Privacy policy

Who is responsible for which data

Your professional account data, such as your name, email and preferences: Nootrie is the controller.

Patient data the professional records, captures or receives through Nootrie: the professional is the controller, and Nootrie processes it on their behalf as a processor. If you are a patient, please contact your professional first; we help them answer your request.

During this beta, Nootrie has no Brazilian company registration (CNPJ) yet. Address: 120 Broadway Ave.

What data we handle

Only what the service needs to work:

• Account: your name, email, and the preferences you set in Settings.
• Patients: identification and contact details, the patient's context, their checklist and booked returns, the notes, recordings and files the professional adds after a consultation, and the check-in answers the patient sends.
• Consultations: the audio recorded by the professional, who commits to getting the patient's authorisation first; the transcript, only until the professional finishes the review; the analysis; and the cards generated for review, with the excerpts of the conversation that support each field.
• Audit history: what was approved, edited, sent or deleted, and when.
• Technical data: the cookies needed to keep you signed in and remember your language, and error logs that contain no clinical content.

Legal bases

We process personal data on these LGPD bases:

• performance of our contract with the professional, to provide the service (art. 7, V);
• protection of health, in a procedure carried out by a health professional, for patients' health data (art. 11, II, f). Informing the patient and getting their authorisation to record, as professional rules require, is the professional's commitment under the Terms of Use;
• compliance with legal obligations and the regular exercise of rights, where applicable (art. 7, II and VI).

What we use it for

Only to provide the service: transcribe the consultation, organise what was said into cards for review, and carry out what the professional accepts.

Nootrie does no clinical analysis and makes no clinical decisions: it does not suggest or recommend diets, foods, supplements, treatments or courses of action. Everything it organises is reviewed by the professional before it becomes part of the record or leaves the app.

We do not sell data, use it for advertising, or pass it to data brokers.

Artificial intelligence

Consultation audio is transcribed by Lemonfox (Lemon Fox GmbH, Berlin, Germany) on its European endpoint: the audio is processed in the European Union. Organising the transcript into cards uses Google Gemini through the paid API, under which Google does not use the data sent to improve its products.

Before any text is sent to the model, Nootrie replaces with placeholders the patient's name, email and phone number and, whoever they belong to, any CPF, phone number, email address, postcode (CEP) or date of birth said in the consultation. Audio cannot be treated that way, and other names spoken during the consultation may appear in the transcript.

According to Lemonfox, the audio is deleted as soon as the transcription finishes. Google does not keep the analysis requests (storage turned off). Every request, to either, is recorded in the audit history with the provider and the region, without its content.

Everything the model produces is checked by the system and reviewed by the professional, card by card, before it is saved. A recording added to a patient's note is transcribed the same way.

When you import a patient list, the file's content — including names, emails and phone numbers — is sent to Google Gemini to be read, without the placeholder substitution, because reading those details is the point. Nootrie does not keep the file; only the patients you confirm are registered.

WhatsApp

A professional can invite a patient to receive appointment reminders and follow-up links from Nootrie's WhatsApp number, which uses Meta's WhatsApp Business Platform (Cloud API). The link exists only if the patient sends, from the phone number on file, the invite code the professional gave them, and replies YES (SIM) to the consent request. The channel is for operational purposes: reminders, links and forwarding requests to the professional. It is not for health information and does not handle emergencies.

From the channel we keep only what is needed to run it and to prove consent: the link, the date and purpose of the consent and the version of the text accepted; the invite, with its code kept only as a hash; and, for each message, its identifier, type, delivery status and the kind of request it was classified as. The phone number is kept only as a keyed hash. We do not keep the text, photos, audio or files a patient sends: the text is read in memory to understand the request and discarded, and media is never downloaded.

To understand requests written freely, the text is sent to Gemini without the name, phone number and other identifiers, as described under “Artificial intelligence”. The AI makes no clinical decisions: anything about health is forwarded to the professional.

To leave, send PARAR (stop). The link ends at once and the number goes on a block list, kept only as a hash, that prevents any further message. When Nootrie understands, from a message, that the patient asked to stop, the link ends at once and the professional is notified. The professional can also end the link at any time, and changing the phone number in the patient's record ends it. To ask for the channel's data to be deleted, contact your professional or write to the address under “Contact” at the end of this page.

The professional can also send check-in invitations through the channel: a short follow-up questionnaire the patient answers on a Nootrie page, through the link received, never in the chat. The answers are health data: they are kept in Nootrie, with the patient, together with the questions as they were sent, and only those who look after the patient's follow-up in Nootrie see them. Nootrie may highlight an answer that meets a rule the professional set (for example, a score below 3), only for the professional to decide; no diagnosis, recommendation or score is drawn from the answers. If the patient does not answer, the channel sends at most one reminder.

The links the channel sends the patient, to their own released meal plan and to a check-in, open without signing in: they are signed for that patient and that link, last up to 72 hours, and stop opening if the link ends or the phone on file changes. That is why they are sent only to the linked number; anyone who has the link within that time can open it.

A professional can also link their own number to the Nootrie Assistant, under Settings → WhatsApp. They type their mobile number, get a single-use code valid for 2 hours, send that code from the same phone and confirm with SIM. The link lets the Assistant answer the professional's operational questions: a summary of their patients, follow-ups, the Nootrie agenda and pending items, plus draft tasks and notes. If the professional has connected Google Calendar to Nootrie, the Assistant also reads, through that same connection and with no new consent, only the busy times of that calendar, with no titles, guests or places; each read is recorded in the audit history, and it can be turned off in Settings → WhatsApp, with the option “Include Google Calendar in agenda answers”. A number with no active link gets no reply at all.

For the professional's link, we keep the link, the date and version of the consent, and the invite, with the code and the number kept only as hashes. For each message, we keep its identifier, type, the kind of request and the outcome, never the text. The professional's messages are read by Claude, by Anthropic, to identify the kind of request; the words of consent and control (SIM, NÃO, PARAR, AJUDA, the activation code, PAUSAR AUTOMAÇÃO and RETOMAR AUTOMAÇÃO) are read only by fixed rules inside Nootrie, and the rules also answer when the AI cannot read a message. Before it is sent, the professional's patients' names, phone numbers, e-mails, CPF and CEP are replaced with placeholders. The AI does not write the reply, makes no decision and changes nothing: a task or note is still a draft, saved only on SIM, and a request to pause or resume the automations is carried out only when the professional sends the exact command. Nootrie does not keep the text. Under Anthropic's commercial terms, the content sent is not used to train models and is deleted within 30 days; content that Anthropic's systems flag as violating its usage policies may be kept for up to 2 years, and the classification notes for up to 7 years. Each request is recorded in the audit history, without its content. The replies carry only operational information, such as counts, times, patients' first names and initials, and links that require signing in to Nootrie.

The professional can also send the Assistant a voice message. The audio is downloaded in memory and sent to Lemonfox (Lemon Fox GmbH, Berlin, Germany), on its European endpoint, only to be transcribed; it is erased as soon as the transcription ends and is never kept by Nootrie. The transcribed text follows the same path as a typed message, described above, and is not kept either. For safety, SIM, NÃO, PARAR and PAUSAR or RETOMAR AUTOMAÇÃO must be typed: nothing is confirmed or carried out from a voice message. Voice messages longer than 90 seconds are not transcribed. Each transcription is recorded in the audit history, without the audio or the text. Patients' voice messages are never downloaded, listened to or transcribed.

The Assistant never changes anything without confirmation. A task or note asked for on WhatsApp first becomes a draft, saved only when the professional replies SIM. A draft waits at most 10 minutes, and its text is erased as soon as it is saved, discarded or expires.

To end the professional's link, they send PARAR from the linked phone or use “End WhatsApp” in Settings. From then on, the number gets no replies. Replying NÃO, or not replying within 30 minutes to the confirmation request, also ends the link. The professional's link is also in testing.

Messages pass through Meta's infrastructure, which handles them under the WhatsApp Business Platform terms and may process them outside Brazil.

This channel is in testing and is not yet used with real patients.

Data from your Google Account

Signing in with Google uses only your name, email address and profile picture.

Integrations are optional and connected one at a time, each with the least access it needs:

• Google Calendar: create events on a calendar Nootrie creates itself, and check only when you are busy, never what your events say.
• Gmail: send the message you have read in full and confirmed. Nootrie does not read, list or search your inbox.
• Google Drive: create the files you added to a patient in a Nootrie folder, and access only the files Nootrie itself created.

Access credentials are stored encrypted. You can disconnect any service from the Integrations screen, or revoke access at myaccount.google.com/permissions.

Data received from Google APIs is not used to train artificial intelligence models, is not passed to third parties, and is not read by people, except when you ask us to, when it is needed to keep the service secure, or when the law requires it.

Nootrie's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

Only the providers the service needs in order to work, under contract:

• Supabase: database, authentication and file storage, in São Paulo.
• Vercel: application hosting.
• Lemonfox (Lemon Fox GmbH, Torstr. 195, 10115 Berlin, Germany): transcription of consultation audio and of the voice messages the professional sends to the Nootrie Assistant, processed in the European Union.
• Google: Gemini, for analysing transcripts and reading imported patient lists, and the Google Workspace APIs when you connect an integration.
• Meta (WhatsApp Business Platform, Cloud API): sending and receiving the WhatsApp channel's messages, when a professional uses it with a patient.
• Anthropic (Claude): identifying the kind of request in the messages the professional sends to the Nootrie Assistant on WhatsApp, without patients' names or identifiers.
• Resend: delivery of sign-in emails, which contain your email address.
• Cloudflare (Turnstile): bot protection on the public booking page, which receives the IP address and technical browser signals of whoever books.
• ntfy.sh: operational alerts to the Nootrie team when a step fails, with technical identifiers and error codes only — never names, audio, transcripts or consultation content.

We may also share data when the law or a court order requires it.

Where the data lives

The database, recordings and files are stored in Brazil, in São Paulo.

Transcription by Lemonfox, processing by Gemini, reading of the professional's messages by Claude, by Anthropic, hosting and email delivery may happen outside Brazil. These international transfers happen only as far as needed to provide the service, under art. 33 of the LGPD. Audio sent to Lemonfox is processed only in the European Union, which the ANPD recognises as providing an adequate level of protection (art. 33, I; Resolution CD/ANPD No. 32/2026). With Google, they follow the standard contractual clauses approved by the ANPD (art. 33, II, b), included in Google's data processing terms. With Anthropic, the transfer is based, under art. 33 of the LGPD, on the European Commission's 2021 Standard Contractual Clauses, Module 2 (controller to processor), incorporated into Anthropic's data processing addendum.

How long we keep it

• Consultation audio: deleted as soon as processing ends, when the review cards are ready. There is no option to keep it.
• Transcript text: kept only until the professional completes the consultation's review, then erased. We keep the structured notes and the excerpts that justify them. A consultation completed without analysis keeps the text, so the analysis can be re-run, until the patient is deleted.
• The patient's context, notes, files, checklist and returns: while the account is active, until the professional deletes the patient. Deleting a patient removes, at once, their consultations, audio, transcripts, cards, notes, checklist and returns; what already went to Google stays there.
• Account: deletion can be requested in Settings or by email. We email you before anything is removed, then delete or anonymise whatever we are not legally required to keep.
• WhatsApp: the content of received messages is not kept. The link, the consent and the message records are deleted when the patient is deleted; the hash of the number of anyone who asked to stop is kept, to prevent further messages.
• Check-ins: the questions sent, the answers and the highlights are kept while the account is active, until the professional deletes the patient; deleting the patient erases them all at once.

Security

Data is encrypted in transit and at rest. Each professional can reach only their own data, through rules enforced inside the database itself, and significant actions are kept in the audit history.

No system is immune to failure. If an incident could bring significant risk or harm, we will notify the people affected and the ANPD, as the LGPD requires.

Your rights

Under the LGPD, you can ask for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of data that is unnecessary or processed unlawfully;
• portability of your data;
• information about who we share your data with;
• withdrawal of consent, where processing depends on it.

We answer within 15 days. You can also lodge a complaint with Brazil's National Data Protection Authority (ANPD).

Cookies and browser storage

We use only necessary cookies: the ones that keep you signed in and the one that remembers your language. We use no advertising or analytics cookies.

While a consultation is being recorded, the audio is kept on the device until it is uploaded, so nothing is lost if the connection drops.

Changes to this policy

If we change this policy in a meaningful way, we will tell you in the app or by email before the change takes effect. The date at the top shows the version in force.

Contact

Person in charge of personal data processing (DPO): João Melo.

For questions, requests about your data, or to reach the person in charge, write to:

vivitomelo@gmail.com