healthia Educação
Privacy Policy
Version 2026-09-19.3 · Last updated: September 19, 2026
Controller: upSkillScore LLC, subsidiária integral da Pyrmont Holdings, Inc. · Data Protection Officer: [PENDENTE: nome do encarregado (DPO)], privacy@upskillscore.com.
Also read the Terms of Use.
1. Data we process
| Category | Examples | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Registration | e-mail, name, credentials (Cognito) | create and authenticate the account | performance of contract (V) |
| Study usage | answers to cases/mock exams, scores, progress, attempts | provide the service, measure performance | performance of contract (V) |
| Free text | typed answers graded by AI | grading and feedback | performance of contract (V) |
| Payment | Stripe customer identifier, subscription status/cycle (we do not store card numbers) | billing | performance of contract (V); legal obligation (II) |
| Device/security | device identifier (used to prevent account sharing) | prevent sharing | legitimate interest (IX) |
| Technical | access and error logs (kept for 6 months) | security and diagnostics | legitimate interest (IX) |
| Acceptance | accepted version, date and time, IP address and browser | prove consent to the terms | legal obligation and regular exercise of rights (II, VI) |
We do not ask for the student's health data. Do not enter identifiable data of a real patient.
2. AI and automated decisions
Free-text answers are sent to language models (Amazon Bedrock) for grading and tutoring. You may submit a score dispute through the platform. It goes into an internal review queue handled by our team, which is not a clinical review, with no guaranteed response time and no automatic notice. Regardless of that, you may ask the data protection officer to review an automated decision (LGPD art. 20) at privacy@upskillscore.com. See the AI Notice.
3. Who we share data with
Processors: AWS (hosting, Cognito, Bedrock, SES) and Stripe (payments). We do not sell data. Today we do not use third-party analytics tools. See the Cookie Policy.
4. International transfer
Processors may process data outside Brazil (LGPD art. 33). The transfer takes place with processors that adopt contractual data protection safeguards.
5. Retention
Account data: kept until deletion. After a deletion request, we erase it within 30 days, except records the law requires us to keep (payment, proof of acceptance, logs). The acceptance audit trail (accepted version, date and time, IP address and browser) is mandatory retention: it proves your consent and is kept for as long as the relationship lasts and for the statutory limitation period. Access logs are kept for 6 months (Brazilian Internet Civil Framework, art. 15).
6. Your rights (art. 18)
Confirmation, access, correction, anonymization/deletion, portability, information about sharing, withdrawal of consent, review of automated decisions (art. 20). Ask at privacy@upskillscore.com; reply within 15 days. Requests for data export and deletion are also made at that address. A score dispute on the platform follows item 4.2 of the Terms of Use and does not replace a request to the data protection officer.
7. Security
Encryption in transit, access control, logs. Relevant incidents will be reported to the ANPD and to data subjects as required by law.
8. Children and adolescents
The platform is intended for people aged 18 or over (Terms of Use, item 5.1). We do not knowingly collect data from children and adolescents; if we identify an account in that situation, it will be closed and the data erased.
9. Changes
We will announce relevant changes by e-mail or on the platform.