LGPD and your rights
Laudos.AI processes personal data — including sensitive health data — under the rules of the General Data Protection Law (Law 13.709/2018) and ANPD regulations. This page explains the principles we follow, the legal bases applied, how we protect data and how long we keep it, and, above all, how you exercise your rights as a data subject.
1. Principles guiding processing (art. 6)
Purpose and adequacy
We process data for legitimate, specific and informed purposes, compatible with the operation of an assistive radiology reporting tool.
Necessity (minimization)
We collect the minimum necessary. Product telemetry does not carry identifiable clinical data; observability logs have automatic PHI sanitization.
Transparency
We state which data we process, under which legal basis and for how long, in clear language, in the Privacy Policy.
Security and prevention
Encryption at rest, least-privilege RBAC, multi-tenant isolation and immutable logs (art. 46 of the LGPD).
Non-discrimination
We do not use data for discriminatory purposes. The AI is assistive and does not make automated clinical decisions about the patient.
Responsibility (accountability)
We maintain a RIPD, a record of processing operations, DPAs with processors and auditable compliance evidence.
2. Controller, processor and the institution's role
Laudos.AI is the controller of the radiologist's registration and telemetry data. The institution that contracts the service (clinic, hospital or network) is the controller of the clinical data. Laudos.AI acts as a processor, under a Data Processing Agreement (DPA). This separation of roles (art. 5, VI and VII) is central to the proper accountability of each party. The details are in the Privacy Policy.
3. Legal bases applied (arts. 7 and 11)
Because the platform processes sensitive health data, we apply specific bases from art. 11, in addition to those of art. 7:
- Performance of contract (art. 7, V; art. 11, II, “a”): operating the platform, authenticating and processing payments.
- Health protection (art. 11, II, “f”): processing by a professional registered with the CRM, under medical confidentiality.
- Legal and regulatory obligation (art. 7, II): complying with CFM Resolutions 2.454/2026 and 1.821/2007.
- Legitimate interest (art. 7, IX; art. 10): aggregated telemetry and fraud prevention, with a documented Impact Report.
- Protection of life (art. 7, IV; art. 11, II, “c”): communication of critical findings (CRIT).
- Consent (art. 7, I; art. 8, § 5): optional features — newsletter, integrations and benchmarks — granular and revocable.
4. Your rights as a data subject (art. 18)
You may exercise, at any time and at no cost, all the rights provided for in the LGPD:
- Confirmation of the existence of processing;
- Access to personal data;
- Correction of incomplete, inaccurate or outdated data;
- Anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance;
- Portability of data to another provider upon express request;
- Deletion of data processed based on consent (except in the cases of art. 16);
- Information about the public and private entities with which data was shared;
- Information about the possibility of not providing consent and its consequences;
- Revocation of consent (art. 8, § 5).
5. How to exercise your rights
The official channel is the Data Protection Officer (DPO). To open a request:
- Send an email to natan@laudos.ai or use the rights request form. State the type of request: access, correction, portability, deletion, revocation of consent or other.
- Provide your full name, contact email and CPF for data subject authentication. If you are a radiologist user, the CRM is optional.
- You receive a tracking number by email and can follow its progress with the DPO.
- The response is given within 15 business days (art. 19, § 1).
Complaint to the ANPD: available at any time, without needing to go through a private channel first (art. 18, § 1 in conjunction with art. 55-J, IV).
6. Data retention and lifecycle
The cycle follows collection → processing (infrastructure defined by function, with applicable access controls) → delivery and retention → deletion. The platform delivers the signed report to the institution's PACS/RIS, which is the official medical record. The minimum 20-year retention is the responsibility of the healthcare service (CFM Resolution 1.821/2007). On the platform, retention follows the contractual term. Deletion respects the exceptions of art. 16 of the LGPD. The full retention periods are in the Privacy Policy.
7. Security and incident response (arts. 46 to 48)
We maintain technical and administrative measures to protect data: encryption at rest, named authentication with MFA, RBAC, multi-tenant isolation and immutable logs. In the event of an incident with relevant risk or damage, we notify the ANPD and the controller within 72 hours (CD/ANPD Resolution 15/2024). The notification includes the nature of the event, the categories of data and the number of people affected. The detailed practices are available at Security.
Questions and answers
Is Laudos.AI certified by the ANPD?
The LGPD does not provide for a mandatory “ANPD certification.” Laudos.AI maintains a documented compliance program. It brings together legal bases, an Impact Report (RIPD), DPAs with processors, a record of processing operations and a channel for exercising rights. The company also fulfills its duties to notify the ANPD in the event of an incident (CD/ANPD Resolution 15/2024).
How do I make a data subject rights request?
Send a request to the Data Protection Officer (DPO) by email at natan@laudos.ai or through the rights request form. Provide your full name, contact email and CPF for authentication. The CRM is optional. You receive a tracking number by email and the response comes within 15 business days.
Who is the Data Protection Officer (DPO)?
Dr. Natan Paraíso Ribeiro (CRM-SP 192770), radiologist and Data Protection Officer of Laudos.AI (art. 41 of the LGPD). Contact: natan@laudos.ai.
Is the decision about my report automated by the AI?
No. Laudos.AI does not make automated clinical decisions. The review, editing and signature of the report belong to the physician, in their official system. That is why the right to review of decisions made solely by automated means under art. 20 of the LGPD does not apply to the clinical act.
Can I file a complaint directly with the ANPD?
Yes. The data subject can petition the National Data Protection Authority at any time. They do not need to exhaust the private route first (art. 18, § 1, in conjunction with art. 55-J, IV of the LGPD).
Data Protection Officer (DPO) contact
Dr. Natan Paraíso Ribeiro — CRM-SP 192770 — Data Protection Officer (art. 41 of the LGPD). Email: natan@laudos.ai. For general matters: oi@laudos.ai.
LGPD compliance, without friction on shift
Data flow and legal bases documented; the radiologist stays in control. Get to know Laudos.AI or talk to our team.