privacy policy

last updated: november 8, 2026

who we are

juntos is an Android and iOS app provided by TEAM DEVZ TI LTDA, registered in Brazil under CNPJ no. 47.784.342/0001-03, based in Brasília, DF (“we”, “us”). We are the controller of the personal data used to run the app, under Brazil’s General Data Protection Law (Law no. 13,709/2018, “LGPD”) and, where they apply, other data protection laws, such as the European GDPR and the UK GDPR.

juntos is available in every country where the app stores offer it and where SMS sign-in works. This policy applies to everyone, wherever you are. People in Europe, the United Kingdom or the United States have extra rules, explained in the sections at the end.

Our data protection officer (in Brazil, the “encarregado”) can be reached at contato@juntos-app.org.

This policy explains what data juntos uses, what for, who it is shared with, how long it is kept and how you can exercise your rights. It applies to the app in Portuguese, English and Spanish.

how the app works

Each juntos group is dedicated to the care of one person, whom we call the patient, whether they are in a hospital, a clinic or at home. Group members share a timeline of updates (with text, photos, videos and comments), the caregiver shift schedule and swap requests, visiting hours, where the patient is, medications, allergies and prescription photos, as well as errands and tasks (things a caregiver on shift needs someone else to take care of).

Groups are private: only people who were invited can see their content. The patient can also be a member and can even organize the group.

what data we use

your account

• Your mobile number, used to sign in with a code sent by SMS.
• Your name.
• A record of your consent and of your acceptance of the terms of use: the date and the version of the text you accepted.

your profile in each group

• Gender (male or female).
• Your relationship to the patient (for example, daughter, brother, friend).
• Your role in the group (organizer, caregiver or patient).
• A profile photo, if you choose to add one.
• Your device’s language and time zone, to show the app in your language and with the right times.

what members post in the group

• Updates, comments, photos and videos.
• The shift schedule and swap requests.
• Shift arrivals: the time of arrival and, when it is detected automatically, the distance to the place at that moment.
• Visiting hours and visits.
• Where the patient is: name of the place, room and address.
• Medications, allergies and prescription photos.
• Doses marked as given: who marked them and when.
• Errands and tasks.

Much of this information is health data, which gets special care (see the next section).

data about other people you enter

• The name, phone number, gender and relationship to the patient of the people you invite. This data stays in the group as an invitation until the person accepts or declines. If they decline, the invitation is deleted.
• The name of the people you book a visit for.

location, contacts and notifications

• Your device’s location, in the situations described under location.
• The name and phone number of one contact from your address book, only when you choose to invite someone “from contacts” (see contacts).
• Your device’s notification identifier (push token), to send alerts to your phone.

technical connection data

As with any internet service, our servers receive technical connection data, such as your IP address, to deliver responses to the app and protect the service against abuse. We also keep access logs (see how long we keep data). When you request a sign-in code, we keep the number and the IP address of the request for a short time, to apply usage limits.

when you contact us

If you write to us, we receive your email and whatever you tell us. If you use the app’s “talk to us” button, the message already includes the app version, the device’s operating system and the language, to help solve the problem. Nothing from the group is included.

what we do not collect

We do not use analytics or tracking tools (SDKs), we do not build behavioral profiles and we do not read your whole address book. Photos and videos are only uploaded when you choose to post them.

health data and information about the patient

Information about health, medications, allergies and prescriptions is sensitive personal data (article 11 of the LGPD) and “special category data” under the European General Data Protection Regulation (GDPR). We use this data based on your consent, requested on a dedicated screen in the app before you create or join your first group (we keep the date and the version of the text you accepted; the current version is the one dated November 8, 2026), and only so the group can organize care. You also accept the terms of use on that same screen.

When you enter information about the patient, you confirm that you have their permission or that you are their legal representative (for example, a parent or guardian of a child, a court-appointed guardian or someone holding a power of attorney). If the patient is able to decide, talk to them first. They can also join the group and even organize it.

We never use health data for advertising, for choosing partner companies, for profiling or for any purpose other than running the group.

You can withdraw your consent at any time by deleting information, no longer using the app or deleting your account. Withdrawal does not affect what was done before it. Without this data, however, the app cannot do its job for the group.

what we use data for, and on what legal basis

Creating your account and confirming your number by SMS

Data: mobile number and name. Legal basis: performance of a contract (LGPD art. 7, V).

Showing your profile and the group’s content to members; building the schedule, visits, errands and medication list

Data: profile and group content. Legal basis: performance of a contract; for health data, consent (art. 11, I).

Detecting shift arrival and showing the group who is on the way

Data: location. Legal basis: consent, given through the device permission and your choice in the app.

Sending notifications

Data: push token, language and time zone. Legal basis: performance of a contract. You can turn notifications off in your device settings.

Reading prescriptions with artificial intelligence (optional)

Data: prescription photos. Legal basis: specific consent, requested in an in-app notice before first use.

Searching for addresses

Data: the address text you type. Legal basis: performance of a contract.

Keeping the service secure, preventing abuse and applying usage limits

Data: technical connection data and, for code requests, the number and IP address. Legal basis: legitimate interest (art. 7, IX).

Keeping access logs (IP address, date and time) for 6 months

Data: IP address, date, time, account and the app function that was called. Legal basis: compliance with a legal obligation (LGPD art. 7, II; article 15 of Brazil’s Internet Civil Framework). Where the GDPR applies, the basis is different (see europe and the united kingdom).

Answering when you contact us

Data: email, message and the technical details the app includes. Legal basis: performance of a contract and legitimate interest.

Recording a support purchase, if one is offered

Data: the purchase confirmation sent by the store. Legal basis: performance of a contract.

Complying with legal obligations and responding to authorities

Data: whatever the law or order requires. Legal basis: compliance with a legal or regulatory obligation (art. 7, II) and the regular exercise of rights (art. 7, VI).

location

juntos uses your device’s location for two things: detecting when a caregiver arrives at the patient’s location for a shift, and letting the group follow someone who is “on the way” until they arrive.

• While the app is open: if you allow location access, the app uses it while it is open.
• In the background: only if you choose “allow all the time” (or “always”). Even then, background use only happens while you are on the way to a shift and to detect your arrival near the patient’s registered location.
• Positions are sent to our server and shown to the group only while you are on the way. When you arrive, the last position is deleted from our server. If you never mark your arrival, it is deleted automatically within 24 hours.
• The arrival record (the time and, when the arrival is detected automatically, the distance to the place) is kept with the schedule.
• You can change or revoke the permission at any time in your device settings. Without it, the app still works, but without automatic arrival and without following who is on the way.

contacts

The app only accesses your contacts if you choose to invite someone “from contacts”. In that case, it reads only the contact you pick, to fill in the invitation’s name and phone number. Your contact list is not uploaded to our servers.

reading prescriptions with artificial intelligence

This feature is optional. Before you use it for the first time on a device, the app shows a notice explaining how it works and asks for your consent. If you agree, the prescription photos are sent, through our server, to the API of Anthropic (the Claude model), a United States company, which identifies medication names, doses and times.

• You review everything before saving. Nothing is saved without your confirmation.
• The text the AI read and what you confirmed are kept with the prescription, as a record of what was checked. The photos are deleted from our server after 7 days.
• According to the provider’s terms, data sent via the API is not used to train models. The provider may keep it for a limited period for security and abuse monitoring.
• The reading can be wrong. Always check it against the original prescription.
• To protect the service, the number of readings may be limited. When that happens, the feature is temporarily unavailable.
• If you prefer not to use AI, or if it is unavailable, you can enter medications manually.

who we share data with

members of your group

Everything you post in a group, your profile in that group and your position while you are on the way are visible to the group’s members. Photos and videos are downloaded to members’ devices, and they can keep or pass on what they see. So only invite people you trust.

providers that help us run the app

• Google (Firebase Authentication): sending the SMS code and signing in with your mobile number.
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): delivering notifications. The text of each notification passes through these services. For that reason, notifications about comments and allergies do not include their content: the full text only appears inside the app.
• Cloudflare: runs the app’s API (Cloudflare Workers) and stores photos, videos and the daily database backups (Cloudflare R2).
• Hetzner: dedicated server in Finland (European Union) that hosts the database (PostgreSQL).
• Anthropic: reading prescriptions with AI, only if you use the feature and consent.
• OpenStreetMap (Nominatim service): receives the address text you type in the search to find the place. The search is made by our server, so OpenStreetMap does not receive your IP address or your account.
• Expo (EAS Update): delivers app updates. It does not receive your account data or group content.
• Apple (App Store) and Google (Google Play): distribute the app and, if a support purchase is offered, process the payment.

These providers use the data only to provide their service to us, under their terms and data protection commitments.

apps you choose to open

Some buttons open other apps, and what goes through them is governed by each app’s own privacy policy: WhatsApp or another app to send an invitation (with the name of the person you invite), Google Maps to see the position of someone on the way on a map, your email app to contact us, and a partner’s WhatsApp or website. Nothing is sent to them until you tap the button.

authorities

When required by law or by an order from a competent authority, we may provide data, limited to what is required.

what we never do

We do not sell, rent or share your data for marketing or advertising. We also do not send your data to partner companies (see partner companies).

partner companies

juntos may show partner companies that families can hire, such as caregiver agencies and home care companies. They appear in the area for adding people to a group and are always clearly labeled as partners.

• Chosen without your data: we do not use any personal data to choose which partners are shown, and we never use health data, group content, updates, prescriptions, medications or the patient’s location. The list is the same for everyone, or is filtered only by a city you pick at that moment, which is used just to filter the list.
• No tracking: we do not use tracking tools or build behavioral profiles for this, and we do not sell data to partners.
• Nothing is sent unless you decide: nothing is sent to a partner unless you choose to contact it. Tapping a partner opens the company’s own WhatsApp or website. From then on, the conversation is between you and the company and is governed by the company’s own privacy policy.

Showing a partner is not a medical recommendation. See also the terms of use.

supporting juntos (optional purchase)

If we offer a way to support juntos, it will be an optional purchase through the App Store or Google Play. The store processes the payment: we do not receive your card details. The store may only tell us that the purchase was made. A purchase does not change what we keep about the group.

international transfers

We are a company based in Brazil, and juntos is used in many countries. So your data may be processed outside the country where you live:

• in Brazil, where we run the service and handle requests;
• in Finland (European Union), where the database is, on a dedicated server;
• in the United States and other countries where Google, Apple, Cloudflare, Anthropic and Expo operate. The API runs on Cloudflare’s network, which handles each request close to where it was made.

To protect this data, we use:

• encryption in transit (HTTPS/TLS) between the app, our API and storage;
• access to the server and database restricted to authorized people;
• providers with contractual data protection commitments;
• when data leaves the European Economic Area or the United Kingdom for a country without an adequacy decision, the standard contractual clauses approved by the European Commission (and the UK addendum) offered by those providers, where applicable.

To learn more about these safeguards, write to contato@juntos-app.org.

how long we keep data

• Updates, comments, notifications, photos, videos and prescription photos: deleted from our server 7 days after they are posted. After that, they exist only on members’ devices, stored inside the app and excluded from iCloud and Google backups. Photos and videos are downloaded to the device automatically (videos over Wi-Fi or, from the 6th day, over any network). If you sign out or delete your account, what was stored on your device is deleted.
• Account, group, schedule, medications, allergies, visits, errands and tasks: kept until they are deleted or until the account or group is deleted.
• Arrival records, doses given and the text from AI prescription reading: kept with the schedule and medications until they are deleted or until the group is deleted.
• Invitations: kept until the person accepts or declines, or until the group is deleted.
• Position of people on the way: deleted from our server when the person arrives or, if the arrival is never marked, automatically within 24 hours.
• Sign-in code requests: the number and IP address of each request are kept for 2 days, to apply usage limits.
• Messages you send us: kept for as long as needed to handle and follow up on your request.
• Access logs: we keep the IP address, date, time and the app function called in each use, linked to your account, for 6 months, as required by Brazil's Internet Civil Framework (Law 12,965/2014, article 15). These logs remain after you delete your account until the 6 months are up, and are only handed to authorities under a court order.
• Backups: we back up the database once a day and keep each backup for 14 days. The storage automatically deletes any backup older than 30 days. Deleted data may remain in these backups until they expire. Backups are only used to restore the service after a failure.

We only keep data longer when the law requires it.

how we protect data

• Communication between the app and the server is encrypted.
• A group’s content is only delivered to its members.
• Access to the servers is restricted to authorized people.
• On your device, content is stored inside the app. Protect your phone with a passcode or biometrics.

No system is completely secure. If a security incident occurs that may cause significant risk or harm, we will notify Brazil’s National Data Protection Authority (ANPD), other data protection authorities when the law requires it, and the people affected.

usage limits

To protect the service and prevent abuse, the app may apply usage limits, for example on SMS sign-in codes and on AI prescription readings. When a limit is reached, the feature may be temporarily unavailable. Limits do not use health data and are not used to build profiles.

your rights

Wherever you are, you can request:

• confirmation that we process your data;
• access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
• portability of your data to another provider;
• deletion of data processed based on your consent;
• information about who we share your data with;
• information about the option not to consent and what happens if you don’t;
• withdrawal of consent.

You can edit your profile and delete your account directly in the app. For other requests, write to contato@juntos-app.org. We may ask you to confirm the request is yours (for example, using the account’s mobile number). We respond within the deadlines set by law and do not charge for it. If the law where you live gives you more rights, we respect them.

If someone else posted information about you in a group (for example, if you are the patient), you can ask the group’s organizer to delete it or contact us.

You can also file a complaint with Brazil’s National Data Protection Authority (ANPD) or with the data protection authority of the country where you live.

deleting your account

You can delete your account at any time in the app, from your profile screen or the group screen. When you do:

• we delete your name, phone number, photos, registered devices and your login;
• what you posted in groups stays there, shown as “deleted account”;
• if you were the only organizer of a group, another member takes over;
• a group left with no members is deleted entirely;
• the updates stored on your device are deleted too.

Content already downloaded to other members’ devices stays with them. Deleted data may remain in backups until they expire, as explained above. Access logs are kept for the 6 months required by law (see how long we keep data).

if you are in europe or the united kingdom

If you are in the European Economic Area, the GDPR also applies. In the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. The data controller is TEAM DEVZ TI LTDA, based in Brasília, DF, Brazil, reachable at contato@juntos-app.org.

Our legal bases, by purpose, are:

Account, SMS sign-in, group content, notifications and address search

Performance of a contract (art. 6(1)(b)).

Health data about the patient and the group

Explicit consent (arts. 6(1)(a) and 9(2)(a)), given on the app’s consent screen.

Reading prescriptions with AI

Explicit consent (arts. 6(1)(a) and 9(2)(a)), requested before first use.

Location

Consent (art. 6(1)(a)), given through the device permission and your choice in the app.

Security, abuse prevention and usage limits

Legitimate interest (art. 6(1)(f)) in keeping the service secure and available.

Access logs for 6 months

Brazilian law requires us to keep them. For people in Europe or the United Kingdom, the basis is our legitimate interest (art. 6(1)(f)) in complying with the law we are subject to, protecting the service and defending legal claims.

Answering messages and rights requests

Legitimate interest (art. 6(1)(f)) and, for rights requests, compliance with a legal obligation (art. 6(1)(c)).

To create an account, you must provide your mobile number. Without it, you cannot use the app. Other data is optional or depends on what the group decides to record.

We do not make automated decisions that have legal or similarly significant effects on you. AI reading only suggests a draft, which a person reviews.

You have the right to access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interests, and to withdraw consent at any time, without affecting what was done before. We respond within one month, as the GDPR requires. You can also lodge a complaint with a data protection authority, in particular in the country where you live, work or where the issue happened (in the United Kingdom, the ICO).

For transfers of data to Brazil, the United States and other countries, see international transfers.

if you are in the united states

We do not sell personal information and do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (CCPA/CPRA) and similar state laws. We do not use sensitive personal information to infer characteristics about you. You can request access to, correction of or deletion of your data at contato@juntos-app.org, and you will not be treated differently for doing so.

consumer health data

This part is for state laws such as Washington’s My Health My Data Act and Nevada’s SB 370.

• What data: medications, allergies, prescriptions and their photos, doses given, health information members write in updates and comments, where the patient is (hospital, clinic or home), and the location of someone on the way to a shift until they arrive at the patient’s place.
• Where it comes from: from you and the other members of the group. The AI reading draft comes from the photos you send.
• What for: only to run what the group uses (medications, allergies, schedule, arrivals, updates) and, if you ask for it, AI prescription reading. Never for advertising or profiling.
• Who we share it with: the members of the group; the providers that process data on our behalf (Cloudflare and Hetzner, to store the data; Anthropic, only if you use AI reading; Google and Apple, to deliver notifications, which may mention, for example, the patient’s location); and authorities, when the law requires it. We have no affiliates that receive this data.
• Sale: we do not sell health data or any other data.
• Your rights: you can confirm whether we process your health data, access it and the list of third parties we share it with, ask for it to be deleted, and withdraw your consent. Delete your account in the app or write to contato@juntos-app.org. If we deny your request, you can appeal by replying to our answer. If the appeal is also denied, you can contact your state’s Attorney General.
• Changes: if we want to use this data for another purpose, we will ask for your consent first.

children and teenagers

juntos is made for adults who organize someone’s care. It is not meant for children under 13, who should not create an account. People aged 13 to 18 (or under the age required by the law of their country) should only use the app with the permission and supervision of a parent or legal guardian. If we learn that a child under 13 has created an account, we will delete it. When the patient is a child or a teenager, their data is entered by their legal guardians, in their best interest.

changes to this policy

We may update this policy when the app or the law changes. The date at the top shows the latest version. If a change is significant, we will let you know in the app before it takes effect and, where the law requires, ask for your consent again.

contact us

Privacy questions, requests or complaints: contato@juntos-app.org (data protection officer).

TEAM DEVZ TI LTDA · CNPJ 47.784.342/0001-03 · Brasília, DF, Brazil