York). It stores the data, with health values already encrypted. The Axis360 WhatsApp server (Evolution), through which messages with Fabi come in and go out, runs on this same server.
• Artificial intelligence: AI providers in the United States. The conversation with Fabi (the text of the messages, the text of the audio messages, and the photos and PDFs she needs to read) goes to these providers to generate the reply. They process the data on behalf of Axis360 and do not use it to train models, according to their contracts. This is an international transfer (LGPD, art. 33).
• Google, in the United States: only if you connect your Google account. Fabi reads your calendar and your emails through Google when you ask, and creates events in your Google Calendar.
• WhatsApp (Meta): messages with the assistant and the codes you request go through it, like any WhatsApp message. If you check the WhatsApp summaries purpose, the summaries with your values also go through it. The new sign-up notice to the person responsible for Axis360 (section 8) also goes through it.
• Data from the Axis360 Conector app enters the conversation with the AI only if you check the AI purpose.
• The Axis360 nutritionist: sees your data only if you check that purpose.
• Your health plan insurer: only when you ask Fabi to book, cancel or reschedule an appointment through your health plan. Through its WhatsApp, it receives what the booking requires (the plan holder's CPF, the specialty, the member card of the person going to the appointment and the appointment details), as if you were calling yourself. It is the insurer you indicate; Axis360 does not choose it.
• The business you ask Fabi to book with (barbershop, salon, restaurant…): through its WhatsApp, it receives the first name of the person going and, when confirming the time or earlier, if it asks, the full name of the person going and your phone number (also when booking for a family member). Never the CPF, email, address, date of birth or health data.
• Axis360's own payment server: processes the Pix when you pay for something with your balance, always after your "sim" (yes) to Fabi. It receives the amount and the recipient; it does not receive health data.
• The laboratory of your test results portal: only if you connect the portal. Fabi signs in to it with your login to fetch your reports; nothing of yours goes to the laboratory beyond what you already have there.
• Google Fonts: the fonts of the dashboard and of this page come from Google Fonts, which receives your device's IP address when they are downloaded, without any health data.
• The Gmail (Google) of the person responsible for Axis360: the new sign-up notice (section 8) is also sent by email, through the responsible person's Google account, and is kept in their email like any message, without any health data.
• The family members you register: only with your authorization. Fabi sends them, through WhatsApp or in a call, the alerts and the summary you choose (for example, glucose out of range, a missed medication or a fall, with your location), and you can change or stop this whenever you want. They also need to agree to receive them.
• Authorities: only when required by law or a court order.

8. Where it is stored and how we protect it

International transfer. Your data is stored on a DigitalOcean server in the United States, contracted by Axis360; the artificial intelligence (AI providers) and Google are also in the United States. By giving your authorization, you agree to this international transfer of your data (LGPD, art. 33). The protection is the same as described here, wherever the server is located.

• Encrypted connection (HTTPS) between the phone, the browser and the server.
• Health values encrypted in the database. The key is kept separately, outside the database and the backups.
• Passwordless sign-in: a single-use code through WhatsApp, valid only in the browser that requested it.
• Each person sees only their own account in the dashboard. The person responsible for Axis360 sees a contact list of people who talk to the assistant (name, number, where they came from, dates, status and how much AI they used, in numbers only, including people who previously asked the assistant to stop, marked as not to be contacted) and can download it as a spreadsheet. They use this list only to resume the service the person requested, such as answering questions and providing support, never for advertising. The list does not show health data. To evaluate and improve the assistant's replies, they may also read each person's conversation with the assistant, as it was stored: the messages, the text of the audio messages, the captions, the indication of a photo or PDF (the photo and PDF themselves are not shown) and the type of what the assistant noted for each message, such as a meal or test result, without the values. To open the list and the conversation, they confirm with a code sent to their WhatsApp, and each access is logged.
• To check bookings of appointments through health plans and fix failures, the person responsible for Axis360 may also read, in the same area, Fabi's conversations with the insurers' customer service, as they were stored. The CPF and the member card appear only as a placeholder, never the number. These conversations are kept for up to 12 months, and each access is logged.
• With each new sign-up, through WhatsApp, the dashboard or the Axis360 Conector app, the person responsible for Axis360 receives on their WhatsApp and email a notice with your first name (the one you told Fabi or the one in your WhatsApp profile), the last 4 digits of your number and how you signed up, without any health data. They use this notice only to follow sign-ups and provide support, never for advertising. The notice goes directly to them, without the Administration code, and this copy remains in their WhatsApp and email even after you use "Apagar meus dados" (Delete my data).
• Technical logs from the dashboard and the app do not keep health values, full numbers or codes.
• If a security incident occurs that may pose a risk or cause harm to you, we notify you and Brazil's National Data Protection Authority (ANPD), as required by the LGPD (art. 48).

9. Your rights

The LGPD (art. 18) guarantees that you may, at any time and at no cost:

• Know whether we process your data and see what it is: in the dashboard. For a copy of your data, use "Exportar meus dados" (Export my data) under Your account, in the dashboard; you download reports and photos one by one under Files. For anything not there, ask through the contact below.
• Correct incomplete, inaccurate or outdated data. Conector data comes from your phone: correct it in the source app, and the Conector sends the new version. For what you sent through WhatsApp, ask Fabi to correct it. For everything else, ask through the contact.
• Request the anonymization, blocking or deletion of unnecessary or excessive data or data processed unlawfully: through the contact.
• Portability: request a copy of your data in an open format, to take to another service: in the dashboard, under Your account, "Exportar meus dados" (Export my data) generates a JSON file, an open format; you download reports and photos one by one under Files. For everything else, ask through the contact.
• Delete your data: in the dashboard, under Your account, tap "Apagar meus dados" (Delete my data). This deletes the entire account, including the conversation kept by the assistant, with confirmation by a code on WhatsApp. In the app, "Apagar dados do Conector" (Delete Conector data) deletes what that phone sent. The messages remain in the WhatsApp history, on your phone and on the Axis360 number.
• Know who we share it with: see section 7 of this page.
• Not authorize: without authorization, the app does not send and the dashboard does not show Conector data (sleep, steps, heart, workouts and weight), and you can keep using Axis360 through WhatsApp. What you sent to Fabi appears in the dashboard for you, regardless of this authorization. Conector data that has already arrived is still yours: it is included in "Exportar meus dados" (Export my data) even without the authorization.
• Withdraw your authorization: in the dashboard, under Your account, tap "Retirar autorização" (Withdraw authorization). In the app, tap "Desconectar este celular" (Disconnect this phone).
• File a complaint with Brazil's National Data Protection Authority (ANPD).

We respond to requests made through the contact within 15 days. Removing the permission in Health Connect only prevents new readings. It does not delete what has already been sent.

10. Contact

To talk about privacy and your data, including with the data protection officer: through the Axis360 WhatsApp, at the same number that sends your access codes.

Viewing your data, withdrawing your authorization and deleting everything you can do yourself, instantly, through the dashboard.

Age and health

To use Axis360 with health data, you must be 18 or older. If we learn that an account belongs to someone under 18, we delete the data. Children do not have accounts: a father, mother or guardian may register a child as a family member only for the safety features (QR wristband, watch and location), and is the one who gives authorization. The same applies to anyone responsible for a person with dementia. Axis360 is a wellness follow-up service and does not replace medical advice.

Changes to this page

If this page changes in an important way, we will let you know through the dashboard. If the authorization text changes, we will ask for your authorization again.