Draft for privacy review
Privacy policy.
The public website currently avoids sensitive-data collection. Final LiveAgent and case-processing disclosures require completed data mapping, contracts, and legal review.
Insert verified controller details, address, registration number, representative or DPO contact where applicable, effective date, lawful bases, retention periods, processors, transfer safeguards, and jurisdiction-specific rights.
Who controls personal information
The intended operator is Pharma Via Rx Ltda. The final policy must identify the legal controller or controllers for the public site, individual cases, employer programs, and support services, including any distinct roles of licensed or contracted partners.
Public website
The static public site does not contain a public intake form and should not collect prescriptions, diagnoses, identity documents, payment information, or other sensitive case evidence. Standard server and security logs may be processed by the approved hosting provider and must be documented in the final policy.
General support email and chat
General email and optional chat are limited to non-clinical questions. Users are instructed not to include sensitive information. The LiveAgent widget remains disabled until consent, vendor, data-location, retention, transfer, access, security, DPA, and BAA applicability reviews are complete.
Portal and case records
The planned MVP portal supports credential creation, case-entry tickets, and correspondence. Before activation, the final policy must explain account data, ticket content, authentication, purposes, legal bases, recipients, retention, rights, transfers, safeguards, and whether LiveAgent is permitted to receive any health information.
Purposes and lawful bases
Potential purposes include providing requested services, account and case administration, support, security, fraud prevention, legal and regulatory compliance, quality and complaint handling, and employer-program administration. The approved lawful basis for each purpose and jurisdiction must be documented before collection.
Recipients and international transfers
Potential recipients may include hosting, support, security, licensed supply-chain, fulfillment, courier, payment, professional-adviser, employer-plan, and government recipients as appropriate to an approved case. Each category and transfer mechanism must be verified and disclosed.
Retention and security
Final schedules must distinguish public logs, marketing or cookie preferences, support tickets, case evidence, quality records, complaints, financial records, and regulated records. Controls should include least privilege, strong authentication, encryption where appropriate, logging, review, incident response, and secure disposal.
Rights and choices
The final policy must explain applicable access, correction, deletion, restriction, objection, portability, consent withdrawal, complaint, appeal, and non-discrimination rights, together with identity-verification and response procedures.
Contact
Privacy questions may be sent to support@pharmaviarx.com without including sensitive case information until a dedicated verified privacy channel is published.