Privacy Policy

1. Who we are

Medvoice is a product of Qub8 Soluções em Software e Infraestrutura Digital Ltda., CNPJ 62.288.490/0001-20, headquartered at Rua Felipe de Oliveira, 728, Petrópolis, Porto Alegre/RS, CEP 90630-000, which is the controller of the personal data described in this policy, except where otherwise indicated in section 6.

Data protection officer (DPO): Anderson Roberto Pinheiro Domingues, dpo@qub8.com.br. For support and other matters: contato@qub8.com.br.

2. What Medvoice is

Medvoice is a tool that supports clinical documentation for health professionals and researchers. With the patient’s authorization, the professional records the consultation (or imports a recording they are authorized to use), and Medvoice transcribes the audio and produces a draft clinical document for the professional’s own review.

Professionals create their own account in the app, and recording is enabled only after the account is approved; registration may go through a manual check. Medvoice is not offered to patients.

3. AI produces a draft, not a diagnosis

The document produced is a draft generated by artificial intelligence from what was said during the consultation. It is not a diagnosis, a prescription, or an autonomous clinical decision: Medvoice records only what the professional said and does not suggest, infer, or complete diagnoses.

Review by the professional is mandatory. Copying or sharing the document is enabled only after the professional marks it as reviewed, and every later edit removes that mark.

4. Data we process

About the professional and the account

• email address, used to identify the account and for access;
• the sign-in method the professional chooses: email and password, with the password set by the professional and the email address confirmed by a code sent to it; a Google account; or an Apple account;
• when signing in with Google: the email address, name, profile photo address, and an identifier of the Google account, sent by Google. We use the email address and the identifier for access; the name and photo are recorded in the authentication service, but the app neither uses nor displays them;
• when signing in with Apple: an identifier of the Apple account and the email address, sent by Apple. If the professional chooses to hide their email address, Apple sends us a private relay address from Apple in its place, and that address is the one stored on the account. Only on the first authorization does Apple also send the name, which we record in the authentication service and use to fill in the name on the profile;
• name and, optionally, CRM (medical council registration number) and UF (Brazilian state), provided by the professional in the app and used when the account is approved. When the professional signs in with Apple, the name Apple sends appears already filled in on the profile and becomes the registered name only when the professional checks and saves it; the name received from Google is not used;
• account status (awaiting approval, approved, or suspended), profile (physician or researcher), and daily encounter quota;
• the record of acceptance of this policy and of the Terms of Use: version, language, hash of the accepted text, and server time.

About the encounter

• the confirmation, given by the professional for each encounter, that the patient was informed and authorized the recording, with the version of the notice presented;
• the audio of the consultation, recorded in the app or imported;
• the transcript, identifying who spoke (professional, patient, companion, staff);
• the clinical document, its edits, and the review mark;
• the free-text reference the professional chooses to give the encounter to find it later;
• the optional “Rate this document” rating (score, reference time, and how much of the text was changed);
• the record that a document was copied or shared: only the type of action, the version, and the time, never the text or the recipient.

Encounter content may contain sensitive personal health data of patients. See section 6.

Technical and diagnostic data

• opaque identifiers, app version, operating system, processing states, and error logs. These logs are configured not to contain audio, transcripts, documents, names, email addresses, CRM numbers, or clinical text;
• the IP address and connection data that every server receives when it is accessed, processed by the infrastructure providers.

The app stores on the device the access session and, until the upload finishes, the audio chunks of the recording in progress. The medvoice.app website does not use advertising or tracking cookies.

From the website waitlist

Name, email address, specialty, optional CRM and UF, and the record of acceptance, to contact interested people about the pilot.

5. Purposes and legal bases

• Providing the service (creating and approving the account, authenticating, recording, transcribing, generating, and displaying the document): performance of the contract with the professional, under Brazil’s General Data Protection Law (LGPD), art. 7, V.
• Processing patient health data on behalf of the professional, to document the encounter: protection of health in a procedure performed by a health professional (art. 11, II, f), together with the patient’s authorization collected for each encounter.
• Security, fraud prevention, failure diagnosis, and reliability improvement, with minimized technical data: legitimate interest (art. 7, IX).
• Keeping proof of acceptance of this policy and responding to authorities: compliance with a legal or regulatory obligation and the regular exercise of rights (art. 7, II and VI).
• Contacting waitlist subscribers: consent (art. 7, I), which may be withdrawn whenever the subscriber wishes.

6. Patient data and authorization for each encounter

With respect to patient data, the health professional (or the institution where they work) is the controller: they decide to record, inform the patient, and are responsible for the medical record. Medvoice acts as processor, processing this data only to provide the service to the professional and according to the professional’s instructions.

Before each recording or import, the app shows the notice that the professional must give the patient:

The confirmation that the patient was informed and gave authorization always starts unchecked, applies to a single encounter, and cannot be reused. Without it, the app neither records nor uploads audio. If the patient refuses, the encounter proceeds without Medvoice. When the patient is a child or adolescent, the professional is responsible for obtaining authorization from one of the parents or the legal guardian.

Patients who wish to exercise rights over their data should contact the professional or institution that treated them. If they contact us directly, we will forward the request to that professional or institution and support the response.

7. Providers

We use the providers below, engaged to process data only to provide the service to Medvoice. Transcription uses more than one provider: each audio file is sent to one of them at a time, chosen according to each one’s availability and capacity, and another is used only if the chosen one is unavailable.

When the professional chooses to sign in with Google or Apple, these companies, headquartered in the United States, authenticate the professional’s account under their own privacy policies and send us only the data described in section 4. When an account that uses Apple to sign in is deleted, we send Apple the revocation request described in section 9.

We may also share data when required by law, a court order, or a competent authority, or in a corporate reorganization, with the safeguards of this policy maintained.

8. International transfer

Audio and transcripts are processed by providers outside Brazil (AssemblyAI, Amazon Web Services in the United States, Runpod, and OpenAI), and technical data by Sentry, Expo, Vercel, and Google. These transfers are made to perform the service contracted by the professional (LGPD, art. 33, IX and II), under contracts that limit the use of the data to providing the service, prohibit training models with it, and require security measures compatible with this policy.

When transcription runs on Amazon Web Services in the United States (the Northern Virginia, Ohio, and Oregon regions), the audio is not stored there: it stays only in the server’s temporary memory while it is transcribed and is discarded when the transcription ends, and the server is shut down when there is no more work. The audio remains stored only in Brazil.

9. Retention and deletion

• Audio: deleted as soon as the transcript is saved and verified. As an additional safeguard, all audio remaining in our storage is automatically deleted within 30 days.
• At the transcription and generation providers: we request deletion or configure no retention whenever the provider offers that control. Where it does not, the provider’s contractual period applies, generally up to 30 days, solely for security and abuse prevention. At Amazon Web Services in the United States, the audio is not stored (section 8).
• Transcript and document: kept until the professional deletes the encounter in the app, which removes them permanently, or until the account is deleted.
• Account: while it is active. When the account is deleted, we delete the encounters and the associated data, including the data received from Google or Apple at sign-in. If the account uses Apple to sign in and is deleted on the iPhone, the app asks Apple for a new confirmation and we ask Apple to revoke the authorization given to Medvoice; we keep no Apple token. See how to delete the account.
• We keep for the legally required period only the minimum necessary to comply with legal obligations or to defend ourselves in legal proceedings, such as the access logs required by Brazil’s Marco Civil da Internet (6 months). Proof of acceptance of this policy is kept while the account exists and is deleted with it.
• Waitlist: until the end of the pilot or until a deletion request, whichever comes first.

A document that the professional copies or shares then resides at the destination they chose, such as the medical record or a messaging app. At those destinations, keeping it is their responsibility, and deleting the encounter in Medvoice does not delete those copies.

10. Security

• audio is sent directly to storage over an encrypted connection and is stored encrypted with a dedicated key, with no public access;
• access to data is restricted to the professional and to authorized services, with rules enforced in the database;
• the account is personal, and access uses a password the professional sets, with the email address confirmed by a code, or the professional’s Google or Apple account;
• the operations team sees only technical and aggregate indicators, never audio, transcripts, or documents;
• technical logs do not contain personal or clinical data, only opaque identifiers.

No system is completely immune to incidents. If an incident involving relevant risk occurs, we will notify those affected and Brazil’s National Data Protection Authority (ANPD), as the law requires.

11. Your rights

Under the LGPD (art. 18), you may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, withdrawal of consent, and review of automated decisions.

Name, CRM, and UF can be corrected in the app itself, under Profile (identity changes go through a new approval). Encounters can be deleted by the professional. For other requests, write to the DPO at dpo@qub8.com.br; we respond within 15 days. You may also file a complaint with the ANPD.

Support · Delete my account

12. Effective date, version, and changes

This policy is version 2026-10-21.1, in Brazilian Portuguese, of which this page is a courtesy translation, and it applies together with the Terms of Use. If we make a relevant change, we will publish a new version on this page and ask for a new acceptance in the app before you continue using the service. Previous versions remain valid for what was done while they were in effect.