Privacy Policy

1. Data controller and roles

Website: the controller of the personal data collected on this website is Dersalis Brasil Inovações em Saúde S.A., corporate taxpayer ID (CNPJ) 31.106.162/0001-32.

App: the Dersalis app is provided to business customers and their partners. For the personal data of operators processed in the app, the customer company that contracts the service acts as controller and Dersalis Brasil Inovações em Saúde S.A. acts as processor, under the BioLink.Fleet Terms of License and Use.

For any questions about this policy or to exercise your rights as a data subject, contact us at contato@dersalis.com.

2. Data collected on the website

Data you provide voluntarily: when you fill out our contact form, we collect your name, work e-mail, company, job title, sector, estimated number of operators and, optionally, your phone number.

Data collected automatically: when you browse the site, we automatically collect navigation data such as pages visited, traffic source (UTM parameters), device and browser type, and IP address, through Google Analytics (GA4) and Google Tag Manager.

Cookies: small files stored in your browser to remember your cookie-consent choice and, when you authorize it, to power the analytics tools mentioned above.

3. Why we use this data (website)

We use the data described above to: respond to messages and requests sent through the contact form; understand how visitors use the site so we can improve its content and experience; and measure the origin and performance of our marketing efforts.

4. Sharing with third parties (website)

To operate the site and the services described here, we work with the following providers, who process data on our behalf and solely for these purposes: Vercel (website hosting), Brevo (contact/CRM management and lead-notification e-mails) and Google (Analytics and Tag Manager, for traffic analysis). These providers may store data on servers located outside Brazil.

5. Legal basis (LGPD) — website

We process personal data collected on the website based on: your consent, for analytics cookies; the execution of preliminary procedures related to a contract, to respond to a contact request you initiate; and our legitimate interest, for aggregated navigation metrics that do not identify you individually.

6. Cookies and the consent banner

Strictly necessary cookies (such as the one that stores your consent choice) are always active. Analytics cookies (Google Analytics) are only activated after you accept them in the cookie banner shown on your first visit. You can withdraw your consent at any time by clearing this site's data in your browser settings, which will show the banner again.

7. Your rights as a data subject

Under LGPD article 18, you may request: confirmation that we process your data; access to your data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data; data portability; deletion of data processed with your consent; information about the public and private entities with which we share data; and the right to withdraw consent. To exercise any of these rights, write to contato@dersalis.com.

For data processed in the app, you may also exercise your rights with the customer company (controller); Dersalis will support the handling of the request.

8. Data retention (website)

We keep contact-form data for as long as necessary to fulfil the purpose it was collected for, or until you request its deletion. Analytics data follows the retention settings configured in our Google Analytics account.

9. Security

We adopt reasonable technical and administrative measures to protect personal data, on the website and in the app, against unauthorized access, loss, alteration or disclosure.

10. App: what data we collect

When you use the Dersalis app, it may collect and sync with Dersalis servers the following categories of data:

User identification: the registration number (matrícula) assigned by the customer company. The app does not collect name, e-mail address or phone number, and the data collected is associated with the matrícula, not with those personal details.

Location data: GPS coordinates — latitude, longitude and altitude — as detailed in section 11.

Physiological and health data: heart rate and heart rate variability (intervals between beats), skin temperature, movement intensity, acceleration and vibration, drowsiness and fatigue indicators, energy expenditure and attention-test results, obtained through sensors and wearable devices connected to the app and the phone's own sensors, as detailed in section 12.

Activity recognition: physical-activity information provided by the device.

Technical data: phone and sensor battery level and technical information needed for the app to work and sync.

11. Location data

The app collects your device's precise location (GPS): latitude, longitude and altitude. A position is recorded approximately once every minute while a work journey is active, and collection stops when the journey ends.

Collection uses Android's location permissions (precise, approximate and background) and a foreground service, which allows location to keep being recorded during the journey, including when the app is not open on screen. Location data is stored on the device and synced with Dersalis servers.

We use location only to provide the operational context for risk analysis: it is cross-referenced with physiological signals to help interpret risk in the operation.

Location data may be accessed by the customer company (controller) and by Dersalis (processor). You can revoke the location permission at any time in your device settings; without the permission, the app does not collect location.

12. Physiological and health data (sensitive data)

The physiological signals collected by the app are sensitive personal data relating to health under the LGPD. They are processed to generate probabilistic risk indicators (for example, of fatigue) that support decisions made by people designated by the customer company. The app and the service are not a medical device and do not diagnose any health condition.

The customer company, as controller, is responsible for defining the appropriate legal basis and for informing operators about the processing of this data. Dersalis processes it as processor, confidentially and with technical and administrative security measures.

13. How we use app data and who we share it with

We use app data to operate, support and improve the service — in particular, to process physiological signals and operational data to generate risk indicators and alerts for the customer company.

Identifiable app data is accessed by the customer company that contracted the service (controller) and by Dersalis (processor). We may share data with infrastructure and technology providers that help us operate the service, which process it on our behalf and only for that purpose.

Dersalis may also generate anonymized, aggregated data, which does not identify the customer or any data subject, for research and improvement of its algorithms and products.

14. Retention and account deletion (app)

App data, including location and physiological signals, is kept while the customer company's license is active. After the license ends, Dersalis may delete it after 90 (ninety) days, subject to the service's technical records and legal retention requirements set out in the Terms of License and Use.

The app does not collect name, e-mail address or phone number. To request deletion of the registration for a matrícula, the customer company (controller) must submit the request to Dersalis, as described at dersalis.com/exclusao-de-conta. Once the registration is deleted, the data already collected is no longer linked to that matrícula.

15. App permissions and how to control them

On Android, the app requests permissions for: precise, approximate and background location (section 11); body sensors and activity recognition (section 12); Bluetooth (to connect sensors and wearable devices); and notifications (to send alerts). You can grant or revoke these permissions at any time in your device settings. Without some permissions, parts of the service may not work as expected.

16. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised.

17. Contact

Questions about this policy or requests related to your personal data can be sent to contato@dersalis.com.