This section applies to Brazilian residents and is provided pursuant to the Lei Geral de Proteção de Dados (LGPD — Law No. 13,709/2018).
Confirmation and Access — request confirmation that we process your personal data and obtain a copy of it.
Correction — request correction of incomplete, inaccurate, or outdated personal data.
Anonymisation, Blocking, or Deletion — request that unnecessary, excessive, or unlawfully processed personal data be anonymised, blocked, or deleted.
Portability — request that we transmit your personal data to another service or product provider, subject to regulatory guidance.
Deletion of Consented Data — request deletion of personal data processed on the basis of your consent, except where retention is required by law.
Information on Sharing — request information about the public and private entities with which we have shared your personal data.
Withdrawal of Consent — withdraw consent to our processing of your personal data at any time. Withdrawal does not affect the lawfulness of prior processing but may affect our ability to provide trial matching services.
Objection — object to processing carried out on a legal basis other than consent where you believe it does not comply with the LGPD.
Review of Automated Decisions — request review of a decision made solely on the basis of automated processing that affects your interests, including an automated trial eligibility assessment, and information on the criteria and procedure used for it.
Breach Notification — if we experience a breach of your personal data likely to result in risk or harm to you, we will notify you and the ANPD within the timeframe required by applicable law.
Health information is sensitive personal data under the LGPD and requires your explicit consent before we collect or process it.
Your personal data, including health data, is collected directly by HealthMatch United States, Inc., 33 Arch Street, Boston, MA 02110, USA (HM US), the controller, and stored in the United States. It is used to match you with clinical trials, operate the HealthMatch platform and communicate with you about trials.
HM US transfers your data to HealthMatch Pty Ltd (ABN 77 618 446 905), Australia (HM AU), which accesses it from Australia as HM US's processor to operate and support the platform, assess your eligibility for trials (which may use automated tools), assist with matching and referrals and provide patient support. The transfer is made under the ANPD Standard Contractual Clauses (Resolution CD/ANPD No. 19/2024), HM US as exporter and HM AU as importer. Both entities are bound by the commitments in this policy and your consent.
Your data is retained while your account is open. You may delete your account at any time; data is then deleted or anonymised unless law or trial record-keeping obligations require longer retention.
Your data may be onward-transferred to the sites, sponsors and CROs of a trial you have agreed to be referred to, and to approved service providers supporting the platform, in each case under written contracts imposing equivalent protections. If you reached HealthMatch through a referral partner, we send that partner a click identifier, the fact and time of your sign-up and the fee due, for attribution and fee reconciliation only; no health data is included. If you agreed to it at sign-up, we send hashed contact identifiers and sign-up events, never health data, to advertising and measurement platforms to measure trial recruitment campaigns.
You may exercise the rights above against HM US (contact: Tate Stubbs, tate@healthmatch.io) and may petition the ANPD at any time.
Our Data Protection Officer (Encarregado) is Tate Stubbs, contactable at tate@healthmatch.io.
Email tate@healthmatch.io or privacy@healthmatch.io. We will verify your identity and respond within 15 days.
If you are not satisfied with our response, you may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.