Privacy Policy

1. Who we are

Accrua Tecnologia para Saúde LTDA ("Accrua", "we"), registered under CNPJ No. 66.679.773/0001-54, headquartered at Rua Pais Leme, 215, Conjunto 1713, Pinheiros, São Paulo/SP, ZIP 05424-150, Brazil, is a technology company that develops and operates artificial intelligence solutions for the revenue cycle of hospitals and other healthcare institutions.

This Privacy Policy clearly explains how we process personal data in compliance with Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD") and other applicable rules.

2. Who this policy applies to

This policy applies to anyone who interacts with Accrua through the accrua.com.br website and its communication channels, including:

• website visitors;
• people who fill out contact forms, request a diagnostic or use the impact calculator;
• hospital professionals, clients, partners, suppliers and investors who interact with us;
• job applicants;
• participants in events, webinars and content promoted by Accrua.

Data processing carried out within the Accrua platform on behalf of client hospitals follows its own rules, described in section 5 and in the contracts signed with each institution.

3. What data we collect

Data you provide to us

• identification and contact: name, corporate email, phone, job title and institution;
• information submitted in forms, messages and conversations with our team;
• data voluntarily entered in the impact calculator, such as estimated revenue and denial indicators;
• résumé and professional information, in the case of applicants.

Data collected automatically

• IP address, browser type, operating system and device;
• pages visited, browsing time, traffic source and interactions with the site;
• data from cookies and similar technologies, as described in section 8.

Data received from third parties

• public professional information, such as that available on professional networks, when you interact with our content;
• data shared by partners and organizers of events you attended and where you authorized sharing.

4. How we use your data

We process personal data only for legitimate, specific and disclosed purposes, always based on one of the legal grounds provided for in the LGPD:

5. Health data processed in hospital operations

When providing services to client hospitals, Accrua has access to revenue cycle information that may include sensitive personal data of patients, such as care, procedure and billing data.

In these situations, the hospital is the data controller and Accrua acts as the processor, handling the information exclusively according to the hospital's instructions, for the purposes set out in the contract and in the cases authorized by article 11 of the LGPD, such as health protection and compliance with legal and regulatory obligations.

• each hospital's data is kept in segregated logical environments and accessed only by authorized people;
• we do not sell or trade patient data;
• we do not share one hospital's data with another hospital or with payers without a legal basis and the controller's instruction;
• when used to improve our artificial intelligence models, data is aggregated and anonymized, so that it is not possible to identify patients, professionals or institutions.

Patients who wish to exercise their rights over this data should contact the hospital responsible for their care directly, which is the controller. Accrua will support the hospital in handling these requests.

6. Who we share data with

We may share personal data, to the extent necessary, with:

• technology suppliers, such as cloud, hosting, email, CRM and analytics providers, engaged under confidentiality and data protection clauses;
• legal, accounting and audit advisors;
• financial partners involved in structuring working capital, such as fund administrators and managers, when necessary to perform the contract;
• public authorities, when there is a legal obligation, court order or request from a competent authority;
• in corporate transactions, such as mergers, acquisitions or consolidations, with a guarantee that data protection will continue.

Accrua does not sell personal data.

7. International transfer

Some of our suppliers, such as cloud providers, may store or process data outside Brazil. In these cases, we adopt the safeguards provided for in the LGPD, such as specific contractual clauses, and require security levels compatible with those applied by Accrua.

8. Cookies

We use cookies and similar technologies to make the site work, remember your preferences and understand how it is used. They fall into the following categories:

• Essential: required for the site to work and stay secure. They cannot be disabled.
• Performance and analytics: help measure audience and improve content.
• Marketing: allow us to present more relevant content and communications.

On your first visit, you can accept, reject or choose non-essential cookies by category through the notice shown on the site, and change your choice at any time in the Cookie Policy. The full list of cookies, purposes and retention periods is in our Cookie Policy.

9. How long we keep data

We keep personal data only for as long as necessary to fulfill the disclosed purposes, respecting legal, regulatory and contractual deadlines. After that period, data is deleted or anonymized, except where retention is permitted by the LGPD, such as to comply with a legal obligation or exercise rights.

10. How we protect your data

We adopt technical and administrative measures to protect data against unauthorized access, loss, alteration or improper disclosure, including:

• encryption of data in transit and at rest;
• role-based access control, with authentication and activity logging;
• segregation of environments and data by client;
• continuous monitoring and vulnerability management;
• team training and confidentiality commitments.

No system is completely immune to risk. In the event of a security incident that may cause relevant risk or harm, we will notify affected data subjects and Brazil's National Data Protection Authority (ANPD), as required by law.

Learn more in our Trust Center.

11. Your rights

As a data subject, the LGPD guarantees you the right to:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• request the anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• request data portability to another provider;
• request the deletion of data processed based on your consent;
• know who we share your data with;
• be informed about the possibility of not giving consent and its consequences;
• withdraw consent at any time;
• object to processing carried out in breach of the law;
• request review of decisions made solely on the basis of automated processing.

You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

12. How to exercise your rights and contact the DPO

To exercise your rights or ask questions about this policy, contact our Data Protection Officer (DPO):

For your security, we may request information confirming your identity before handling your request. We will respond within the time limits set by law.

13. Children and adolescents

Accrua's website and services are intended for healthcare professionals and institutions. We do not knowingly collect data from children and adolescents through the website.

14. Changes to this policy

This policy may be updated to reflect changes in our practices, services or legislation. The current version will always be available on this page, with the date of the last update. Relevant changes will be communicated through our channels.

15. Governing law and jurisdiction

This policy is governed by Brazilian law. The courts of São Paulo/SP are elected to settle any disputes, without prejudice to the data subject's rights provided by law.