Data Protection

Privacy Policy

See how handles personal data and protects your privacy.

Updated on: January 7, 2026
1

Introduction

This Privacy Policy aims to demonstrate the commitment of MUPI SYSTEMS LTDA, private legal entity under private law, registered with CNPJ/MF under No. 26.882.608/0001-80, headquartered at Rua Dom João Pimenta, 701, store 2, Centro, in Montes Claros-MG, with the privacy and protection of personal data collected from its users.

This policy establishes the rules regarding the collection, recording, storage, use, sharing, enrichment, and deletion of data collected within the scope of the services and functionalities of the website mupisystems.com.br and platforms developed by it, in accordance with the applicable laws.

As a condition for access and use of the functionalities, the USER declares to be over 18 (eighteen) years old and that they have fully and carefully read the rules of this document and the Terms of Use, being fully aware and thus giving their free and express agreement to the terms stipulated herein. If you do not agree with these guidelines, you should discontinue your access.

2

Collected Data, Method and Purpose of Collection

Data is collected when the USER voluntarily enters or submits information by accessing and interacting with the features available on this site, which includes:

REGISTRATION PERSONAL DATA

Full name, email, date of birth, phone number, full address, used for: identifying the user, performing data portability, fulfilling service obligations, informing about news and features, promoting products and services, responding to requests, and complying with legal obligations.

DIGITAL IDENTIFICATION DATA

IP address, interaction logs, accessed screens, device information, Session ID, Cookies, used to: comply with the Internet Civil Framework, identify the user, evaluate the use of services, develop statistical and security studies.

3

Storage and Security

All technologies used will always comply with current legislation and the terms of this Privacy Policy.

The collected data will be stored on servers located in the United States, United Kingdom, Germany, or Brazil, as well as in a cloud computing environment, with secure transfer when necessary.

Through the service channel, the USER may change their consent grants for the processing of their data, grant new permissions, or withdraw their consent, being informed of the consequences that the withdrawal may cause.

4

Your Rights

Display and Rectification

Request access to your data or correction of incorrect information

Portability

Transfer your data to another service provider

Deletion

Request the removal of your personal data when appropriate

Opposition

Express opposition to the use of your personal data

Data Sharing

Collected data and recorded activities may also be shared with judicial authorities when there is a legal requirement, or automatically in the case of corporate transactions.

The database formed through data collection on the MUPI website and platforms is our property and responsibility, and its use, access, and sharing, when necessary, will be done within the limits and purposes of our business and described in this Privacy Policy.

  1. Personal identification information will not be sold or rented by MUPI.
  2. The USER is jointly responsible for the confidentiality of their personal data. Sharing passwords and access data violates this Privacy Policy and the Terms of Use of the MUPI website and/or platforms. Emails requesting the USER to forward their registration data will not be sent.

Internally, the data we collect is accessed only by properly authorized professionals, respecting the principles of proportionality, necessity, and relevance to the objectives of the MUPI website and/or platforms, in addition to the commitment to confidentiality and privacy preservation under this Privacy Policy.

How We Store Data and Records

  • The collected data and activity records will be stored in a secure environment controlled for the following minimum periods: concerning personal registration data, a period of 5 years after the cancellation of the registration on the site and MUPI SYSTEMS platforms, pursuant to Articles 12 and 34 of the Consumer Protection Code; and, for digital identification personal data, a period of 6 months, as per Article 15 of the Internet Civil Rights Framework Law.
  • If there is a USER request, the data may be deleted before that deadline. However, it may be necessary to keep the data for a longer period due to law, court order, fraud prevention, credit protection and other legitimate interests, in accordance with legal requirments. After the deadline and legal requirement, they will be deleted using secure disposal methods, or used in an anonymized manner for statistical purposes.
  • The collected data will be stored on servers located in the United States, United Kingdom, Germany, or Brazil, as well as in an environment using cloud computing resources or servers, which may involve, in this latter case, the transfer or processing of data outside Brazil, in the European Union, United Kingdom, and United States.
  • It may be necessary for MUPI to transfer your personal data to other companies that are part of the same economic group, or to an external service provider, which may also be based outside of Brazil, but operates exclusively on behalf of MUPI, and will use the user's personal data in accordance with this Privacy Policy.

Display, Rectification, Limitation, Objection, and Deletion of Data

  • The USER can request the display or rectification of their personal data through the following channels:
    1. CONTACT: accessible through this;
    2. SAC: by email contato@mupisystems.com.br.
  • Through the same tool, the USER can also:
    1. request the limitation of the use of their personal data;
    2. express their opposition to the use of their personal data;
    3. request the portability of registration data, in a readable format, to another Controller in the same field of our operations;
    4. request the deletion of their personal data that we have collected, provided that any Access Accounts have been canceled and the minimum legal retention period for data has passed.
  • If the user withdraws his consent for essential purposes for the regular operation of the MUPI site and/or platforms, services and features may become unavailable.
  • If the USER does not grant their consent for optional purposes, related to sending information, news, content, and other events relevant to the maintenance of the relationship, the services and functionalities of the MUPI website and/or platforms will continue to be regularly available.
  • For audit, security, fraud control, and rights preservation purposes, we may retain the USER's data record history for a longer period in cases where the law or regulatory norm establishes it, or for rights preservation.

NEWSLETTER

  • If you have signed up to receive the newsletter from the MUPI website and/or platforms, the USER agrees to receive news, personalized advertising about our products and services, and other information.
  • The MUPI newsletter includes updates, offers, and other MUPI or Group brand information.
  • When signing up to receive the MUPI newsletter, the USER declares to agree that MUPI will perform a personalized compilation of news, offers, and other information, as well as evaluate their site usage patterns, for the purpose of sending a personalized newsletter that meets the USER's needs and interests.
  • The data is also stored and used for promotional purposes and market research. To do so, we will only contact the USER by email. Finally, we will also use your data to analyze and improve the effectiveness of our websites.
  • If the USER no longer wishes to receive the MUPI newsletter, they may cancel their subscription at any time. To do so, the USER can click on the link provided in all newsletters to be redirected to the cancellation process or can use one of the following means of communication:
    1. CONTACT: accessible through this;
    2. SAC: by email contato@mupisystems.com.br.

COOKIES

  • To facilitate the use of the MUPI website and/or platforms, "Cookies" are used. Cookies are small data units stored on your computer's hard drive by your browser and are necessary for the use of the MUPI website and/or platforms.
  • Cookies allow a Digital Platform to store information about the USER's visit, their preferred language, their location, the frequency of their sessions, and other variables that MUPI considers relevant to make the experience much more efficient. These Cookies will also be used to help determine the usefulness, interest, and number of uses of the sites, allowing for faster and more efficient navigation and eliminating the need to repeatedly enter the same information. They do not store personal data or collect personally identifiable information.
  • Online Behavioral Advertising Cookies:
    1. MUPI reserves the right to use information obtained through Cookies from an analysis of the behavior of site visitors and/or MUPI platforms, in order to display specific advertising for some of our products. MUPI believes that this action benefits the USER because content or advertising that MUPI believes corresponds to the interests of the USER will be displayed - based on their browsing behavior - so you will see less randomly displayed advertising and less content that is not of interest to you.
  • How to prevent cookies from being stored on your hard drive and/or delete them:
    1. Most Internet browsers are set to automatically accept Cookies. The USER can change the settings to block the use of Cookies or alert you when a Cookie is being sent to your device.
    2. After authorizing the use of Cookies, the USER can always deactivate part or all of our Cookies.
    3. All browsers allow the user to accept, reject, or delete Cookies, namely by selecting the appropriate settings in their respective browser. The USER can configure the Cookies in the "options" or "preferences" menu of their browser.
    4. Note that by disabling cookies, you may prevent some web services from functioning properly, affecting, either partially or fully, navigation on the website.
  • Cookies used and their purposes:
    1. Google Analytics:
      1. Web analysis service provided by Google, Inc. ("Google"). Google Analytics uses a specific form of "Cookies", that is, text files, which are stored on your computer and allow the analysis of your website usage. The information generated by the Cookie about your use of the website will be transmitted and stored on a Google server in the USA. MUPI emphasizes that Google Analytics has been expanded on the website and MUPI platforms to include the code "gat._anonymizeIp();" to ensure anonymous recording of IP addresses (so-called IP masking). Due to IP anonymization on this site, the USER's IP address is abbreviated by Google within the European Union territory and the European Economic Area Agreement. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and then abbreviated there.
      2. Google uses this information on behalf of MUPI to analyze the usage of its website and/or platforms, in order to compile reports on website activities and provide additional services related to its use and internet usage to the website operator. The IP address transmitted to Google Analytics by the USER's browser is not consolidated with other data from Google. The USER can prevent the storage of Cookies through the appropriate setting of the browsing software. Additionally, the USER can prevent Google from recording and processing data generated by Cookies and related to website usage (including IP address), by downloading and installing the plug-in available at the link and additional information on terms of use and data protection at https://www.google.com/analytics/terms/br.html ou https://www.google.com.br/intl/pt-BR/policies/privacy/.
    2. Google Adwords:
      1. A Google Analytics and conversion tracking service, which is part of Google AdWords. It works as follows: when the USER clicks on an ad displayed by Google, Google AdWords stores a conversion tracking Cookie (a "conversion Cookie") on the USER's computer's hard drive. These cookies expire after 30 days and do not allow the USER to be personally identified. By visiting certain pages on the MUPI site and platforms, MUPI and Google can recognize that the USER clicked on the ad and was redirected to that page.
      2. The information obtained through conversion cookies aims to create statistics for AdWords customers using conversion tracking. Through these statistics, it is possible to discover the number of USERS who clicked on the ad displayed by Google and accessed the page marked by the conversion tracking tag.
      3. Google Analytics is also used to analyze AdWords data and "DoubleClick" Cookies for statistical purposes. If the USER does not wish this to be done, they can disable it through the Ad Preferences Manager.
      4. With Google's Remarketing feature, MUPI can reach USERS who have already visited the website and MUPI platforms. For example, MUPI may deliver advertising to target groups that have shown interest in our products or services. Additionally, based on usage patterns on Google's advertising network sites ("Display Network") in the last 30 days and with the help of contextual search engines, AdWords determines the interests and characteristics shared by our site users. Using this information, AdWords identifies potential new customers for marketing purposes, whose interests and characteristics are similar to those of our site's USERS. Remarketing to the specific target group is then carried out through the combined use of Cookies, such as Google Analytics cookies and DoubleClick cookies. For more information on Google AdWords terms and conditions of use and data privacy, visit: http://www.google.com.br/policies/technologies/ads/.
    3. Google DoubleClick:
      1. We use the Google DoubleClick function on the website and MUPI platforms to evaluate site usage, as well as to allow MUPI, Google, and other advertisers collaborating with DoubleClick to display relevant ads to the USER. For this purpose, a Cookie is installed on the USER's computer hard drive. With the help of Cookies like this, an anonymous identification number is assigned to the browser, and information about the ad displayed on your browser and whether the ad page was accessed is collected. The information generated by the Cookie regarding your use of websites is typically transferred to a Google server in the US and then stored. Based on the collected information, interest categories are assigned to the browser. These categories are used to display ads of interest to the USER.
      2. In addition to changing the USER'S browser settings, you can also permanently disable the DoubleClick Cookie with the help of a browser plug-in. With the plug-in, the deactivation settings for this browser are retained even if the USER deletes all Cookies.
      3. By using the MUPI website and platforms, the USER allows the introduction of the DoubleClick Cookie and, consequently, the collection, storage, and use of their usage data as described above and for the specified purposes. Additionally, they agree that their data may be stored in Cookies even after closing the browser session and that it may be possible, for example, to access them again on their next visit to the site. The USER may revoke this consent at any time, with effect for the future, by deleting the DoubleClick Cookie and permanently deactivating it.

GENERAL PROVISIONS

  • We do not use any type of automated decision-making that affects the USER.
  • We have the right to change the content of this Privacy Policy at any time, according to the purpose or need, as well as for the adequacy and legal compliance of a law provision or rule that has equivalent legal force, the USER being responsible for checking it whenever accessing the MUPI website and platforms.
  • If updates to this document require new consent, you will be notified through the contact information provided in your registration.
  • If you have any questions regarding the provisions of this Privacy Policy, the USER can contact us through the customer service channels listed below.:
    1. CONTACT: accessible through this site;
    2. SAC: by email contato@mupisystems.com.br.
  • If third-party companies perform the processing of any data we collect, they must comply with the conditions stipulated here and our Information Security policies, mandatory
  • If any provision of this Privacy Policy is deemed unlawful or illegitimate by the authority of the locality in which you reside or by your Internet connection, the other conditions will remain in full force and effect.
  • THE USER acknowledges that all communication carried out by e-mail (to the addresses provided in their registration), SMS, instant messaging applications, or any other digital, virtual, and digital form are also valid, effective, and sufficient for the disclosure of any subject related to the services we provide, as well as the conditions of their provision or any other subject addressed therein, except for the expressly different provisions provided in this Privacy Policy.

APPLICABLE LAW AND JURISDICTION

  • The present Privacy Policy will be governed and interpreted according to Brazilian law, in the Portuguese language, with the Forum of the District of the headquarters of Mupi Systems elected to settle any dispute or controversy involving this document, except for specific reservation of personal, territorial, or functional competence by the applicable law.
5

ANDROID MOBILE APP – eAgenda

This item applies specifically to the mobile app "eAgenda" available for Android devices, developed and maintained by MUPI SYSTEMS LTDA.

eAgenda is an appointment and calendar management application aimed at professionals and companies that provide services by appointment (medical consultations, counseling, general services), allowing full management of appointments, participants, and notifications.

The app allows user registration linked to organizations, creation and management of calendars, scheduling appointments, registering participants, and sending reminder notifications.

5.1 DATA COLLECTED ON THE MOBILE APPLICATION

The eAgenda app collects personal data from USERS and APPOINTMENT PARTICIPANTS:

a) REGISTRATION PERSONAL DATA

Full name, email address, password (stored encrypted), used for authentication, identification, data synchronization, and legal compliance.

b) ORGANIZATION DATA

Trade name, unique identifier (slug), phone number, used for linking the user and personalizing the experience.

c) PARTICIPANT DATA

Full name (required), email (optional), phone (optional), CPF (optional), for identification, contact, notifications, and historical record.

d) APPOINTMENT DATA

Date, time, calendar, services, status, description, location, search code, for appointment management and reports.

e) SOCIAL AUTHENTICATION

Access token, profile name and email from Google/Facebook, exclusively for simplified authentication.

f) FCM TOKENS

Device identifier for push notifications, notification preferences.

g) TECHNICAL DEVICE DATA

Model, OS version, installation ID, backend URL, for technical support and aggregated statistics.

h) TECHNICAL LOGS

Error logs, technical events, connectivity, for diagnosis and app improvement.

Important: Collection of participant data (email, phone, CPF) is OPTIONAL, with only the name being mandatory.

5.2 PURPOSE OF THE PROCESSING

✓ Used for:

  • Authentication and access control
  • Schedule management
  • Notifications and reminders
  • Data synchronization
  • Technical support and improvements
  • Legal obligation compliance

✗ NOT used for:

  • Data selling or leasing
  • Behavioral profiles for advertising
  • Real-time location tracking
  • Advertising unrelated to the service
  • Marketing without consent
  • Sharing with social networks

5.3 LEGAL BASIS (LGPD)

Consent (art. 7, I): By creating an account, the user gives free and informed consent.

Contract execution (art. 7, V): Processing necessary for the operation of the contracted service.

Legitimate Interest (art. 7, IX): Security, fraud prevention, technical support, and improvements.

Legal obligation (art. 7, II): When the organization is legally required to keep records.

5.4 STORAGE AND PROCESSING

LOCAL STORAGE (Device)

  • Authentication tokens: Encrypted via Flutter Secure Storage (Keychain/KeyStore)
  • User data: Name, email, organization stored in SharedPreferences for offline operation
  • Notifications: History kept for 30 days, automatically deleted
  • Settings: Backend URL stored locally

REMOTE STORAGE (Servers)

  • Data transmitted via HTTPS/TLS 1.2+ to backend servers
  • Location set by the organization (national or international)
  • MUPI SYSTEMS acts as DATA OPERATOR
  • Periodic automatic backups

FIREBASE SERVICES (Google)

  • FCM tokens stored on Firebase servers
  • Servers in multiple regions (USA, EU)
  • Processing for push notifications

5.5 DATA SHARING

With the User's Organization (CONTROLLER)

Full access to scheduling data, calendars, and participants. Responsible for the purpose and manner of processing.

With MUPI SYSTEMS (OPERATOR)

Processes and stores data on behalf of the data controller organization, according to contractual instructions and LGPD.

With Google LLC / Facebook Inc.

Only tokens and basic data for Firebase (notifications) and social authentication. We do not share scheduling data.

DO NOT share with:

Other organizations, advertising companies, data brokers, third parties for commercial purposes, or other unrelated users.

5.6 DATA SECURITY

  • TLS 1.2+ encryption (HTTPS)
  • Encrypted Flutter Secure Storage
  • JWT tokens with automatic renewal
  • Validation against code injection
  • 30s timeout to prevent DoS
  • Passwords with secure hash (bcrypt/Argon2)
  • Organization access control
  • Audit logs
  • Automatic cleanup of temporary data
  • Periodic security updates
  • Incident response protocols
  • Notification to the ANPD in case of a breach

5.7 DATA SUBJECT RIGHTS (Art. 18 LGPD)

Confirmation and Access

Confirm processing and access your data

Correction

Correct incomplete or inaccurate data

Anonymization/Elimination

Request removal of unnecessary data

Portability

Transfer data to another provider

Deletion

Delete data processed with consent

Sharing Information

Know who we share with

Revocation of Consent

Revoke consent at any time

Response time: 15 business days (Art. 18, §4 LGPD), extendable by an equal period.

5.8 RETENTION AND DELETION

User registration data: 5 years after account closure (CDC arts. 12 and 34)

Participant data: Period defined by the organization, minimum 5 years

Authentication tokens: Until logout or expiration (24h access, 30 days refresh)

Local notifications: 30 days, automatically deleted

Technical logs: 90 days, then anonymized or deleted

5.9 INTERNATIONAL TRANSFER

Data may be transferred to servers outside Brazil:

  • Firebase (Google): USA and EU, according to Google Cloud infrastructure
  • Organization backend: According to the controlling organization's choice
  • Guarantees: Google certified GDPR, EU Standard Contractual Clauses

5.10 APP PERMISSIONS

✓ Camera

Only for scanning configuration QR Code. Does not capture photos/videos.

✓ Internet

HTTPS communication with backend and Firebase for app operation.

✓ Notifications

Push notifications via FCM. Can be disabled without harm.

✗ WE do not request:

Location, Contacts, System Calendar, External storage, Microphone, Phone, SMS

5.11 THIRD-PARTY SERVICES

✓ We use:

  • Firebase Core (Google)
  • Firebase Cloud Messaging (notifications)
  • Google Sign-In (authentication)
  • Facebook Login (authentication)
  • Open-source Flutter/Dart libraries

✗ WE do not use:

  • Analytics (Firebase/Google/Mixpanel)
  • Advertising (AdMob, etc.)
  • Automatic crash reporting
  • Cookies/tracking pixels
  • Marketing/remarketing
  • Maps/geolocation

5.12 RESPONSIBILITIES

ORGANIZATION (Controller)

  • Defines processing purposes
  • Guides users on responsible data collection
  • Responds to data subjects' requests
  • Notify ANPD in incidents
  • Complies with LGPD as a controller

MUPI SYSTEMS (Operator )

  • Processes data according to instructions
  • Implements security measures
  • Maintains confidentiality
  • Assists with request handling
  • Notifies the controller about incidents

5.13 SPECIFIC APP CONTACT

App users:

Contact MUPI SYSTEMS via: contato@mupisystems.com.br
Subject: "eAgenda Mobile – Proteção de Dados LGPD"

Scheduling participants:

Contact the organization where you made the appointment directly (they are the data controller).

Response time: 15 business days (Art. 18, §4 LGPD), extendable by an equal period.

GLOSSARY OF TECHNICAL TERMS

Access Token: short-term credential for access to protected resources.

API: Application programming interface for app-server communication.

Backend: Servers that process and store data.

Cache: Temporary storage for quick access.

Encryption: Encoding of information for security.

FCM: Firebase Cloud Messaging for push notifications.

HTTPS/TLS: Secure encrypted communication protocol.

JWT: JSON Web Token for authentication.

OAuth: Standard authorization protocol.

Push Notification: Message from the server displayed on the device.

QR Code: 2D barcode scannable by the camera.

Refresh Token: Long-term credential to renew access tokens.

SharedPreferences: Local storage of settings.

Flutter Secure Storage: Secure encrypted storage.

Synchronization: Data synchronization between device and server.

Token: Unique code for authentication and authorization.

Last update of this section: January 2026
Version: 1.0

Contact Us

In case of any questions regarding the provisions of this Privacy Policy, please contact us through the following channels:

Formulário

Contact page

Do you have questions about our privacy policy?

Our team is ready to clarify any questions about how we handle your data.

Speak with our team