Privacy Policy

• Professional account data (name, email, login, subscription and payment): CodexaFlow is the controller.
• Patient clinical data (mood, shared notes, activities, scales, feedback and schedule): the professional caring for the patient is the controller, since they decide how it is used in treatment. CodexaFlow acts as processor, handling this data only to provide the service, following the professional's instructions and this Policy.
• Patient app account data (name, email, login, preferences and consent): CodexaFlow is the controller.

Data Protection Officer (DPO): [email protected].

• Account: name, email, password (stored only as a hash), language and time zone.
• Patient record created by the professional: name, contact, date of birth and the care information the professional chooses to record.
• Sensitive health data (LGPD art. 5, II): mood entries, notes the patient chooses to share, activity and scale responses, session feedback and schedule.
• Patient private notes: visible only to the patient, never to the professional or our team.
• Payment (professionals only): processed by Stripe. We never receive or store card numbers.
• Technical data: IP address, device and browser type for login sessions, essential cookies and access and error logs.
• Website contact form: name, email, phone and the message you send, used only to reply to that message.

We don't collect location, contacts, photos, microphone or advertising identifiers. The app only asks for notifications (optional) and biometrics for the app lock (optional, checked on the device only).

• Patient sensitive health data: the patient's specific and prominent consent, requested on first use of the app (art. 11, I) and revocable at any time; and health protection by a health professional (art. 11, II, “f”), where applicable to the professional.
• Account and use of the service: performance of contract (art. 7, V).
• Security, fraud prevention and access logs: legitimate interest and legal obligation (art. 7, II and IX; Brazilian Internet Civil Framework, art. 15).
• Billing and tax obligations: legal obligation and performance of contract.
• Service emails (verification, password reset, subscription notices): performance of contract. We send no marketing without your consent.
• Contact form messages: your consent (art. 7, I), only to reply. We don't use this data for marketing or send it to Google Analytics.

We don't use clinical data for advertising, to train artificial intelligence models or for automated decisions about you.

Between professional and patient: the patient sees what the professional sends (activities, sessions, replies); the professional sees what the patient logs in the app, except private notes.

Vendors (sub-processors) that help us run the service, under contract and only for that purpose:

• Neon (managed PostgreSQL database).
• A dedicated server (VPS) contracted by CodexaFlow, where the application runs.
• Cloudflare (DNS, content delivery and attack protection).
• Resend (transactional email delivery).
• Stripe (professionals' subscription payments).
• Expo, Apple and Google (app distribution, updates and notification delivery).
• Google Analytics (aggregated usage statistics for the website and the professional area, only with your consent; see section 10).

We may share data when required by law or court order. We never sell personal data.

Some vendors process data outside Brazil (for example, in the United States). In those cases we use the safeguards of LGPD art. 33, such as contractual clauses and vendors with recognized data protection programs. The exact list of regions will be confirmed in the final version of this Policy.

• Encryption in transit (HTTPS/TLS) on every connection.
• Clinical content also encrypted at the application level (AES-256-GCM), with keys kept apart from the database.
• Per-practice isolation: a professional never accesses another practice's data, and automated tests check this on every change.
• Audit log of who viewed or changed clinical data.
• App lock with PIN or biometrics, and revocable login sessions.
• The CodexaFlow team does not access clinical content: the internal admin dashboard only shows counts and professional account data.

• While the account is active, we keep the data the service needs.
• When you delete your account, data is removed from the production database immediately; backups are overwritten within 30 days.
• Access logs: 6 months (Brazilian Internet Civil Framework). Tax and billing data: for the period required by tax law.
• Clinical records: in Brazil, CFP Resolution 1/2009 requires psychologists to keep records for at least 5 years. That is the professional's responsibility; before deleting the account they must keep their own copy.

Under the LGPD (art. 18) you may request: confirmation and access, correction, anonymization or blocking of unnecessary data, portability, information about sharing, revocation of consent and deletion.

How: delete the account directly in the app (Profile › Delete account) or the dashboard (Settings › Account & privacy), revoke consent in the app (Profile › Privacy) or email [email protected]. We reply within 15 days.

Patients: requests about the clinical record kept by the professional should go directly to them, as the controller of that data; we will help as needed.

You may also complain to Brazil's National Data Protection Authority (ANPD).

Teenagers may use the app when cared for by a professional. For anyone under 18, consent must also be given by a parent or legal guardian, and the professional is responsible for obtaining it (LGPD art. 14).

The patient app and the back office only use essential cookies (login session, language and security), with no third-party analytics or tracking tools.

On the marketing website (https://animi.app) and in the professional area (login, sign-up and dashboard), we use Google Analytics, only with your consent, for aggregated usage and conversion metrics (for example, page views, completed sign-ups, subscription checkout and confirmation, and contact form submissions). Page addresses are sent without identifiers (patient ids and query parameters are removed), and we never send names, emails, phone numbers, patient data or any clinical data. Google signals and ad personalization are turned off.

These cookies (_ga and _ga_*) are only set if you accept them in the cookie notice; without your consent nothing is stored in your browser for this purpose and no event is sent. Your choice applies to both the website and the professional area. Legal basis: consent (LGPD art. 7, I). We use no advertising cookies.

Contact form data (name, email, phone and message) is only used to reply to your message and is never sent to Google Analytics.

You can change your choice at any time using the "Cookies" link in the website footer or by clearing the site data in your browser.

Animi does not replace professional care or emergency services, and nobody monitors entries in real time. In a crisis in Brazil, call 188 (CVV, 24 hours) or 192 (SAMU); elsewhere, call your local emergency number.

We will notify you by email or in the app about relevant changes. If a change affects how health data is used, we will ask for consent again.

DPO and privacy requests: [email protected]. Support: [email protected].