Handles health records, in Brazil

Lei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data) · Read the law's page

• Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.
• Process a child's or adolescent's personal data only with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, and never condition participation in a game, application, or other activity on more personal data than the activity strictly needs.
• Do not treat anonymized data as personal data unless the anonymization process can be reversed using your own means or with reasonable effort, and treat data used to build an identifiable behavioral profile as personal data again.
• Give a public-health research body access to personal data only within a controlled and secure environment, anonymized or pseudonymized where possible, and never transfer that data to a third party.
• Do not share sensitive health data between controllers for economic advantage, except for the data subject's requested portability or the listed health-service, pharmaceutical, or health-assistance transactions.

Lei nº 14.289, de 3 de janeiro de 2022, arts. 2º, 3º and 6º · Read the law's page

• Do not disclose information that identifies a person as living with HIV or chronic hepatitis B or C, or as a person with leprosy or tuberculosis, in a health service, school, workplace, public administration, public security body, court proceeding or written or audiovisual media.
• Break professional secrecy over that condition only where a law requires it, for just cause, or with the person's express authorization (the legal guardian's, for a child) given by a signed informed-consent form, subject to article 11 of the LGPD.
• Protect the information on those persons held in a public or private health service or a private health-plan operation, and keep it confidential where it could identify the condition.
• Organize care in a health service so that the general public cannot identify the condition.