Terms of Use

Last updated: October 14, 2026

1. Scope and Acceptance

1.1 These Terms of Use ("Terms") govern access to and use of the Mamini platform (mamini.app) by healthcare professionals whose account is registered in a country other than Brazil. Members whose account is registered in Brazil are governed by the Portuguese-language Termos de Uso available at mamini.app/termos.

1.2 By creating an account, accessing or using the Platform, you ("Member") confirm that you have read, understood and accepted these Terms, together with the Privacy Policy (mamini.app/en/privacy), which forms an integral part of these Terms. Section 10 and Annexes I to III of these Terms govern our processing of Patient Data on your behalf.

1.3 The Platform is operated by Mamini Ltda., a company incorporated in Brazil, registered under CNPJ no. 68.726.254/0001-25, with its registered address at Rua Alessandro di Berardo, 1900, Jundiaí, São Paulo, Brazil ("Mamini", "we", "us" or "our").

1.4 You confirm that you use the Platform in the course of your professional activity as a healthcare professional and not as a consumer.

2. Definitions

For the purposes of these Terms:

Platform: the online patient management and clinical record system made available at mamini.app, including its web and mobile applications
Member: the healthcare professional who registers individually on the Platform
Solo Member: a Member who uses the Platform individually, without sharing Patients with other professionals
Clinic: a collaborative space within the Platform, created by a Member, in which other Members may be invited to share access to Patients and clinical records
Clinic Administrator: the Member who created a Clinic and holds management rights over it (invitations, configuration, closure)
Secretary profile: access to the Platform granted by the Clinic Administrator to a staff member who does not act as a healthcare professional, under Section 6.9
Patient: the person whose data is entered into the Platform by the Member responsible for their care
Patient Data: personal data relating to Patients, and to their parents or legal guardians, processed through the Platform on behalf of Members
Subscription: the paid plan that gives access to the paid features of the Platform, taken out individually by a Member or, in a Clinic under centralized management, by the Clinic Administrator, under Section 6.6

3. Eligibility and Account

3.1 Registration as a Member is restricted to persons aged 18 or over who are licensed or otherwise legally authorized to practice a healthcare profession in their jurisdiction. Secretary profiles are governed by Section 6.9.

3.2 You must provide true, complete and up-to-date information, including your professional registration number and the body that issued it, where applicable in your jurisdiction.

3.3 Your login credentials are personal and non-transferable. You are fully responsible for keeping them secure and for all use of the Platform made with them, and you must notify us immediately of any suspected unauthorized access.

3.4 We may refuse registrations, or suspend or close accounts, in case of false information, misuse or breach of these Terms.

4. Free Trial, Plans and Billing

4.1 Free trial: on registration, you receive 14 (fourteen) days of free access to the paid features of the Platform. No payment card is required to start the trial.

4.2 No automatic conversion: the trial does not convert automatically into a paid Subscription. A Subscription starts only through your voluntary and express action of subscribing and providing a valid payment card.

4.3 Start of billing: the first charge occurs immediately upon subscribing, regardless of how many trial days remain. Remaining trial days do not generate any credit, discount or refund.

4.4 Plans and prices: Subscriptions are charged per Member (individual seat), on a monthly or annual basis as offered on the pricing page at mamini.app, in the currency shown at checkout. Subscriptions renew automatically for the same period and on the same card unless canceled.

4.5 Taxes and fees: unless otherwise stated, prices do not include taxes. You are responsible for any taxes applicable to your purchase in your jurisdiction, except taxes on our income. Because Mamini is established in Brazil, your card issuer may charge international transaction or currency conversion fees, which are your responsibility.

4.6 Price changes: we may change Subscription prices. Changes will be notified to you by email at least 30 days in advance and will apply from your next renewal.

4.7 End of trial without subscription: if you do not subscribe by the end of the trial, access to paid features will be restricted or suspended until you subscribe. Data entered during the trial is kept in accordance with Section 7.

4.8 Failed payments: if a charge fails, we will retry it for a reasonable period and notify you. If payment is not regularized within 7 days, access may be suspended. Regularizing the payment restores full access.

4.9 Payment processing: all charges are processed by Stripe. We do not store full payment card details. Stripe's terms also apply to the processing of your payment.

4.10 Add-ons: the Platform may offer additional paid features, purchased separately from the Subscription, subject to availability and to the prices in force at the time of purchase. Add-ons follow the billing period of the Subscription to which they are linked and are charged pro rata, at the time of purchase, until the end of the current billing period. Without prejudice to Section 5.1, canceling an add-on takes effect at the end of the period already paid, without any pro-rata refund, and reactivating it within that period does not give rise to a new charge. Canceling the Subscription ends the add-ons linked to it on the same date. In a Clinic under centralized management, an add-on purchased by the Administrator benefits all affiliated professionals.

5. Cancellation and Refunds

5.1 Refund window: you may cancel your Subscription or an add-on within 7 (seven) calendar days of purchasing it and receive a full refund of the amount paid for it. Refund requests must be sent through the contact channels in Section 17.

5.2 Cancellation after the refund window: from the 8th day after subscribing, you may cancel at any time. Cancellation takes effect at the end of the billing period already paid (monthly or annual), without pro-rata refunds, except as provided in Section 10.8. You keep full access until the end of that period.

5.3 How to cancel: you can cancel in your account settings or by contacting us. Confirmation is sent by email.

5.4 Reactivation: you may reactivate your Subscription at any time, under the terms and prices in force on the date of reactivation.

6.1 Creation: any Member may create a Clinic within the Platform. The Member who creates it becomes its Clinic Administrator.

6.2 Invitations: the Clinic Administrator may invite other professionals, whether already registered or not, to join the Clinic. Joining requires the express acceptance of the invited Member, including acceptance of these Terms.

6.3 Sharing of Patients: by joining a Clinic, you gain access to the Patients and clinical records shared in it, according to the Clinic's configuration. Likewise, Patients you register within the Clinic become accessible to its other Members.

6.4 Roles in relation to Patient Data: each Member is the controller of the Patient Data they enter or process, including within a Clinic. Where the same Patient is shared among Members of a Clinic, those Members act as joint controllers of the shared Patient Data. Mamini acts as processor on behalf of Members, under Section 10.

6.5 Arrangement between joint controllers: by joining a Clinic, Members agree among themselves that: (a) each Member is responsible for the lawfulness of the Patient Data they enter and for informing the Patients they treat about the processing of their data; (b) a Patient may exercise their rights with any Member who treats them, and that Member will coordinate the response with the other Members concerned; (c) the Clinic Administrator acts as the Clinic's point of contact with Mamini; and (d) Members will make the essence of this arrangement available to Patients where required by applicable law. Members may agree additional terms among themselves, provided they do not conflict with these Terms.

6.6 Billing within a Clinic: billing within a Clinic follows the operating model chosen by the Clinic Administrator when the Clinic is created, which cannot be changed afterwards:

(a) Independent practitioners: each Member keeps their own individual Subscription, charged to their own card. The Clinic is not a contracting party and does not centralize payments, and a new Member joining the Clinic does not generate any charge to the other Members.

(b) Centralized management: the Subscription is taken out by the Clinic Administrator and charged per affiliated professional (seat), including the Administrator, to the card provided by the Administrator. A new professional joining the Clinic gives rise to an immediate pro-rata charge for the corresponding seat until the end of the current billing period, except during the Administrator's free trial, when joining gives rise to no charge and the new professional shares the same trial period. Removing a professional reduces the number of seats from the following billing period, without any refund or pro-rata credit for the current period. The other Members do not hold a Subscription of their own, and their access to paid features depends on the Clinic's Subscription remaining in good standing, being restricted or suspended if it is canceled or payment is not made. Secretary profiles do not occupy a seat. Different commercial terms, where agreed with Mamini, prevail over this paragraph.

Joining a Clinic takes place through an account linked to the Clinic, separate from any individual account the professional may hold. An existing individual Subscription is not canceled, converted or refunded as a result of joining, and the professional may cancel it under Section 5 if they so wish.

6.7 Appointment confirmation and messages to Patients: for each appointment created, the Platform automatically generates a confirmation page showing only the Patient's full name. The page is reachable through a random URL, is not indexed by search engines, is known only to those who hold the link, and stops displaying the Patient's name 48 hours after the appointment time.

You may enable, in your settings, automated messages to Patients as appointment confirmation requests or reminders, by email or WhatsApp. Messages contain the Patient's name, your name, and the date and time of the appointment, and allow the Patient to confirm or cancel. By enabling this feature, you confirm that you have assessed its suitability for your professional context, informed your Patients of this practice, and obtained any consents or authorizations required by the law applicable to you.

WhatsApp messages are sent from a single Platform number, used exclusively for automated messages and not monitored. You must not present it to Patients as a contact channel.

If a Patient asks to stop receiving these messages, you are responsible for removing the Patient's email address or phone number from your records on the Platform, or for disabling the corresponding channel in your settings. The Platform does not currently offer an automatic opt-out mechanism for Patients.

6.8 Digital signatures: digital signature features based on the Brazilian ICP-Brasil infrastructure (VIDaaS and Bird ID) are available only to Members registered in Brazil. Unless expressly stated otherwise, documents generated by the Platform for Members outside Brazil are not signed under any qualified or advanced electronic signature scheme, and you are responsible for ensuring that the documents you issue meet the legal requirements of your jurisdiction.

6.9 Secretary profiles: the Clinic Administrator may grant access to the Platform to staff who do not act as healthcare professionals, through secretary profiles intended for administrative and front-desk tasks. A secretary profile:

(a) has access restricted to the features determined by the Administrator, such as the schedule, Patient registration and, where authorized, financial information, and the schedule and financial information may be limited to those of a specific professional of the Clinic;

(b) does not allow progress notes, assessments or other clinical records to be created, changed or deleted; and

The Clinic Administrator is responsible for granting, limiting and revoking such access, for making these Terms and the Privacy Policy known to the holder of the profile, and for the acts performed by them on the Platform, including the duty of confidentiality regarding the Patient Data they can access.

7. Account Closure

7.1 At your initiative: you may close your account at any time, without having to give a reason.

7.2 Your personal data as a Member: after closure, your personal data as a Member (registration, login and contact details) is kept for up to 90 days to allow account recovery and is then deleted or anonymized, except where we are legally required to retain it.

7.3 Patient Data within a Clinic: Patient Data you entered within a Clinic remains in the Clinic and accessible to its other Members, who continue to act as controllers. This sharing is an essential part of the Clinic feature, and you expressly acknowledge and accept this consequence when joining a Clinic.

7.4 Authorship records: records of authorship of progress notes, assessments, clinical documents and other professional acts you produced remain associated with your name and professional registration, to preserve the integrity of the clinical record. This authorship cannot be removed, even at your request.

7.5 Sole Clinic Administrator: if you are the only Administrator of a Clinic, closing your account requires you first to transfer the Administrator role to another Member of the Clinic or, if there is no other Member, to close the Clinic. In a Clinic under centralized management, transferring the Administrator role includes responsibility for the Clinic's Subscription, which must be taken out by the new Administrator in their own name; until then, the outgoing Administrator's Subscription remains in force and under their responsibility.

7.6 Export before closure: before closing your account, you may request an export of your Patient Data and clinical records. We will provide it in a structured and commonly used electronic format within 15 days of the request.

7.7 Patient Data outside a Clinic: Patient Data you entered as a Solo Member, outside any Clinic, is deleted within 90 days after closure, except where we are legally required to retain it. It is your responsibility to export it before closing your account.

7.8 Retention of clinical records: you are responsible for keeping your Patients' clinical records for the minimum periods required by the law and professional rules of your jurisdiction. If you close your account, you must arrange for their retention by other means.

8. Member Responsibilities

8.1 You are solely and exclusively responsible for:

All clinical decisions, assessments, diagnoses, treatments and professional acts
The truthfulness, accuracy and currency of the data you enter into the Platform
Compliance with the professional, ethical and health regulations of your jurisdiction
Keeping clinical records for the periods required by law
Processing your Patients' personal data in compliance with the data protection law applicable to you as controller, including having a valid legal basis for processing health data, informing your Patients, responding to their requests, and carrying out impact assessments where required
When caring for minors, observing the best interests of the child and the rules of your jurisdiction regarding the information, consent or authorization of parents or legal guardians
Obtaining, renewing and properly using any credentials or certificates you use with the Platform

8.2 You must not:

Provide false information or impersonate another professional
Share your login credentials
Use the Platform for unlawful or fraudulent purposes or contrary to good faith
Attempt to compromise the security or integrity of the Platform
Reverse engineer, decompile or copy components of the Platform
Overload, interfere with or abuse the operation of the Platform

8.3 Measurement, calculation and reference tools: the Platform provides auxiliary tools (including growth and reference curves, scales, formulas, reference values and comparison tables) designed for use in the care of infants and children. You acknowledge and accept that:

These tools are strictly auxiliary and do not replace the professional's clinical judgment
Results may contain errors or inaccuracies, or become outdated as the scientific literature evolves
It is entirely your responsibility to check and validate the accuracy of results before using them in any clinical decision, document or communication to a Patient
By signing, validating or formally approving a document containing results generated by these tools, you assume full responsibility for the values presented, towards the Patient, your professional body and any authority
Mamini is not liable for consequences arising from the use of results without your proper verification
Use of the tools in populations other than infants and children, or in contexts for which they were not designed, is entirely your responsibility

8.4 Artificial intelligence assistant: responses generated by the assistant are auxiliary and informative, are produced by a third-party model from the data you have entered, and may contain inaccuracies. They do not constitute a diagnosis, prescription, report or professional advice, do not make decisions on your behalf, and do not replace your assessment and clinical judgment. You must critically review any generated content before using it. Section 9 applies in full.

9. Availability, Warranties and Limitation of Liability

9.1 Best efforts: we use reasonable efforts to keep the Platform available, secure and functional, but we do not guarantee uninterrupted availability or the absence of errors.

9.2 Maintenance: the Platform may be temporarily unavailable due to maintenance, updates or events beyond our control. Where foreseeable, we will notify you reasonably in advance.

9.3 Backups: we make periodic backups of the database, without guaranteeing full recovery in every scenario.

9.4 DISCLAIMER OF WARRANTIES: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.

9.5 Exclusions: to the maximum extent permitted by applicable law, Mamini is not liable for:

Clinical decisions made by Members
The content, accuracy or completeness of data entered by Members
Consequences of the misuse of a Member's credentials
Failures caused by force majeure, acts of third parties or unavailability of external infrastructure services
Indirect, incidental, special or consequential damages, or loss of profits, revenue or data

9.6 LIABILITY CAP: TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, OUR TOTAL LIABILITY TO YOU UNDER OR IN CONNECTION WITH THESE TERMS IS LIMITED TO THE AMOUNTS ACTUALLY PAID BY YOU TO MAMINI IN THE 12 (TWELVE) MONTHS PRECEDING THE EVENT GIVING RISE TO THE LIABILITY.

9.7 Nothing in these Terms limits or excludes any liability that cannot be limited or excluded under applicable law.

10. Data Protection and Processing of Patient Data

10.1 Privacy Policy: the processing of personal data of Members and website visitors, for which Mamini is the controller, is governed by the Privacy Policy, which forms part of these Terms.

10.2 Roles: Mamini acts as controller of the personal data of Members and website visitors, and as processor of Patient Data, on behalf of Members. Each Member acts as controller (or joint controller, within a Clinic) of the Patient Data they enter and process.

10.3 Scope of this Section: this Section 10, together with Annexes I to III, governs our processing of Patient Data as processor for as long as we process it on your behalf. For Members in the EEA or the United Kingdom, it constitutes the contract required by Article 28(3) GDPR and the UK GDPR. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given to them in the GDPR, or the equivalent meaning in other applicable data protection law. In case of conflict between this Section and other provisions of these Terms on data protection matters, this Section prevails.

10.4 Instructions: we process Patient Data only on your documented instructions. These Terms, the configuration of the Platform you choose and the actions you perform on the Platform constitute your complete documented instructions; any additional instruction must be agreed in writing. We may process Patient Data otherwise only where required by law to which we are subject, in which case we will inform you before processing, unless the law prohibits it. We will immediately inform you if, in our opinion, an instruction infringes applicable data protection law.

10.5 Your obligations as controller: you are responsible for having a valid legal basis for processing Patient Data (including health data and data concerning children), for providing Patients with the information required by law, for ensuring that your instructions are lawful, for the accuracy and retention of the Patient Data you enter, and for carrying out data protection impact assessments where required.

10.6 Confidentiality: we ensure that persons authorized to process Patient Data are bound by confidentiality and that access is limited to what is necessary to provide, support and secure the Platform.

10.7 Security: we implement the technical and organizational measures described in Annex II, appropriate to the risk and to the special categories of data involved. We may update them provided that the overall level of protection is not reduced. You are responsible for the security of your account and for managing access within your Clinic.

10.8 Sub-processors: you give us general written authorization to engage the sub-processors listed in Section 9 of the Privacy Policy, which forms Annex III. We will inform you of any intended addition or replacement of a sub-processor that processes Patient Data, by email and/or in-Platform notice, at least 30 days before it takes effect. You may object on reasonable data protection grounds within that period. If the objection cannot be resolved in good faith, the holder of the Subscription (the Member or, in a Clinic under centralized management, the Clinic Administrator) may terminate it before the change takes effect and receive a pro-rata refund of prepaid fees for the period after termination, and a Member without a Subscription of their own may close their account within the same period. We impose on each sub-processor, by contract, data protection obligations at least as protective as this Section, and remain liable to you for their performance.

10.9 Data subject requests: we assist you in responding to requests from data subjects, mainly through Platform features to access, correct and export Patient Data. Requests about Patient Data received directly by us are forwarded to the competent Member without undue delay, and we will not answer them ourselves, other than to say they have been forwarded, unless you authorize it or the law requires it.

10.10 Assistance with compliance: taking into account the nature of the processing and the information available to us, we provide reasonable assistance with your obligations relating to security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with supervisory authorities.

10.11 Personal data breaches: we will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your Patient Data, with the information available at the time (nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed), supplemented in phases where needed. We will take reasonable measures to contain and remedy the breach. Notification is not an acknowledgement of fault or liability.

10.12 International transfers: Mamini is established in Brazil. Transfers of Patient Data from the EEA to Mamini rely on the European Commission's adequacy decision for Brazil, adopted in January 2026. Onward transfers to sub-processors outside the EEA and Brazil rely on the Standard Contractual Clauses adopted by the European Commission and/or, where the sub-processor is certified, the EU-U.S. Data Privacy Framework, together with the safeguards required by Brazilian law. Transfers from the United Kingdom rely on the UK International Data Transfer Addendum or another mechanism recognized under UK law, and transfers from other countries on the safeguards required by the law of the country of origin. You authorize these transfers.

10.13 Return and deletion: the export and deletion of Patient Data at the end of your account follow Sections 7.3 to 7.7. Copies in backups are deleted in the ordinary backup rotation cycle and remain protected under this Section until then.

10.14 Audits: we make available the information necessary to demonstrate compliance with this Section, including documentation of our security measures and responses to reasonable security questionnaires. Where that information is not sufficient, or where required by a supervisory authority, you may audit us directly or through an independent auditor bound by confidentiality, with at least 30 days' prior written notice, no more than once every 12 months (except after a personal data breach or at the request of a supervisory authority), during business hours, without disrupting our operations or compromising the data of other Members, and at your own cost.

10.15 No sale and no training: we do not sell Patient Data and do not use Patient Data to train our own artificial intelligence models.

10.16 Liability: liability under this Section is subject to Section 9, without prejudice to liability towards data subjects that cannot be limited under applicable data protection law.

11. Intellectual Property

11.1 Platform: all intellectual property rights in the Platform, including source code, trademarks, design, architecture and features, belong exclusively to Mamini or its licensors. These Terms grant you only a personal, non-transferable, non-exclusive license to use the Platform while your account is active.

11.2 Your data and Patient Data: data entered into the Platform remains owned by you or by the respective Patients, as applicable. We use it strictly to provide the service, as described in the Privacy Policy and Section 10.

11.3 Bibliographic references: the calculation, measurement and reference tools of the Platform are based on external scientific sources (publications, clinical guidelines, studies, technical standards and other third-party works), which are protected by the copyright of their respective authors and publishers. Mamini is not the author of those sources, and their use on the Platform respects the legal limits of scientific citation and copyright. Where applicable, the source reference is shown next to the corresponding tool.

12. Suspension and Termination by Mamini

12.1 We may suspend or close your account, with or without prior notice depending on the severity of the case, in the following situations:

Payment overdue for more than 7 days after notice
Breach of these Terms or the Privacy Policy
Fraudulent, unlawful or bad-faith use
Risk to the security of the Platform or to other Members
Order of a competent authority

12.2 Effects: in case of closure by Mamini, Section 7 applies to the fate of the data. No refund is due where closure results from your breach of these Terms.

13. Changes to these Terms

13.1 We may update these Terms from time to time. Material changes (affecting rights, obligations or prices) will be notified to you by email and/or in-Platform notice at least 30 days before they take effect.

13.2 Continued use of the Platform after the new version takes effect constitutes acceptance. If you do not agree with a change, you may cancel your Subscription before it takes effect, with effect at the end of the billing period already paid.

14. Additional Terms for the European Economic Area and the United Kingdom

This Section applies to Members whose account is registered in a member state of the European Economic Area (EEA) or in the United Kingdom.

14.1 Professional use: you act in your professional capacity. Statutory withdrawal rights applicable to consumers in distance contracts therefore do not apply; the refund window in Section 5.1 applies instead.

14.2 GDPR: when processing Patient Data, Mamini acts as processor under Article 28 of Regulation (EU) 2016/679 (GDPR) and, where applicable, the UK GDPR, and Section 10 and Annexes I to III of these Terms constitute the contract required by that article. As controller, you are responsible for relying on an appropriate legal basis for processing health data, such as Article 9(2)(h) GDPR, and for complying with the rules on professional secrecy applicable to you.

14.3 Rights of data subjects: nothing in these Terms limits the rights of data subjects under the GDPR, including the right to lodge a complaint with a supervisory authority or to bring proceedings before the courts of their member state of residence.

15. Additional Terms for the United States

This Section applies to Members whose account is registered in the United States.

15.1 HIPAA: Mamini does not currently enter into Business Associate Agreements under the Health Insurance Portability and Accountability Act (HIPAA). If you are a covered entity or a business associate under HIPAA, you must not use the Platform to create, receive, maintain or transmit protected health information. By using the Platform, you represent that your use does not require a Business Associate Agreement with Mamini. If this changes, you must notify us and stop entering protected health information into the Platform.

15.2 State health privacy laws: where state laws on health data (such as the Washington My Health My Data Act) apply to Patient Data, you are responsible for complying with them as the regulated entity, and Mamini acts as your processor under Section 10.

15.3 Disclaimers: Sections 9.4 and 9.6 apply to the maximum extent permitted by the law of your state.

16. General Provisions

16.1 Severability: if any provision of these Terms is held invalid, the remaining provisions remain in full force.

16.2 Assignment: Mamini may assign these Terms in the event of a corporate reorganization, merger or acquisition, maintaining the same guarantees to Members.

16.3 Communications: communications between the parties will be made preferably through the channels provided in your registration and through the Platform.

16.4 No waiver: failure to enforce any provision does not constitute a waiver of it.

16.5 Language: these Terms may be made available in other languages. In case of discrepancy between the English version and a translation, the English version prevails, except where applicable law provides otherwise.

16.6 Governing law and jurisdiction: these Terms are governed by the laws of the Federative Republic of Brazil. The courts of Jundiaí, São Paulo, Brazil, have exclusive jurisdiction over any dispute arising from them, without prejudice to mandatory provisions of data protection law and to the rights of data subjects under it.

17. Contact

General inquiries and refunds: [email protected]
Data protection officer: [email protected]

Annex I: Description of the Processing of Patient Data

Subject matter: provision of a platform for patient management, clinical records, clinical measurements and communication with Patients.

Duration: for the term of the Member's account and until deletion under Sections 7 and 10.13.

Nature of the processing: collection through the Member, storage, hosting, organization, structuring, retrieval, consultation, calculation of clinical indices and measurements, generation of clinical documents, sending of appointment confirmations and reminders, AI-assisted querying when enabled by the Member, backup and deletion.

Purpose: to enable the Member to manage their Patients, clinical records, appointments and communications in the course of providing health care.

Categories of data subjects:

Patients, including infants and children
Parents and legal guardians of Patients

Categories of personal data:

Identification data: name, date of birth, identity documents
Contact data: email address, phone number
Appointment data: dates, times, status of confirmation
Clinical data: clinical history, progress notes, assessments, measurements and clinical indices
Images: clinical photographs, three-dimensional head scans, attached documents

Special categories of data: data concerning health. Data concerning children is also processed. The safeguards applied are described in Annex II.

Frequency: continuous, for the duration of the account.

Annex II: Technical and Organizational Measures

Encryption in transit: TLS for all communications between users, the Platform and sub-processors
Encryption at rest: encryption of the database and of file storage
Authentication: session authentication with HttpOnly and Secure cookies, and passwords stored only as cryptographic hashes
Access control: role-based access control, with separation of data between Members and Clinics, and ownership checks on every request to Patient Data
Audit logs: logging of access to clinical records, retained for 12 months
Error monitoring: filtering of personal data before events are sent to the error monitoring sub-processor, and no session recording
Appointment confirmation pages: random, non-guessable URLs, excluded from search engine indexing, with the Patient's name hidden 48 hours after the appointment
Personnel: access limited to authorized persons bound by confidentiality, on a need-to-know basis
Backups: periodic backups of the database
Incident management: a documented procedure for detecting, assessing and notifying personal data breaches
Sub-processor management: data protection agreements with sub-processors and assessment of their security before engagement

Annex III: Sub-processors

The sub-processors authorized by the Member, with their purpose and location, are those listed in Section 9 of the Privacy Policy at mamini.app/en/privacy, as updated under Section 10.8.