Privacy Policy

1. Who we are (Controller identification)

Atypos.family is a digital platform for families with neurodivergent children and adolescents. The service is operated by:

If you have questions about how we handle your data, you can write to us at any time.

2. Data Protection Officer (DPO)

As required by LGPD Art. 41, we have designated a DPO:

3. Data we collect and why

We collect only the data we need to operate. Below are the categories, what we collect, and why:

3.1 Caregiver (legal guardian) data

3.2 Child or adolescent identification data

3.3 Health data — SPECIAL CATEGORY (LGPD Art. 11)

The data below is classified as sensitive data and receives enhanced protection:

Important: Atypos.family is not a health service and does not make diagnoses. The "declared diagnosis" is provided by you — we do not verify, clinically interpret, or share it with third parties beyond the technical sub-processors listed in Section 7.

3.4 Behavioural and usage data

3.5 Financial data

We do not store credit card data. Payment processing is handled by Stripe (credit card — US servers): Atypos receives only payment confirmation (status + transaction_id); and AbacatePay (PIX — Brazilian servers): Atypos receives only payment status confirmation.

3.6 Navigation and technical diagnostic data

4. Children's and Adolescents' Data — Special Protection (LGPD Art. 14)

Atypos.family processes data of children (under 12) and adolescents (12 to 17 years old), with enhanced protection as required by LGPD Art. 14. The same safeguards apply to both groups, though we acknowledge that risk profiles and progressive autonomy differ between these age ranges.

Guiding principle: the best interests of the child and adolescent guide all our decisions about data processing.

Consent: processing a minor's data requires specific and prominent consent from the legal guardian (parent, tutor, guardian, or any person legally authorised to represent the minor), collected at the start of the manual creation flow. We adopt guardian legitimacy verification mechanisms proportional to the risk of the processing and to the minimisation principle.

• We use the minor's data exclusively to generate the manual requested by the caregiver
• We do not share the minor's data with third parties for commercial purposes
• We do not use the minor's data for advertising or marketing profiling
• The manual is accessible only to the legal guardian who created it (private URL with 144 bits of entropy)
• Minor's photo: optional, stored in a private bucket, access URLs expire in 72 hours

5. Artificial Intelligence and Automated Decisions

Atypos.family uses artificial intelligence tools to support the organisation of your responses and the generation of your personalised manual. This processing may include creating summaries and descriptive profiles based on the information provided in the form and quiz.

Atypos.family does NOT perform medical diagnosis, does NOT issue clinical reports, and does NOT replace specialised professional assessment. The generated manual is a practical guidance document — with no clinical or therapeutic value.

AI provider: Anthropic Inc. (USA), through the Claude model via a standard commercial API. By default, Anthropic does not use inputs and outputs from commercial clients to train its models. We do not have Zero Data Retention (ZDR) or a Business Associate Agreement (BAA) configured with Anthropic. Anthropic's data practices can be consulted directly in its official documentation (privacy policy and usage policies).

When automated processing may significantly affect your interests, you may: (a) request human review of the AI-generated decision or content; (b) request clarification about the logic applied; (c) exercise all rights provided under LGPD Art. 20 regarding automated decisions. To do so, contact us at encarregado@atypos.family.

6. How long we keep your data (Retention)

When you delete your account, all minor's data is removed from the active database. We request deletion from third-party systems (Section 8), but their timelines may vary. Backup copies may have residual technical retention per internal backup policy.

7. Your Rights as a Data Subject (LGPD Art. 18 and Art. 20)

You have the following rights over your data — and the data you provided about your child or dependent:

• Confirmation: know whether we process your data
• Access: receive a copy of the data we hold about you
• Correction: correct incomplete, inaccurate or outdated data
• Anonymisation or blocking: for unnecessary, excessive, or non-compliant data
• Portability: receive, in a structured and interoperable format, the data you directly provided — limited to data the law actually subjects to the portability right
• Erasure: request deletion of data processed on the basis of consent
• Information: know with whom we share your data
• Objection: object to processing based on legitimate interest if you believe it harms your rights
• Human review of automated decisions: request that an AI-generated automated decision be reviewed by a human, receive clarification about the logic applied, and contest the outcome (LGPD Art. 20)
• Withdrawal of consent: revoke any consent given, without prejudice to prior processing

How to exercise your rights:

1. Via the app: go to /account and select "Privacy and data"
2. By email: encarregado@atypos.family with subject "LGPD Rights"

We respond within the applicable legal and regulatory timeframes. We may ask for identity confirmation before processing your request. You may also submit a complaint directly to the Brazilian National Data Protection Authority (ANPD): https://www.gov.br/anpd

8. Who we share your data with

We share personal data only with third parties necessary to operate, host, bill, communicate, or protect the service. Depending on the context, these third parties act in distinct roles:

Processors (handle data on our behalf, following our instructions):

Independent controllers (also process data to meet their own regulatory obligations and purposes):

Public content CMS (does not access family data):

DPAs (Data Processing Agreements) with vendors marked as "under review" or "to be formalised" are in the process of negotiation and execution. We will update this section as instruments are signed.

9. International Data Transfers

Several of our vendors have servers outside Brazil. Transfers are governed by the legal mechanisms applicable to each flow:

9. Cookies and Tracking

We use cookies to keep your session active, analyse site usage, and identify technical bugs. You can manage your preferences via the cookie banner available on the site.

Categories:

• Essential: required for operation (authentication, session). Cannot be disabled.
• Analytics: PostHog and Google Analytics — collect aggregated usage data. Enabled with your consent.
• Diagnostics: Sentry — captures technical errors with masked sessions. Enabled with your consent.

10. Security

We adopt technical and organisational measures to protect your data:

• Database with per-user access control (Row-Level Security)
• Photos and PDFs stored in private buckets (authentication required for access)
• Temporary access URLs (expire in 72h) for sensitive files
• Data transmission via HTTPS with TLS
• Error monitoring with masked data
• Internal access limited to the minimum necessary

If we become aware of a security incident affecting your data, we will notify you and the ANPD as required by LGPD Art. 48.

11. Changes to this Policy

We may update this policy periodically to reflect legal, operational, or technological changes to the service. When we make material changes, we will provide notice by appropriate means at least 30 days in advance. The "last updated" date at the top of this page will always reflect the current version. When a change involves a new purpose, new sharing, new international transfer, or a change of legal basis that requires consent, new consent will be requested before the new processing begins — continued use of the service does not substitute that specific consent. If you do not agree with a material change, you may close your account before it takes effect.

12. Contact and DPO Channel

To exercise your rights, ask questions, or make complaints:

If you are not satisfied with our response, you may also contact the Brazilian National Data Protection Authority (ANPD) at https://www.gov.br/anpd https://www.gov.br/anpd

Version 1.0.0 — May 15, 2026