Privacy Policy

This Policy explains, in plain language, what personal data we process, why we process it, who we share it with, how we protect it and how you can exercise your rights on Awake Health's Sinais platform.

It applies specifically to Sinais — the environment where we bring together a patient's biomarkers, including data collected from your WHOOP wearable device. Other Awake Health services may have their own privacy notices.

1.Who the controller of your data is

The controller — the party that decides how and why your personal data is processed — is:

Throughout this text, “Awake Health”, “we” or “the Clinic” refer to the controller, and “you” refers to the data subject — the patient.

2.Who this Policy applies to

It applies to you if you are an Awake Health patient and you have:

• connected your wearable device account (currently WHOOP) to the Sinais platform; or
• had health data recorded on Sinais as part of one of our care lines — Longevity or Performance.

If you received a WHOOP device from Awake Health as part of your programme, the device account is yours — personal and non-transferable. Awake Health does not hold your WHOOP account credentials and does not access your account on your behalf.

3.What data we process

3.1 Identification and contact data

• Name, email, phone number, date of birth and other registration details you provide.
• An internal patient identifier assigned by Awake Health.

3.2 Health data from the wearable device

Once you authorise the connection, we periodically receive the following from WHOOP through its official developer API:

We also receive the technical identifiers WHOOP assigns to each record and their creation and update timestamps, which we need to keep our records consistent.

What we do not receive: the WHOOP API does not give us access to continuous heart rate, step count, VO₂ max, your Journal entries, WHOOP Coach, or any document, lab result or medical record you keep inside the WHOOP app. We also never have access to your WHOOP password.

3.3 Other health data you provide

• Intake questionnaires, surveys and health forms completed during your care.
• Laboratory, imaging, genetic or metabolomic results you send us.
• Clinical records produced by the Awake Health team during your care.

3.4 Technical data

• Platform access logs (date, time and identity of whoever accessed), kept for audit purposes.
• IP address and connection data, to the extent necessary for service security.

4.How we obtain WHOOP data

The connection uses OAuth 2.0, an industry-standard protocol. In practice:

1. You click to connect within the Sinais platform.
2. You are taken to WHOOP's own environment, where you log in directly with them.
3. WHOOP shows you exactly which permissions we are requesting, and you decide whether to grant them.
4. If you grant them, WHOOP issues us a revocable authorisation — never your password.

From then on, the platform retrieves your data automatically at regular intervals, with no action required from you. We request only the permissions we actually use, listed in section 3.2.

We also request the technical permission called offline, which lets us renew the authorisation without asking you to log in again every hour. It does not broaden the set of data we can access.

5.What we use your data for

What we do not do

• We never sell, rent, licence or assign your data to third parties — not even with consent, as this is also prohibited by WHOOP's terms.
• We never use your health data for advertising, marketing, audience targeting or promotional offers.
• We never share your data with employers, insurers, health plan operators or financial institutions.
• We never use your data to train third-party artificial intelligence models.
• We do not make automated decisions that produce effects on you (see section 14).

6.Legal bases for processing

All processing requires a legal basis. Ours are:

Withdrawing consent stops the collection of new device data, but does not invalidate processing already carried out, nor override the mandatory minimum retention of clinical documentation explained in section 10.

7.Who we share your data with

7.1 Clinical team

Your data is accessible to the health team involved in your care — physicians, clinical support professionals and anyone performing a care-navigation role in your programme. Access is granted by role, limited to what is necessary, and every access is logged. All of them are bound by professional secrecy and by contractual confidentiality obligations.

7.2 Processors

We engage suppliers that process data on our behalf and under our instructions, contractually bound to security and confidentiality standards and prohibited from using the data for their own purposes:

7.3 Authorities

We may share data where there is a court order, a request from a competent authority or a legal obligation. Wherever legally permitted, we will inform you.

7.4 What we never share

There is no sharing for commercial, advertising or profiling purposes. We do not sell data. We do not provide data to employers, insurers or health plan operators.

8.International data transfers

Part of the processing takes place on servers located outside Brazil, because both WHOOP and Cloudflare operate global infrastructure. This constitutes an international data transfer under article 33 of the LGPD.

We carry out these transfers on the basis of the necessity to perform the contract with you and your specific consent, and we require contractual guarantees from suppliers offering protection equivalent to that provided under Brazilian law.

9.Information security

We apply technical and administrative measures proportionate to the sensitivity of the data:

• Encryption in transit — all communication travels over a secure channel (HTTPS/TLS).
• Encryption at rest — stored data is encrypted.
• Identity-based access control — platform access requires corporate authentication and is granted by role, following the principle of least privilege.
• Audit trail — we record who accessed what, and when.
• Credential segregation — integration keys are held in a dedicated vault, never in source code, and are rotated.
• Periodic review of permissions and granted access.

No system is absolutely impenetrable. We commit to keeping these measures current and to acting transparently if an incident occurs — see section 17.

10.How long we keep your data

Once the period ends, data is irreversibly deleted or anonymised so that it can no longer be associated with you.

11.History and no overwriting

Wearable data changes after it is generated: a night's sleep may be rescored, an activity may be corrected, and a measurement may arrive incomplete and be completed hours later.

For that reason, when a data point is updated we store the new version without deleting the previous one. This exists for a clinical and safety reason: it allows us to state precisely what information was available to your physician on a given date, which is essential to the traceability of any clinical decision.

This history is fully subject to the retention periods in section 10 and to your right to deletion (section 12).

12.Your rights

The LGPD guarantees you the following, at any time and free of charge (art. 18):

To exercise any of these, write to medicina@awakehealth.com.br. We will respond within 15 days. We may ask for additional information to confirm your identity — a safeguard against fraudulent requests made in someone else's name.

You are also entitled to access, within the Sinais platform itself, the data we have collected about you.

13.How to revoke the WHOOP connection

There are three routes, and all of them work:

1. In the Sinais platform — use the disconnect option. Collection stops immediately and the authorisation is revoked with WHOOP.
2. In the WHOOP app — you can remove the Awake Health integration directly in WHOOP's own settings.
3. In writing — email medicina@awakehealth.com.br requesting disconnection.

Revoking the connection stops the collection of new data. If you also want the data already collected to be deleted, please say so explicitly — we will handle the request under section 12, subject to the statutory medical record retention periods described in section 10.

14.Automated decisions and platform content

The Sinais platform presents and compares data: it shows your values, how they evolve and how they deviate from your own historical baseline.

It does not diagnose, prescribe or recommend clinical action, and it does not make automated decisions producing legal effects or significantly affecting your interests. All clinical interpretation is performed by a qualified health professional. The information displayed does not replace medical consultation, diagnosis or treatment.

15.Cookies and similar technologies

We use the bare minimum, and none of them serve advertising:

• Authentication cookie — keeps your session open securely.
• Authorisation state cookie — temporary, valid for minutes, used solely to protect the WHOOP connection process against fraud.

We do not use advertising, cross-site tracking or behavioural profiling cookies.

16.Children and adolescents

The Sinais platform is intended for people aged 18 and over. We do not knowingly collect data from children or adolescents through it. If we identify improper collection, we will delete the data. If you are a legal guardian and believe this has happened, write to medicina@awakehealth.com.br.

17.Security incidents

If a security incident occurs that may create relevant risk or harm to you, we will notify you and the Brazilian National Data Protection Authority (ANPD) within a reasonable period, describing the nature of the data affected, the risks involved and the measures taken. We will also notify WHOOP where the incident involves data originating from the device, as required by its API terms of use.

18.Changes to this Policy

This Policy may be updated. Every version carries a number and effective date at the top. Where a change is material — particularly if it broadens the purposes of use or the list of people who can access your data — we will notify you in advance through your contact channels and, where the legal basis is consent, we will request fresh consent.

19.How to contact us

20.Governing law and jurisdiction

This Policy is governed by Brazilian law, in particular Law 13.709/2018 (LGPD), Law 12.965/2014 (Internet Civil Framework) and, where applicable, the Consumer Protection Code and the rules of the Federal Council of Medicine on medical records and professional secrecy. The courts of the data subject's domicile are elected to settle any disputes arising from it.

This English version is provided for convenience. In the event of any discrepancy, the Portuguese version prevails.