Privacy Policy
Sandra Pinheiro Estética values the privacy and protection of the personal data of clients, visitors and users of its digital channels.
This Privacy Policy explains, in a simple and transparent way, what data may be collected, how it is used, with whom it may be shared and what rights data subjects may exercise, under the Brazilian General Personal Data Protection Law (LGPD), Law No. 13,709/2018.
Who we are
Sandra Pinheiro Estética is an aesthetics and beauty clinic located in Brasília, Federal District, Brazil, which provides information about services, promotional campaigns, institutional content, contact channels and customer service through digital means.
The controller of the personal data processed under this policy is 59.773.208 SANDRA CECILIA ARAUJO PINHEIRO (individual entrepreneur), trading as Sandra Pinheiro Estética, CNPJ 59.773.208/0001-96, located at QRSW 7, Lote 3, Loja 18, Ed. Verdes Mares, Sudoeste, Brasília/DF, Postal code 70675-700, Brazil. Clinic email: sandrapinheiroestetica@gmail.com. Privacy and data protection matters: Data Protection Officer, by email at joseluis@pinheirotech.com.br.
Brazilian General Personal Data Protection Law (LGPD)
The main legal reference for this policy is Law No. 13.709 of August 14, 2018 — Brazilian General Personal Data Protection Law (LGPD).
Sandra Pinheiro Estética is committed to processing personal data in accordance with the principles of the LGPD: purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and responsibility and accountability. Data is processed for legitimate purposes communicated to the data subject, limited to what is necessary, and the health data provided in the Anamnesis Form receives the enhanced protection that the law grants to sensitive personal data.
What data we may collect
We may collect data provided directly by the user, such as name, email address, phone number, messages sent, comments posted on the website and information needed for customer service, scheduling or responding to requests.
We may also collect technical browsing data, such as IP address, device type, browser, pages visited, traffic source, interactions with website buttons, cookies and measurement identifiers, when used.
How we use the data
The data may be used to respond to inquiries, provide customer service, facilitate scheduling, present information about services, display promotional campaigns, improve the website experience, measure campaign performance, prevent abuse, comply with legal obligations and maintain the security of our digital channels.
Anamnesis Form, Health Data and Photographic Records
To plan and perform procedures safely, the clinic may collect, as required by each procedure:
1. identification and contact data;
2. information about health and pre-existing conditions;
3. allergies, sensitivities and contraindications;
4. medications and treatments in use;
5. history of aesthetic procedures;
6. information about pregnancy and other conditions relevant to safety;
7. assessment, follow-up and results photographs of the procedures;
8. records of the performance and progress of the appointments.
Under the LGPD, data concerning health is sensitive personal data and receives enhanced protection. Photographs receive the same enhanced protection when they reveal health information, physical conditions or other sensitive elements, depending on their content and context.
The personal and sensitive data obtained through the Anamnesis Form, assessments and photographic records is intended for the planning, performance, follow-up and safety of the aesthetic treatments contracted by the client.
This data is used only for purposes directly related to the client's care:
1. identification of contraindications;
2. assessment of the suitability of the procedure;
3. risk prevention;
4. individualization of care;
5. follow-up of aesthetic progress;
6. technical record of the service performed;
7. compliance with legal or regulatory obligations;
8. regular exercise of rights, when necessary.
This data is not used for advertising, prospecting, campaigns or other incompatible purposes, and the clinic does not sell anamnesis data, health information or photographs of clients.
Legal bases: identification and contact data is processed for the performance of the contract and of preliminary procedures (art. 7, V, of the LGPD), for compliance with legal obligations (art. 7, II) and for the regular exercise of rights (art. 7, VI). Health data is processed based on the client's specific and highlighted consent for the purposes above (art. 11, I) and, where applicable, for compliance with a legal or regulatory obligation (art. 11, II, a) and for the regular exercise of rights (art. 11, II, d). Contracting the service, in itself, is not used as a basis for processing health data.
Photographs for technical follow-up: these are the records necessary for the assessment, documentation and follow-up of the procedures. They are treated confidentially, for the purposes and on the legal bases described above, and are not disclosed.
Photographs for publicity: the use of images of the client on social media, on the website, in campaigns, in promotional materials, in presentations or in a portfolio depends on the client's specific, highlighted and optional authorization. This authorization does not arise from completing the Anamnesis Form, from contracting the procedure or from the authorization for technical follow-up, and refusal does not prevent the contracting of services. The authorization may be revoked at any time through the Data Protection Officer's channel, without affecting uses made before the revocation.
Regarding this data, the client may request from the Data Protection Officer, by email at joseluis@pinheirotech.com.br, information about the processing, access to and correction of the data, the sharing carried out, the storage and any international transfers, the revocation of consents and the deletion of the data.
Deletion observes the legal grounds for retention: records that must be retained due to a legal or regulatory obligation, or for the regular exercise of rights, are not deleted immediately and unrestrictedly (see the Data deletion section).
Comments on service pages
When a user leaves a comment on a service page, we may collect their name, email address, comment content, IP address and technical information needed for security and spam prevention.
The email address provided will not be displayed publicly. Comments may be moderated before being published.
WhatsApp, forms and customer service
When clicking WhatsApp buttons or sending messages through digital channels, the user may be redirected to third-party platforms, such as WhatsApp/Meta. In these cases, data processing may also be subject to the policies of those platforms.
The information provided by the user will be used for customer service, answering questions, scheduling, confirming interest and continuing the requested communication.
Data sharing
Data may be shared with service providers necessary for the operation of the website and customer service, such as hosting (Hostinger), security, audience measurement (Google), communication tools and messaging services (such as WhatsApp/Meta).
Some of these providers may process data outside Brazil, in compliance with the LGPD rules on international transfers.
We do not sell personal data.
Cloud Storage and International Data Transfer
The website, the clinic's management system and the respective databases are hosted on infrastructure contracted from Hostinger (Hostinger International Ltd.), on a server located in São Paulo, Brazil, where the backup copies kept by the clinic are also stored. Hostinger acts as a processor, processing data on behalf of the clinic. As it is a company headquartered abroad, remote access by its technical team, for support and maintenance under the terms of the hosting contract, may constitute an international transfer.
International transfers that have actually been identified occur when the user uses third-party resources: Google (audience measurement, advertising features, map and reviews, only after permission is given in the cookie preferences) and WhatsApp/Meta (conversations initiated by the user and service messages). These providers also process data for their own purposes, in accordance with their policies. The clinic does not use Anamnesis Form data or clinical photographs in measurement or advertising tools, and automatic messages with verification codes do not contain clinical information.
International data transfers must observe arts. 33 to 36 of the LGPD and Resolution CD/ANPD No. 19 of August 23, 2024. The clinic is verifying the documentation of the mechanisms adopted by these providers, such as standard contractual clauses, and the data subject may request information about the transfers carried out from the Data Protection Officer.
Security and storage
We adopt technical and administrative measures to protect personal data against unauthorized access, loss, alteration, improper disclosure or inappropriate processing, including:
1. encrypted connection (HTTPS) on the website;
2. access to the clinic's management system restricted to the team, subject to authentication;
3. non-essential third-party cookies and resources loaded only after the user's permission;
4. backup copies with restricted access.
These measures are reviewed periodically and improved whenever a need is identified. Data will be kept for as long as necessary to fulfill the purposes described in this policy, legal obligations, the defense of rights or legitimate interest.
Data subject rights
Under art. 18 of the LGPD, the data subject may request:
1. confirmation that processing takes place;
2. access to the data;
3. correction of incomplete, inaccurate or outdated data;
4. anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in non-compliance with the law;
5. portability of the data to another service or product provider, subject to the regulations of the Brazilian National Data Protection Authority (ANPD);
6. deletion of data processed with the data subject's consent, except in the cases of retention provided for by law;
7. information about the public and private entities with which the data has been shared;
8. information about the possibility of not giving consent and about the consequences of refusing;
9. withdrawal of consent.
The data subject may also object to processing carried out on the basis of another legal ground, in the event of non-compliance with the LGPD.
Requests can be made to the Data Protection Officer, by email at joseluis@pinheirotech.com.br. The data subject also has the right to petition the ANPD regarding their data.
Data Protection Officer
For the duties set out in art. 41 of the LGPD, the clinic provides a channel to its Data Protection Officer:
Email: joseluis@pinheirotech.com.br
This channel handles:
- requests for information about the processing of personal data;
- the exercise of the data subject's rights provided for in the LGPD;
- requests for correction and updating of data;
- requests for deletion of data, where legally applicable;
- questions, complaints and inquiries about privacy;
- communications related to the legal duties of the Data Protection Officer, including those from the Brazilian National Data Protection Authority (ANPD).
The provision of this channel also observes Resolution CD/ANPD No. 2 of January 27, 2022, which addresses small-scale processing agents and recognizes the appointment of a Data Protection Officer as a good governance practice.
Data deletion
To request the deletion of your personal data, contact the Data Protection Officer:
1. Send an email to joseluis@pinheirotech.com.br with the subject "Data deletion".
2. Provide your name and the phone number or email address you used to contact the clinic, so that we can locate your data. You do not need to send documents or health information at this stage.
3. The requester's identity may need to be confirmed before the request is fulfilled, to prevent third parties from requesting deletion on your behalf.
4. The request will be reviewed in accordance with the LGPD, and the response will be sent through the same channel, stating which data was deleted or anonymized and, where applicable, which data must be retained and why.
Deletion is subject to the legal retention cases provided for in the LGPD. Data that is subject to legal or regulatory obligations, such as tax and service records, or that is necessary for the regular exercise of rights and fraud prevention may need to be retained; in such cases, it is restricted to those purposes.
Comments posted on the website may also be removed upon request through the same channel.
Contact
To exercise rights related to personal data or to ask questions about this Privacy Policy, please contact the Data Protection Officer by email at joseluis@pinheirotech.com.br. For other matters, please use the clinic's email, sandrapinheiroestetica@gmail.com.
The conditions of use of the website and services are described in the Terms of Service.
Updates to this policy
This Privacy Policy may be updated at any time to reflect website improvements, legal changes, operational changes or new features.
Last updated: October 2026.