Dersalis Privacy Policy

Effective as of: April 2026

We, DERSALIS BRASIL INOVACOES EM SAUDE SA, hereinafter referred to as Dersalis, value the privacy and protection of personal data of our clients, users, employees, partners, and all data subjects. Therefore, this Privacy Policy has been prepared in compliance with Brazilian Law No. 13,709/2018 (General Data Protection Law – LGPD), Law No. 12,965/2014 (Brazilian Internet Act), Law No. 8,078/1990 (Consumer Protection Code), and, where applicable, international data protection regulations, including the General Data Protection Regulation of the European Union (GDPR).

This Policy aims to clearly and transparently describe how Dersalis collects, accesses, uses, stores, shares, and protects personal data in the context of its services, including its website, web platform, mobile application, wearable devices, sensors, gateways, and other integrated technologies.

By using or accessing our services, applications, devices, or platforms, you acknowledge that you have read and understood the practices described in this Privacy Policy. We recommend careful reading, as it explains what data may be collected, how it is used, with whom it may be shared, and what rights are granted to data subjects.

1. DATA COLLECTED, COLLECTION METHODS, AND PURPOSE

Dersalis collects and processes personal data strictly necessary for the provision of its services, compliance with legal and contractual obligations, operational safety, and continuous improvement of its technological solutions.

Data collection may occur actively, when information is provided directly by the data subject, client, or contracting company, or automatically, through the use of our website, platform, mobile application, wearable devices, sensors, gateways, and related technologies.

In general, Dersalis may collect, use, store, and process personal data to enable service delivery, authenticate access, ensure system security, monitor operational risks, generate alerts, produce reports, provide technical support, improve solutions, and comply with legal and regulatory requirements.

Within our institutional website, data may be collected when users fill out contact forms, request demonstrations, interact with support channels, participate in recruitment processes, or browse content. This may include name, email, phone number, company, job title, professional information, and any other data voluntarily provided.

Within the mobile application and integrated systems, Dersalis may collect operational identifiers, device data, usage data, connectivity data, location data, and sensor data from connected devices.

Whenever possible, data is associated with internal identifiers defined by the contracting company, avoiding direct public identification such as full name or personal ID numbers in operational contexts.

1.1 Location Data

The Dersalis mobile application may access, collect, and process location data from the device, including GPS data, Wi-Fi-based location, mobile network data, and other available technologies. Location data may be collected both while the application is actively in use and, when required for the service, in the background, even when the application is not open.

Location data is used to contextualize operational events, associate risk alerts with physical environments, support safety analysis, assist in incident investigation, monitor operations, and generate operational and safety reports.

Dersalis does not use location data for advertising, marketing targeting, or sale to third parties.

1.2 Sensor and Wearable Data

Dersalis solutions may collect data from wearable devices and sensors connected via Bluetooth, BLE, Wi-Fi, LTE, NB-IoT, or similar technologies. This includes heart rate, heart rate variability (HRV), skin temperature, motion data, accelerometer and gyroscope data, and other physiological or operational signals.

These data are used for monitoring occupational risks, assessing fatigue and stress, generating preventive alerts, supporting safety analysis, and improving operational performance.

Dersalis does not provide medical diagnosis. The data processed is intended solely for operational safety and risk prevention purposes.

1.3 Device and Connectivity Data

We may collect technical data such as Bluetooth connection status, device identifiers, network information, synchronization logs, transmission logs, system performance data, timestamps, and other technical information required to ensure system functionality and reliability.

1.4 Application Usage Data

We collect data related to application usage, including access logs, interactions, system events, errors, and performance metrics. This information is used to improve user experience, maintain system stability, and enhance security.

2. DEVICE PERMISSIONS AND APPLICATION FUNCTIONING

The Dersalis mobile application may request access to device features, including location, Bluetooth, internet connectivity, and background execution, as necessary for the proper functioning of the solution.

Location permission may be required to enable safety monitoring, operational context analysis, and reporting features. Bluetooth access is required to connect to wearable devices and sensors. Network access is necessary for data transmission and synchronization.

Background execution may be required to ensure continuous monitoring and data collection for safety purposes.

Users may manage permissions through device settings; however, restricting permissions may impact the functionality of the application.

3. PURPOSE OF DATA PROCESSING

Personal data is processed exclusively for legitimate purposes, including operational safety, risk prevention, service delivery, performance monitoring, reporting, technical support, compliance with legal obligations, and continuous improvement of our solutions.

Dersalis does not use personal data for advertising or commercial targeting.

4. DATA SHARING

Data may be shared with authorized personnel within Dersalis, the contracting company responsible for the monitored operation, service providers (such as cloud infrastructure providers), and authorities when required by law.

Dersalis does not sell personal data.

5. INTERNATIONAL DATA TRANSFER

Data may be stored or processed outside Brazil, including in the United States, due to the use of cloud infrastructure services. Dersalis ensures appropriate safeguards are in place to protect personal data in accordance with applicable laws.

6. DATA RETENTION

Data is retained for as long as necessary to fulfill its purpose, comply with legal obligations, and support contractual requirements. After this period, data may be deleted or anonymized.

7. DATA SECURITY

Dersalis adopts technical and organizational measures to protect personal data, including access controls, encryption where applicable, monitoring, and secure cloud infrastructure.

8. DATA SUBJECT RIGHTS

Data subjects have rights under applicable laws, including access, correction, deletion, anonymization, and objection to processing, where applicable.

9. POLICY CHANGES

This Privacy Policy may be updated at any time. Updated versions will be made available through official channels.

10. CONTACT

For questions or requests related to this Privacy Policy, please contact:

contato@dersalis.com

Effective as of: April 2026.