Privacy Policy

1. Who is responsible for your data

Moxuara Servicos Medicos Sociedade Simples, CNPJ 27.683.555/0001-31, Brazil, operates NeuroHub and is the controller of the personal data described here. Contact: decastroneurologia@gmail.com.

2. Data we collect

• Account data: email address, password (stored only in hashed form by our authentication provider), full name, role (student or physician) and, optionally, your professional registration number.
• Content you submit: messages in the chat and emergency/outpatient modules, clinical case simulation transcripts and feedback, and prescription-drafting inputs and results. Please do not include patient-identifying information.
• Usage data: conversation history, daily AI message counts (for fair-use limits) and basic technical logs.
• Subscription data: plan, status and billing dates. Payments are handled by Paddle; we do not receive or store your full card details.

3. Why we use it

• To provide and secure the Service, including generating AI responses and saving your history.
• To manage your subscription, prevent abuse and enforce usage limits.
• To send essential emails, such as account confirmation.
• To improve the Service, including through the feedback you choose to share.
• To comply with legal obligations.

Our legal bases are performance of the contract with you, our legitimate interests in operating and securing the Service, compliance with legal obligations and, where required, your consent. We do not sell your personal data and do not use it for advertising.

4. Service providers that process data for us

• Supabase — database and authentication.
• Vercel — application hosting.
• Anthropic — artificial intelligence model that generates answers. Your messages and the relevant reference excerpts are sent to it to produce each response.
• Voyage AI — converts text into numerical representations (embeddings) to find relevant reference material. The text of your recent messages is sent to it for this purpose.
• Resend — delivery of transactional emails.
• Paddle — payment processing, tax and invoicing, as our merchant of record. Paddle acts as an independent controller of the payment data it collects, under its own privacy policy.

These providers may be located outside your country, including in the United States, so your data may be transferred internationally. We rely on contractual safeguards with our providers for such transfers.

5. Patient information

NeuroHub is not designed to store protected health information. Do not enter names, document numbers, contact details or other identifiers of patients. If you believe identifiable patient information was submitted by mistake, contact us so we can delete it.

6. Cookies

We use only essential cookies, to keep you signed in and to remember your language. We do not use advertising or cross-site tracking cookies.

7. Retention

We keep your data while your account is active. When you ask us to delete your account, we delete your personal data and content, except what we must keep to comply with legal, tax or accounting obligations or to handle disputes.

8. Your rights

Under the Brazilian General Data Protection Law (LGPD) and, where applicable, the GDPR and similar laws, you may ask us to confirm that we process your data, access it, correct it, delete it, export it, restrict or object to certain processing, and withdraw consent. To exercise these rights, email decastroneurologia@gmail.com. You may also lodge a complaint with your data protection authority, such as Brazil’s ANPD.

9. Security

We use access controls, encryption in transit and per-user data isolation in our database. No system is completely secure, so we cannot guarantee absolute security; tell us right away if you suspect unauthorized access to your account.

10. Children

The Service is intended for adults. We do not knowingly collect data from anyone under 18.

11. Changes

We may update this policy. The “Last updated” date shows the current version, and we will notify you of material changes.