privacy policy

last updated: november 8, 2026

who we are

juntos is an Android and iOS app provided by TEAM DEVZ TI LTDA, registered in Brazil under CNPJ no. 47.784.342/0001-03, based in Brasília, DF (“we”, “us”). We are the controller of the personal data used to run the app, under Brazil’s General Data Protection Law (Law no. 13,709/2018, “LGPD”).

Our data protection officer (in Brazil, the “encarregado”) can be reached at contato@juntos-app.org.

This policy explains what data juntos uses, what for, who it is shared with, how long it is kept and how you can exercise your rights. It applies to the app in Portuguese, English and Spanish.

how the app works

Each juntos group is dedicated to the care of one person, whom we call the patient, whether they are in a hospital, a clinic or at home. Group members share a timeline of updates (with text, photos, videos and comments), the caregiver shift schedule and swap requests, visiting hours, where the patient is, medications, allergies and prescription photos, as well as errands and tasks (things a caregiver on shift needs someone else to take care of).

Groups are private: only people who were invited can see their content. The patient can also be a member and can even organize the group.

what data we use

your account

• Your mobile number, used to sign in with a code sent by SMS.
• Your name.

your profile in each group

• Gender (male or female).
• Your relationship to the patient (for example, daughter, brother, friend).
• Your role in the group (organizer, caregiver or patient).
• A profile photo, if you choose to add one.
• Your device’s language and time zone, to show the app in your language and with the right times.

what members post in the group

• Updates, comments, photos and videos.
• The shift schedule, swap requests and shift arrivals.
• Visiting hours and visits.
• Where the patient is: name of the place, room and address.
• Medications, allergies and prescription photos.
• Errands and tasks.

Much of this information is health data, which gets special care (see the next section).

location, contacts and notifications

• Your device’s location, in the situations described under location.
• The name and phone number of one contact from your address book, only when you choose to invite someone “from contacts” (see contacts).
• Your device’s notification identifier (push token), to send alerts to your phone.

technical connection data

As with any internet service, our servers receive technical connection data, such as your IP address, to deliver responses to the app and protect the service against abuse.

what we do not collect

We do not use ads or analytics or tracking tools (SDKs), we do not build behavioral profiles and we do not read your whole address book. Photos and videos are only uploaded when you choose to post them.

health data and information about the patient

Information about health, medications, allergies and prescriptions is sensitive personal data (article 11 of the LGPD) and “special category data” under the European General Data Protection Regulation (GDPR). We use this data based on your consent, given in the app, and only so the group can organize care.

When you enter information about the patient, you confirm that you have their permission or that you are their legal representative (for example, a parent or guardian of a child, a court-appointed guardian or someone holding a power of attorney). If the patient is able to decide, talk to them first. They can also join the group and even organize it.

We never use health data for advertising, for profiling or for any purpose other than running the group.

You can withdraw your consent at any time by deleting information, no longer using the app or deleting your account. Withdrawal does not affect what was done before it. Without this data, however, the app cannot do its job for the group.

what we use data for, and on what legal basis

Creating your account and confirming your number by SMS

Data: mobile number and name. Legal basis: performance of a contract (LGPD art. 7, V).

Showing your profile and the group’s content to members; building the schedule, visits, errands and medication list

Data: profile and group content. Legal basis: performance of a contract; for health data, consent (art. 11, I).

Detecting shift arrival and showing the group who is on the way

Data: location. Legal basis: consent, given through the device permission and your choice in the app.

Sending notifications

Data: push token, language and time zone. Legal basis: performance of a contract. You can turn notifications off in your device settings.

Reading prescriptions with artificial intelligence (optional)

Data: prescription photos. Legal basis: specific consent, requested on a dedicated screen before first use.

Searching for addresses

Data: the address text you type. Legal basis: performance of a contract.

Keeping the service secure and preventing abuse

Data: technical connection data. Legal basis: legitimate interest (art. 7, IX).

Complying with legal obligations and responding to authorities

Data: whatever the law or order requires. Legal basis: compliance with a legal or regulatory obligation (art. 7, II) and the regular exercise of rights (art. 7, VI).

location

juntos uses your device’s location for two things: detecting when a caregiver arrives at the patient’s location for a shift, and letting the group follow someone who is “on the way” until they arrive.

• While the app is open: if you allow location access, the app uses it while it is open.
• In the background: only if you choose “allow all the time” (or “always”). Even then, background use only happens while you are on the way to a shift and to detect your arrival near the patient’s registered location.
• Positions are sent to our server and shown to the group’s members while you are on the way. Once you arrive, your position is no longer shown.
• You can change or revoke the permission at any time in your device settings. Without it, the app still works, but without automatic arrival and without following who is on the way.

contacts

The app only accesses your contacts if you choose to invite someone “from contacts”. In that case, it reads only the contact you pick, to fill in the invitation’s name and phone number. Your contact list is not uploaded to our servers.

reading prescriptions with artificial intelligence

This feature is optional. Before you use it for the first time, the app shows a screen explaining how it works and asks for your consent. If you agree, the prescription photos are sent to Anthropic’s API (the Claude model), which identifies medication names, doses and times.

• You review everything before saving. Nothing is saved without your confirmation.
• According to the provider’s terms, data sent via the API is not used to train models.
• The reading can be wrong. Always check it against the original prescription.
• If you prefer not to use AI, you can enter medications manually.

who we share data with

members of your group

Everything you post in a group, your profile in that group and your position while you are on the way are visible to the group’s members. Photos and videos are downloaded to members’ devices, and they can keep or pass on what they see. So only invite people you trust.

providers that help us run the app

• Google (Firebase Authentication): sending the SMS code and signing in with your mobile number.
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): delivering notifications. The text of each notification passes through these services.
• Cloudflare: runs the app’s API (Cloudflare Workers) and stores photos and videos (Cloudflare R2).
• Hetzner: dedicated server in Finland (European Union) that hosts the database (PostgreSQL).
• Anthropic: reading prescriptions with AI, only if you use the feature and consent.
• OpenStreetMap (Nominatim service): receives the address text you type in the search to find the place.
• Expo (EAS Update): delivers app updates. It does not receive your account data or group content.

These providers use the data only to provide their service to us, under their terms and data protection commitments.

authorities

When required by law or by an order from a competent authority, we may provide data, limited to what is required.

what we never do

We do not sell, rent or share your data for marketing or advertising.

international transfers

Our database is on a dedicated server in Finland, in the European Union. Some providers, such as Google, Apple, Cloudflare, Anthropic and Expo, may process data in other countries, such as the United States. This means your data is transferred outside Brazil.

To protect this data, we use:

• encryption in transit (HTTPS/TLS) between the app, our API and storage;
• access to the server and database restricted to authorized people;
• providers with contractual data protection commitments.

how long we keep data

• Updates, comments, notifications, photos, videos and prescription photos: deleted from our server 7 days after they are posted. After that, they exist only on members’ devices, stored inside the app and excluded from iCloud and Google backups. Photos and videos are downloaded to the device automatically (videos over Wi-Fi or, from the 6th day, over any network). If you sign out or delete your account, what was stored on your device is deleted.
• Account, group, schedule, medications, allergies, visits, errands and tasks: kept until they are deleted or until the account or group is deleted.
• Backups: we back up the database once a day and keep each backup for 14 days. The storage automatically deletes any backup older than 30 days. Deleted data may remain in these backups until they expire. Backups are only used to restore the service after a failure.

We only keep data longer when the law requires it.

how we protect data

• Communication between the app and the server is encrypted.
• A group’s content is only delivered to its members.
• Access to the servers is restricted to authorized people.
• On your device, content is stored inside the app. Protect your phone with a passcode or biometrics.

No system is completely secure. If a security incident occurs that may cause significant risk or harm, we will notify Brazil’s National Data Protection Authority (ANPD) and the people affected, as the law requires.

your rights

Under the LGPD, you can request:

• confirmation that we process your data;
• access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
• portability of your data to another provider;
• deletion of data processed based on your consent;
• information about who we share your data with;
• information about the option not to consent and what happens if you don’t;
• withdrawal of consent.

You can edit your profile and delete your account directly in the app. For other requests, write to contato@juntos-app.org. We may ask you to confirm the request is yours (for example, using the account’s mobile number). We respond within the deadlines set by law.

If someone else posted information about you in a group (for example, if you are the patient), you can ask the group’s organizer to delete it or contact us.

You can also file a complaint with Brazil’s National Data Protection Authority (ANPD).

deleting your account

You can delete your account at any time in the app, from your profile screen or the group screen. When you do:

• we delete your name, phone number, photos, registered devices and your login;
• what you posted in groups stays there, shown as “deleted account”;
• if you were the only organizer of a group, another member takes over;
• a group left with no members is deleted entirely;
• the updates stored on your device are deleted too.

Content already downloaded to other members’ devices stays with them. Deleted data may remain in backups until they expire, as explained above.

if you are in the european union

If you are in the European Economic Area, the GDPR also applies. We are the data controller. Our legal bases are: performance of a contract (art. 6(1)(b)); consent, and explicit consent for health data (arts. 6(1)(a) and 9(2)(a)), also used for location and AI prescription reading; legitimate interests for service security (art. 6(1)(f)); and compliance with a legal obligation (art. 6(1)(c)).

You have the right to access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interests, and to withdraw consent at any time. You can also lodge a complaint with the data protection authority in your country. The database is in Finland; when providers process data outside the European Economic Area, we rely on the safeguards they offer, such as standard contractual clauses, where applicable.

if you are in the united states

We do not sell personal information and do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (CCPA/CPRA) and similar state laws. We do not use sensitive personal information to infer characteristics about you. You can request access to, correction of or deletion of your data at contato@juntos-app.org, and you will not be treated differently for doing so.

children and teenagers

juntos is made for adults who organize someone’s care. People under 18 should only use the app with the supervision of a parent or legal guardian. When the patient is a child or a teenager, their data is entered by their legal guardians, in their best interest.

changes to this policy

We may update this policy when the app or the law changes. The date at the top shows the latest version. If a change is significant, we will let you know in the app before it takes effect and, where the law requires, ask for your consent again.

contact us

Privacy questions, requests or complaints: contato@juntos-app.org (data protection officer).

TEAM DEVZ TI LTDA · CNPJ 47.784.342/0001-03 · Brasília, DF, Brazil