Legal
Data Privacy Policy
Revision 5 — 11 June 2025
1
Purpose
This policy describes how Quoretech collects, uses, shares, stores, and protects personal data processed through its devices, applications, platforms, website, and business relationships, in accordance with the LGPD and other applicable law.
2
Scope
This policy applies to Quoretech and to customers, suppliers, partners, and third parties with which Quoretech maintains commercial, contractual, or partnership relationships.
3
Definitions
- Personal Data: information related to an identified or identifiable person, including name, tax identifier, email, and phone number.
- Sensitive Personal Data: data subject to enhanced legal protection, including health and biometric data and other categories defined by law.
- QuoreOne: the device used to capture ECG data in supported workflows.
- Requestor App: the application used by authorized personnel to set up tests.
- Patient App: the application used for supported data transmission and symptom or activity notes.
- Diagnostic Platform: the environment used by authorized professionals to manage signal review and reporting.
4
Collection and processing
Depending on the service and relationship, Quoretech may process full name, tax identifier, email, biological sex, height, weight, phone number, device and account information, and ECG or other examination data. Data may be collected through devices, applications, platforms, forms, support interactions, and business processes.
5
Purposes
Quoretech processes data to provide and support diagnostic workflows; support authorized clinical analysis and medical decisions; operate accounts, devices, applications, and platforms; meet legal, quality, safety, security, and regulatory obligations; improve products and services; and conduct statistical or scientific work using appropriately anonymized or otherwise lawfully processed information.
6
Automated analysis and clinical support
Quoretech may use automated and algorithmic methods with appropriately governed data to support clinical analysis. These methods do not independently diagnose or prescribe treatment. Outputs require review and confirmation by qualified professionals and must not be the sole basis for a medical decision. Data used to improve or validate models is handled according to applicable law, contractual duties, and internal governance.
8
Security measures
Quoretech maintains technical and administrative safeguards based on its information-security framework, including encryption where appropriate, controlled authentication, access management, incident monitoring, and notification processes. No security measure is absolute, and safeguards are continually reviewed.
9
Storage and retention
Data may be stored on secure infrastructure in Brazil or other countries, subject to applicable transfer safeguards. Retention follows legal, regulatory, contractual, clinical, security, and operational requirements. Where the law permits, data subjects may request access, correction, portability, export, restriction, opposition, consent withdrawal, or deletion.
10
Controllers and processors
The role of Quoretech as controller or processor depends on the context and service. Service providers acting for Quoretech must follow contractual security, confidentiality, and data-protection obligations.
11
Cooperation and confidentiality
Quoretech cooperates with competent authorities, customers, and data subjects to support compliance and transparency. Employees, professionals, suppliers, and other authorized parties must preserve confidentiality and may be subject to administrative, civil, contractual, or criminal consequences for misuse.
12
Data-subject rights
Subject to applicable law, individuals may ask whether Quoretech processes their data; request access, correction, portability, restriction, opposition, or deletion; withdraw consent where processing depends on consent; and seek information about sharing and international transfers. Requests may require identity verification and may be limited by legal or regulatory retention duties.
13
Communications
Marketing recipients may use the unsubscribe link in a message or email opt-out@quore.tech. Service, safety, legal, and transactional communications may still be sent where necessary.
14
Compliance framework
- LGPD, Brazilian Law 13.709/2018.
- ABNT NBR ISO/IEC 27001:2022 as an information-security framework and basis, not a public certification claim.
- ABNT NBR ISO/IEC 27701:2019 as a privacy-information-management reference where applicable.
15
Responsibilities
- Information Security supports compliance, updates policies and procedures, and promotes training and awareness.
- The Data Protection Officer monitors applicable data-protection obligations, acts as liaison with data subjects and competent authorities, and promotes internal awareness.
- Internal and external parties must follow applicable policies and cooperate with data-protection procedures.
16
Contact
For questions, requests, or complaints about personal-data processing, contact the Information Security and DPO team at seg.info@quore.tech. General inquiries may also be sent to contact@quore.tech or made by phone at +55 11 3351-7250.
