Privacy Policy

1. Who is responsible

The Study Hub, Hub Premium and the Central do Virtólogo are run by Isabella Becker, a private individual, under the brand Alquimia das Virtudes, with the address Stepbergweg 3, 82491 Grainau, Bavaria, Germany. Contact for any privacy matter: contato@alquimiadasvirtudes.com.

The Study Hub was donated to Instituto Virtudes as a gift to its students. Even so, Isabella Becker remains responsible for processing the data and for the Hub's content.

2. Two different roles

This policy covers two kinds of data, and the role of Alquimia das Virtudes changes with the kind. It also applies to the free Study Hub account (Hub de Estudos).

• Therapist data (the person who subscribes and uses the tools). Here Alquimia das Virtudes is the controller: it decides what is stored and why.
• Data of those who study on the Study Hub (free account). Here Alquimia das Virtudes is also the controller.
• Patient data (what the therapist records about the people they see). Here the therapist is the controller. They decide what to record and answer to the patient. Alquimia das Virtudes is the processor: it stores and processes this data only to provide the service to the therapist, following the therapist's instructions, and never uses it for any other purpose.

If you are a patient and want to see, correct or delete your data, speak to your therapist first. If you write to us, we will forward the request to them and help them respond.

3. What data is stored

Payment data (card, bank slip, Pix) is handled by Hotmart. Alquimia das Virtudes does not receive card numbers.

4. Legal basis

• Therapist account, subscription and credits: performance of a contract (LGPD, art. 7, V; GDPR, art. 6(1)(b)).
• Free Study Hub account and the study stored in it: performance of the contract accepted at sign-up (LGPD, art. 7, V; GDPR, art. 6(1)(b)). E-mail confirmation and the approval of each request protect the collection from misuse: legitimate interest (LGPD, art. 7, IX; GDPR, art. 6(1)(f)).
• Calendar, agreements, service orders, receipts and reminders: performance of the contract between therapist and patient, for which the therapist is the controller (LGPD, art. 7, V; GDPR, art. 6(1)(b)). Keeping tax documents follows the legal obligation of the therapist's country (LGPD, art. 7, II; GDPR, art. 6(1)(c)).
• Security and fraud prevention: legitimate interest (LGPD, art. 7, IX; GDPR, art. 6(1)(f)).
• Patient health data: the patient's specific and prominent consent, collected by the therapist (LGPD, art. 11, I; GDPR, art. 9(2)(a)). Hub Premium and the Central record this consent with its date and version.
• News e-mails: consent, which can be withdrawn at any time through the link in the e-mail itself.

5. Artificial intelligence

Some tools use artificial intelligence: the Agente das Virtudes, Analisar uma fala, the Mega Análise, the Plano com IA, the psyche thesis, the AI comment and the carousel generator. When the therapist uses one of them, the text they wrote or the case material is sent to Anthropic, in the United States, which returns the answer. Under Anthropic's commercial terms, content sent through the API is not used to train its models.

The AI makes no decision about the patient. Maps and analyses are support material for the conversation in session. The therapist is always the one who concludes and decides.

The therapist chooses whether to use these tools. We recommend not writing the patient's full name in text sent to the AI.

Session recording and transcription. When the patient authorizes it and the therapist records the session, the audio is sent to Groq, in the United States, which returns the text. The audio is not stored: only the text stays in the therapist's account.

Reels and Stories. The video is put together on the therapist's device and is not sent anywhere. When the therapist asks for automatic captions, only the sound of the speech goes to Google (Gemini) and Groq, in the United States, which return the text and the timing of each word. When the therapist asks to publish on Instagram, the video and the caption go to Upload-Post, which publishes on the account the therapist connected.

6. Who the data is shared with

No data is sold or passed on for advertising. The providers below process data only so that the service can work:

Data may also be handed to an authority when the law or a court order requires it.

7. Countries and laws that apply

The data passes through seven countries. This policy was written to comply with the law of each of them at the same time.

Transfers outside Brazil and Europe. When data goes to another country, the transfer is based on each provider's data protection agreement, with standard contractual clauses: those of the ANPD under the LGPD (art. 33 and ANPD Resolution CD/ANPD No. 19/2024) and those of the European Commission under the GDPR (art. 46). For United States providers certified under the EU-U.S. Data Privacy Framework, that certification also applies (GDPR, art. 45).

Users in other countries have the same rights described in this policy. When two laws treat the same point differently, the rule that gives the data subject more protection applies.

Therapists in the United States. Hub Premium and the Central are not a HIPAA-compliant service (HIPAA is the U.S. law on the privacy of health data), and they do not sign the Business Associate Agreement it requires. A therapist subject to HIPAA must assess whether they may record patient data here.

8. How long data is kept

• While the subscription is active, the data is kept.
• When the subscription is cancelled, access closes at once. The data is kept for another 30 days. During that time the therapist receives an e-mail with the date on which everything will be deleted and the option to download the data. On day 30, everything is deleted.
• Those who only had the free trial and did not subscribe: the data is kept for 90 days after the trial ends. With 7 days to go, the person receives an e-mail with the deletion date and the option to download the data. On day 90, everything is deleted.
• If the therapist asks for the account to be deleted, the data is deleted at once, without waiting 30 days.
• The therapist can delete a patient at any time with the "Delete" button. This deletes that patient's Session Record, maps and cases. The virtue folders leave the therapist's follow-up, and the patient keeps using theirs. When the patient asks for their data to be deleted, the therapist also ticks "delete what the patient wrote in the virtue folders", and everything is deleted for good.
• Free Study Hub account: the data is kept while the account exists. The person can ask for deletion at any time at contato@alquimiadasvirtudes.com, and everything is deleted: registration, notebook, progress and exercise answers.

• The record of consents (only date, time and version, with no health data) is kept for up to 5 years, to prove consent if needed.

• Receipts, service orders and signed agreements cannot be edited or deleted one by one. A wrong receipt is cancelled and stays stored, marked; a signed agreement is ended, not deleted. They are deleted with the account.

• Receipts, service orders and agreements open through a link, without sign-in. The link is long and random: whoever has it sees the document, as with an e-mail with the PDF attached.

If the therapist is professionally required to keep clinical records or tax documents for longer, they must download the data before it is deleted.

9. Your rights

Anyone whose data is stored here may ask for:

• confirmation that data about them exists, and a copy of it;
• correction of wrong or outdated data;
• deletion, blocking or anonymisation;
• portability, that is, the data in a format that can be taken to another service;
• the list of who the data is shared with;
• withdrawal of consent, at any time;
• review by a person of any result generated automatically.

Therapists and those with a free Study Hub account send these requests to contato@alquimiadasvirtudes.com. Patients send them to their therapist. The answer comes within 15 days.

10. Children and adolescents

When the patient is under 18, consent must be given by the father, the mother or the legal guardian. Collecting this consent is the therapist's obligation. In the United States, a child under 13 does not answer the maps alone: the guardian answers, or is present (COPPA).

11. Security

• All traffic uses an encrypted connection (HTTPS).
• Each therapist can access only the data in their own account. The database rules block access by anyone else.
• Service keys are kept only on the server, never in the browser.
• If an incident may put data subjects at risk, the Brazilian National Data Protection Authority (ANPD), the competent European authority and the people affected are notified within the legal deadlines.

No system is completely failure-proof. The therapist also protects the data: they do not share the password and they sign out on shared computers.

12. Storage in the browser

The site does not use advertising or tracking cookies. It stores in the browser only what it needs to work: the sign-in session, the marker that the account has already been checked, display preferences and a copy of the study progress. Because it stores only what is strictly necessary for the site to work, it does not need a cookie notice (TDDDG, section 25, and GDPR).

13. Changes to this policy

When this policy changes in an important way, the therapist will be notified by e-mail and will have to accept the new version at their next sign-in.

14. Complaints

If you think your data has not been handled properly, write first to contato@alquimiadasvirtudes.com. You can also complain to the ANPD, in Brazil (gov.br/anpd), or to the Bayerisches Landesamt für Datenschutzaufsicht, in Germany. People living in Portugal can complain to the Comissão Nacional de Proteção de Dados (CNPD, cnpd.pt). People living in another European Union country can complain to the data protection authority of their own country. People living in the United States can complain to the Federal Trade Commission (reportfraud.ftc.gov) or to their state attorney general.