Privacy Notice
This notice describes, in plain language, how Acolher (acolher.live) processes personal data, including sensitive health and wellbeing data, in Brazil and for people in the United States. This is the English version.
Technical-operational text, not legal advice. Legal bases and clauses marked [legal review pending] depend on review by qualified counsel before any compliance statement.
Who is responsible and how to reach the data contact
The service is operated by Acolher. The data officer (DPO) and the request channel appear in the block below; while the fields are empty, configuration is in progress.
Data we process
- Account: name, email, preferred language, date of the 18+ confirmation.
- Product usage: conversations, journal, mood check-ins, practices, learning progress.
- Radar: behavior logs, assessments and cognitive restructuring chains.
- Neuro: cognitive check-ins, personal baseline, changes, and voice samples when you use transcription.
- Sensitive health and wellbeing data: only enters when you turn on the specific consent; without it, nothing new is stored or analyzed.
- Payments: subscription identifier, status and billing events (card data stays with the payment provider).
Purposes and legal bases
We use data to deliver the service you asked for (contract performance), keep the account secure (legitimate interest), meet tax obligations and, where applicable, with your consent — including the specific consent for health and wellbeing data. [legal review pending]
Profiling and automated decisions
Patterns, insights, baselines and classifications are generated automatically from what you log. They are descriptive, revisable hypotheses — not diagnosis, not clinical assessment, and no legally binding decision is made by machine alone. Every surface carries the "automatically generated" mark, separates observation from hypothesis, and has a "Contest / correct" button that records a review request.
Retention
You choose the retention period for your history (12 months by default). The automatic daily cleanup deletes what has expired — including derived data — and records only counts, never content. The period is never extended without you asking.
Your rights and how to exercise them
You can access, export, correct and delete your data; revoke consents (revocation cascades to everything that depends only on that consent); contest automatic classifications; and ask about sharing. Inside the app: Privacy (export, delete, revoke, contest). Outside the app: write to the data contact above. We answer within 15 days (LGPD) / 45 days (US state laws). [legal review pending]
External providers and international transfer
We use infrastructure providers (hosting and database), payments (Stripe) and AI (message processing and voice transcription). When data leaves Brazil, transfer occurs under the safeguards of LGPD Art. 33; the processing record lists country, data involved and mechanism per provider. Transcribed audio is never stored. [legal review pending]
Security
Technical controls: token authentication, row-level authorization (RLS) in the database, rate limits on public areas, encryption in transit and at rest managed by the infrastructure, and a minimal security-event trail. No external certification is complete (SOC 2, ISO, HIPAA) — see /trust.
Minors
Acolher is for people 18 and older. Age confirmation happens at sign-up and is verified server-side in every adult area. The schools product (Schoolonline) stays off until a parental-consent flow exists.
Emergencies
Acolher is not an emergency service. In crisis, call 911 or 988 (Suicide & Crisis Lifeline, US), 188 (CVV, Brazil), or your local emergency number.