Privacy policy — OcularFlow

1 · Who handles your data

• Controller: [TO BE COMPLETED BY THE LAWYER: company name]
• Tax identification: [TO BE COMPLETED BY THE LAWYER: tax identification]
• Registered address: Cra. 7 #156-80, Torre 3, Oficina 1805, Bogotá, Colombia
• Country: Brazil
• Email for privacy matters: [email protected]
• Data protection officer: [TO BE COMPLETED BY THE LAWYER: delegado proteccion datos]

Applicable law: Law 13,709/2018 (LGPD).

2 · First things first, because it changes everything else

There are two groups of data and they are not handled the same way.

1. Health data. What you answer in the safety filter, in the profile, and what you measure in the tracking. These are a special category: they are collected only with your explicit consent, used only for what section 3 says, and stored separately precisely so that they can be handled separately.
2. Everything else. Your email address, your license, the emails we send you, what you practiced and the technical logs.

And two things worth knowing before you read on:

• You answer before you give us your email address. The safety filter and the profile questions are answered in the browser, before any account exists. Until you request the sign-in code and go in, those answers live only in your browser's memory and have not reached our servers. If you close the tab at that point, nothing of yours stays with us.
• There are no passwords. Not yours and not ours. You sign in by asking for a one-time code by email. That means we store no password of yours, and also that anyone with your email can get into your account.

3 · Health data (special category)

3.1 · The safety filter (three questions)

What is stored. When you sign in and your answer is recorded, one row is stored with: your email address, the version of the questionnaire, the exact text of the questions and options you were shown, your answers exactly as you marked them, the verdict (allowed / with warnings / blocked), the reason and the date.

Why the exact text is stored. If we reword a question tomorrow, your row still has to be interpretable. Storing only "chose option 2" turns the record into something that means nothing six months later.

What for. To decide whether access can be sold to you, and to be able to show that the decision was taken before you were charged.

This table is append-only. There is not a single instruction anywhere in the program that changes or deletes a filter row. If you answer again, a new row is added and the latest one prevails; the previous one stays there. The periodic purge does not touch it either.

3.2 · The profile

What is stored: age band, screen hours per day, whether the environment is dry, whether you wear correction, the symptoms you tick from a closed list, your goal, the tolerance you declare, how many minutes per session and how many sessions per week. Plus the version of the questionnaire.

What for. To work out your routine using fixed rules.

Unlike the filter, the profile is overwritten: there is one row per person, and saving again replaces the previous one.

The profile answers do not appear in the audit log or in the server logs. All that is noted about that write is that it happened and with which version of the questionnaire.

3.3 · The tracking (calibration and acuity)

If you use the tracking, the following is stored:

• Calibrations, one per screen: pixels per millimeter, distance in centimeters, the method used (card the size of an ID card, camera or arm) and a device fingerprint. They are per screen because mixing the laptop and the phone would make two measurements incomparable.
• Acuity measurements: eye, logMAR value, letters read correctly out of those shown, distance, method, protocol, level, and the letters that were shown along with what you answered.

This is indicative and it is neither a clinical test nor a diagnosis. The screen itself says so.

3.4 · The professional context

A label from a closed list (programmer, video editor, designer, trader, radiologist, video calls, mixed). It is not your company's name and it is not free text: all it changes is the balance of a routine.

3.5 · The report for your professional

The one-page report you can download is generated in memory and downloaded directly. No copy is left in external storage or on the server's disk.

3.6 · Legal basis for health data

Your explicit consent, given when you answer the questionnaire. You can withdraw it by writing to [email protected]. Withdrawing it does not affect what was done before, and bear in mind what section 3.1 says about the filter.

Without the filter answers you cannot buy: not because we want the data, but because we do not sell access without having asked.

4 · Data that is not health data

4.1 · Your account

Email address (required), name (if you give one), language, time zone, sign-up date and last sign-in date.

The time zone is genuinely needed: without it there is no way to know which day is "today" for you, and a streak would break at seven in the evening just because you live in another time zone.

*Legal basis: performance of the contract.*

4.2 · Signing in, without passwords

• For the one-time code, the code itself is never stored. What is stored is a cryptographic hash that includes your email address, along with the date, the expiry, whether it was used, how many attempts there were and the IP address it was requested from.
• For your session, only a cryptographic hash of the token is stored, never the token. Anyone walking off with a copy of the database would not be walking off with the sessions. Alongside it: the scope (app or panel), the dates, and the IP address and the browser you signed in from.

*Legal basis: performance of the contract, and legitimate interest in account security.*

4.3 · Your practice

Exercise sessions (when they started, when they ended, whether they were abandoned, the local day, average frames per second and dropped frames), which movements you did and in what order, and your streak of consecutive days.

We also store the "device" field, which is the identification string your browser sends (the *user agent*). It is used to understand a performance problem on a particular device.

*Legal basis: performance of the contract.*

4.4 · License and payment

The license periods (origin, from when, until when, whether it renews by itself, whether it has been canceled) and, once there is a payment gateway, the events it sends us.

We never see or store your card. That is handled by the payment gateway.

*Legal basis: performance of the contract, and legal obligations relating to invoicing.*

4.5 · Email

For every email we send you we store: destination, template, language, subject, status (queued, sent, failed, suppressed), attempts and the mail server's verbatim response. That verbatim response is what gets shown to the provider the day someone says "nothing ever arrived".

There is also a suppression list: if your address bounces permanently or marks our mail as unwanted, it stops receiving. Carrying on writing to an inbox that bounces burns the domain's reputation, and with it the email that carries everyone else's sign-in code.

The four emails that exist are transactional — the sign-in code, the welcome, the renewal notice and the expired license notice — which is why none of them carries an unsubscribe link: unsubscribing from the email that brings your key means switching off your own account. There is no marketing email.

*Legal basis: performance of the contract.*

4.6 · Micro-break notifications (optional)

Only if you turn them on. What is stored: the delivery address your browser gives you, the keys needed to encrypt the message, how often you want the reminder, how long it lasts, between which hours, which days, your time zone and your language.

The reminder does not carry your profile, your symptoms, your email address or a link. The notification *is* the break. Your browser's notification service only sees a small encrypted packet and the moment it is sent.

You can turn them off from within the app.

*Legal basis: your consent.*

4.7 · The sales page funnel

We note that a visitor reached a step in the journey (started onboarding, completed it, saw the sign-up, signed up, saw the plan summary, started payment).

• The visitor is identified with a first-party cookie holding a random value. Only a cryptographic hash of that value goes into the database, never the value itself and never your IP address.
• It is append-only, and each step is noted once.
• The cookie lasts one year.

*Legal basis: our legitimate interest in knowing at which step sign-up is abandoned (article 7, IX of the LGPD). We do not store your email or anything that identifies you: only the step where an anonymous visit stopped — it has to be decided whether this measurement rests on legitimate interest or requires prior consent in Brazil.*

4.8 · Audit log

For relevant actions, what remains is: who did it (identifier and the email address in plain text, so that the record still says who it was even if the account is deleted), what action, on what, whether it succeeded or was denied, the reason, a minimum of data, and the IP address.

Every action in the panel that touches a person requires a written reason of at least twenty characters, and it is logged even when it is denied.

*Legal basis: legitimate interest in security and traceability; legal obligation where applicable.*

4.9 · Request limits

Counters per email address and per IP block, so that nobody can hammer the code sending. They live in the database and not in memory, because restarting the server cannot be a way of getting around a limit.

*Legal basis: legitimate interest in security.*

5 · What your browser stores

The app stores no session token in browser storage, and it does not store your profile or your filter there: they are retrieved from your account.

There is no analytics, no pixels and no third-party scripts. The sales page loads a single external resource: the Google Fonts typefaces. The app talks only to its own origin; there is no configurable API address anywhere in the project, and that absence is part of the defense.

6 · How long things are kept

There is a task that runs every six hours and deletes the following. These periods are in the code today:

And this is not deleted automatically, on purpose:

6.1 · What happens when you close your account

Your account is marked as closed, all your sessions are ended, and automatic renewal of your licenses is canceled.

Retention periods still to be set: while the account is active. 30 days after the account is closed, the health questionnaire, the professional context and whatever the person told about their health in the chat are deleted; the clean-up runs every six hours, while the account is active; the practice history is not deleted for being old, because it is what makes the routine progress, while the account is active, and up to 30 days after it is closed. These are the measurements the person takes with the tumbling E and the ones that appear in the report for their ophthalmologist, [TO BE COMPLETED BY THE LAWYER: retencion auditoria] and [TO BE COMPLETED BY THE LAWYER: retencion facturacion].

7 · Who your data is shared with

We do not sell your data to anyone. We do not pass it on for advertising. There is no advertising.

Today there is nothing else. Specifically, as at the date of this review:

• No artificial intelligence provider processes your data. The project has the connection prepared, but there is not one line of the program that calls it.
• Nothing is uploaded to external storage. The upload feature is not switched off: it does not exist. There is not a single line of upload code on the server.
• There is no analytics tool.

If any of those three things changes, this document has to change first.

Transfers outside Brazil: yes, and the first one matters most. The whole platform is hosted in the United States, on Microsoft Azure and Amazon Web Services, so your data —your account, your profile, your answers to the safety questionnaire, your measurements and your history— is stored there and not in Brazil. There are also two transfers to third parties: email goes out through SMTP2GO, which processes your address and the subject line in order to deliver it —without that there is no way to sign in, because access is only by a code sent to your email—; and the chat, if you write in it, sends your question to Microsoft's Azure OpenAI. The rest of the platform does not call the model, and without the chat everything else works the same..

8 · Who inside the company can see your data

There is a superadmin panel. It is worth saying precisely what someone who signs into it can and cannot do, because the code draws the line:

They can see:

• Your account, your licenses, your exercise sessions and the status of the emails we sent you.
• Your complete safety filter answers, with the questions exactly as they were shown to you. It is the only way to make sense of a row from six months ago.

They cannot, and there is no route to do it:

• See or resend your sign-in code. Never, not even to help someone who calls on the phone. If the panel could show someone else's code, technical support would be the easiest way into any account.
• See the body of the emails we send you.
• See the delivery address for your notifications.
• Give themselves, or anyone else, administrator permissions.

They can do, and always with a written reason that is logged: end all your sessions, put your address on the email suppression list, and close your account (which also requires typing your exact email address, and does not allow deleting oneself).

9 · Your rights

You can ask us for:

• Access to the data we hold about you.
• Rectification of anything that is wrong.
• Erasure, subject to what sections 3.1 and 6 say.
• Restriction of processing.
• Portability: taking your data away in a readable format.
• Objection to processing based on legitimate interest.
• Withdrawal of consent for health data and for notifications, at any time.

How: by writing to [email protected] from your account's address. We answer within a maximum of fifteen days from when we receive your request, which is the period set by article 19 of the LGPD.

If you think we have got it wrong, you can complain to the Brazilian National Data Protection Authority (ANPD), at anpd.gov.br. You can also turn to the bodies of the National Consumer Defense System (PROCON) and to the consumidor.gov.br platform.

10 · How we protect this

What the code does today, without embellishment:

• No sign-in code is stored in the clear. What lives in the database is a cryptographic hash that includes your email address, so that a precomputed table of codes is of no use.
• No session token is stored in the clear. Only its hash.
• The response when you request a code is always the same, whether or not the account exists. And there is a single error message for a code that is expired, used, wrong or not allowed: telling them apart would turn the screen into a checker for registered email addresses.
• The code comparison runs through the whole list, without exiting early, so that timing does not give away which one was right.
• HttpOnly, SameSite=Lax cookies, with Secure and the __Host- prefix in production, and no domain set, so that a compromised subdomain cannot plant or overwrite your session.
• Security headers on every response, including error responses, and a content policy that allows only our own origin.
• API responses are not cached (no-store).
• Request limits per email address and per IP block, stored in the database.
• Panel access is a separate session, with its own code.

No system is infallible. If a breach occurs that affects you, we will tell you by email and notify the Brazilian National Data Protection Authority (ANPD), at anpd.gov.br. You can also turn to the bodies of the National Consumer Defense System (PROCON) and to the consumidor.gov.br platform within the period set by Law 13,709/2018 (LGPD).

11 · Minors

The platform is not aimed at people under 18 and we do not knowingly collect their data. If you believe a minor has created an account, write to us at [email protected] and we will close it.

12 · Changes to this policy

If it changes, we announce it by email [TO BE COMPLETED BY THE LAWYER: plazo aviso cambios] in advance when the change genuinely affects you. The date of the version in force appears below.

Version of 2026-09-15.

v1