Privacy policy

1. Introduction

Rivana Solutions LTDA (“we”, “our”) operates the Draaly platform (www.draaly.com). This Privacy Policy describes how we collect, use, store, and protect your personal information, in compliance with Brazil’s General Data Protection Law (LGPD — Law No. 13,709/2018) and other applicable Brazilian legislation. By using Draaly, you consent to the processing of your data in accordance with this policy.

2. Data We Collect

Data you provide directly:

  • Registration data: First name, last name, email, phone number, country;
  • Professional data (therapists): Specialization, professional license number, practice information;
  • Health data (patients): Clinical information entered by your therapist in the context of the therapeutic relationship, answers to clinical forms, mood records, and progress notes;
  • Payment data: Billing information processed by our secure payment providers (Stripe). Draaly does not store full credit card numbers.

Data collected automatically:

  • Technical data: IP address, browser type, operating system, time zone;
  • Usage data: Pages visited, features used, frequency of access;
  • Cookies: We use essential cookies for the platform to work and for session authentication.

3. Purposes of Processing

We use your personal data to:

  • Provide and maintain the services of the Draaly platform;
  • Manage your account and authentication;
  • Process payments and subscriptions;
  • Send service-related notifications (appointments, tasks, payments);
  • Improve the platform’s features and user experience;
  • Comply with legal and regulatory obligations;
  • Protect the security of the platform and its users.

4. Legal Basis for Processing (Art. 7, LGPD)

The processing of your data is based on:

  • Consent (Art. 7, I): For registering and using the platform;
  • Performance of a contract (Art. 7, V): For providing the contracted services;
  • Regular exercise of rights (Art. 7, VI): For defense in judicial or administrative proceedings;
  • Protection of health (Art. 7, VIII): For health data processed by licensed professionals in the therapeutic context;
  • Legal obligation (Art. 7, II): For compliance with legal and tax requirements.

5. Sensitive Data (Art. 11, LGPD)

The mental health data collected through the platform is sensitive personal data under the LGPD. It is processed exclusively:

  • With your explicit consent for specific purposes;
  • By licensed health professionals in the exercise of their duties;
  • For the protection of health within the therapeutic relationship.

Only your assigned therapist and the authorized administrators of your practice can access your clinical information. Draaly’s technical team does not have access to patients’ clinical content.

6. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. Your data may be shared with:

  • Infrastructure providers: Hosting services (Vercel, Supabase) that process data according to our instructions and under data protection agreements;
  • Payment processors: Stripe, for the secure processing of financial transactions;
  • Competent authorities: When required by court order or legal provision.

7. International Data Transfers

Your data may be processed on servers located outside Brazil. In these cases, we ensure that transfers meet the requirements of Chapter V of the LGPD, using standard contractual clauses and providers with adequate levels of data protection.

8. Data Security

We implement technical and organizational measures to protect your personal data:

  • Encryption of data in transit (TLS/SSL) and at rest;
  • Secure authentication with encrypted passwords;
  • Role-based access control (Row Level Security);
  • Continuous infrastructure monitoring;
  • Periodic backups.

In the event of a security incident that may result in significant risk or harm, we will notify the affected data subjects and Brazil’s National Data Protection Authority (ANPD) as required by the LGPD.

9. Data Retention

We keep your personal data while your account is active or as necessary to meet our legal obligations. After an account is canceled:

  • Profile data will be deleted within 30 (thirty) days;
  • Financial records will be kept for the period required by Brazilian tax law (at least 5 years);
  • Clinical data will be kept in accordance with applicable health regulations, unless you request its deletion and deletion is legally permitted.

10. Your Rights (Art. 18, LGPD)

As a data subject, you have the right to:

1. Confirm whether your data is being processed; 2. Access your data; 3. Correct incomplete, inaccurate, or outdated data; 4. Anonymize, block, or delete unnecessary or excessive data; 5. Port your data to another service provider; 6. Delete personal data processed with your consent; 7. Withdraw your consent at any time; 8. Obtain information about the entities with which we share your data.

To exercise these rights, contact us at alejandro@draaly.com. We will respond to your request within the time limits set by the LGPD.

11. Cookies

Draaly uses strictly necessary cookies to:

  • Keep your user session active;
  • Remember your language and time zone preferences;
  • Ensure the security of the platform.

With your consent in the cookie notice, we also use HubSpot (analytics and CRM) and the Meta pixel (Facebook and Instagram) to measure the effectiveness of our ads. When a professional completes the free assessment or creates an account, we send that event to Meta Platforms from our server (Conversions API), together with their email, phone number, and country converted into an encrypted code (SHA-256 hash) before it leaves Draaly. We never share patient data or clinical information with Meta. Without your consent, these cookies are not installed and this data is not sent (legal basis: consent, Art. 7, I, LGPD), and you can withdraw your consent at any time by deleting the draaly-cookie-consent cookie.

12. Minors

Minors may use Draaly only in the context of a therapeutic relationship authorized by their legal guardian. The registration of patients who are minors must be carried out or authorized by a parent or legal guardian.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Substantial changes will be communicated through the platform or by email at least 15 (fifteen) days in advance. The current version will always be available at www.draaly.com/en/privacidad.

14. Data Protection Officer (DPO)

Under the LGPD, you can contact our data protection officer at:

  • Email: alejandro@draaly.com
  • Company: Rivana Solutions LTDA

15. Competent Authority

If you believe that the processing of your data violates the LGPD, you have the right to file a complaint with Brazil’s National Data Protection Authority (ANPD) — www.gov.br/anpd.

Last updated: April 2026

Last update managed by the platform administrator.