Menu Close

Copyright © 2024 Afya. All rights reserved

Powered by MZ

Search
Menu

Privacy Policy

This Privacy Policy was prepared by Afya Limited, Afya Participações S.A., and the other companies comprising the Afya Group, in order to inform the Users of our services how we collect, store, protect and use their Personal Data. The privacy of your data is very important to us and, for this reason, we follow strict policies on the Treatment of Personal Data, in accordance with the relevant legal and regulatory standards, in order to guarantee and respect your privacy and be transparent regarding the processes performed on your Personal Data.

In this Privacy Policy, we present the general guidelines for Processing the Personal Data of our students and their parents, legal and/or financial representatives, guarantors, prospective students, employees and prospective employees and visitors to the Afya Group Platforms, as well as partners and third parties contracted by the Afya Group.

This Privacy Policy is intended to:

  1. Reinforce our commitment to privacy and security in the Processing of Personal Data;
  2. Demonstrate, in a simple and transparent way, which Personal Data we process, the reason and the methods used to collect, store, process, transfer and query said data;
  3. Describe your rights related to Personal Data and the manner by which such rights may be exercised; and
  4. Explain how we protect your Personal Data.

The Privacy Policy is subdivided into the following sections:

Section Theme
1 Who is the Afya Group?
2 What are the important concepts for understanding this Privacy Policy?
3 How does Afya Group collect your Personal Data?
4 What Personal Data is processed by Afya Group?
5 For what purposes does Afya Group Process Personal Data?
6 What are the legal bases for the Processing of Personal Data?
7 Who can we share your Personal Data with?
8 Transfer of your Personal Data outside Brazil
9 How long do we store your Personal Data?
10 What are your rights and how can you exercise them?
11 How do we keep your Personal Data secure?
12 How can you contact Afya Group?
13 General Provisions

1. WHO IS THE AFYA GROUP?

Afya Educacional was founded in 2019 with the objective of being a key partner of medical professionals throughout their training journey. But our history has more than 20 years, especially in the health and medicine programs. Through our educational units, we offer undergraduate degrees – there are more than 30 different programs, in addition to Medicine -, courses for residency exams and other titles, up to medical graduate studies. The group, which currently holds the largest number of authorized medical seats in the country, wants more: our mission is to be a reference in medical and health education, educating our students to transform their dreams into extraordinary lifelong learning experiences. ​Afya Educacional was born from the merger of NRE Educacional, the largest group of medical schools in the country, with Medcel, a reference company in preparatory courses for medical residency, specializations and refreshment courses. Afya is a highly technological company focused on education and dedicated to taking care of the entire professional journey of physicians.

Across their journeys, the two companies that now make up Afya have trained more than 10,000 doctors in different phases of their academic and professional lives, contributing to improve the provision of health services and, thus, promote quality of life in the communities where it is present. The success of Afya Educacional is due to a combination of three factors: physician founders, with vast technical knowledge; professional management and an investor group with a history of success in the education and health segments.

1.1 In addition to Afya Limited, Afya Group is composed of the following companies:
Afya Participações S.A., a holding of non-financial institutions, located at Alameda Oscar Niemeyer, No.: 119, Salas: 504, 1.501, and 1.503, Bairro: Vila da Serra, CEP: 34.006-056, Nova Lima/MG, registered with CNPJ (National Registry of Legal Entities) under No. 23,399,329/0001-72, exempt from state registration, and with Trade Name: Afya Participações S.A.

ITPAC Instituto Tocantinense Presidente Antonio Carlos S.A., with commercial office located at Avenida Filadélfia, No.: 568, Bairro: Setor Oeste, CEP: 77.816-540, Araguaína/TO,  registered with CNPJ (National Registry of Legal Entities) under No. 02,941,999/0001- 98, exempt from state registration, and with Trade Name: ITPAC Araguaína.

ITPAC Instituto Tocantinense Presidente Antonio Carlos S.A., with office located at Avenida 202 Sul Rua NS B, S/N, Conjunto: 02, Lote: 03, Bairro: Plano Diretor Sul, CEP: 77.020-452, Palmas/TO, registered with the CNPJ (National Registry of Legal Entities) under No. 02,941,999/0006-00, exempt from state registration, and with Trade Name: ITPAC – Palmas.

ITPAC Porto Nacional – Instituto Tocantinense Presidente Antonio Carlos Porto S.A. headquartered at Rua 02, S/N, Quadra: 07, Bairro: Jardim dos Ypês, CEP: 77.500-000, Porto Nacional/TO, registered with CNPJ (National Registry of Legal Entities) under No. 10,261,569/ 0001-64, exempt from state registration, and with Trade Name: ITPAC Porto Nacional.

Instituto de Ensino Superior do Piauí S.A., headquartered at Rua Vitorino Orthiges Fernandes, no. 6.123, Bairro: Uruguai, CEP: 64.073-505, Teresina/PI,  registered with CNPJ (National Registry of Legal Entities) under No. 21,909,778/0001-98, exempt from state registration, and with Trade Name: UNINOVAFAPI.

Centro Integrado de Saúde de Teresina LTDA., headquartered at Rua Vitorino Orthiges Fernandes, no. 6.123, Complemento: Bloco D, Bairro: Uruguai, CEP: 64.057-100, Teresina/PI,  registered with CNPJ (National Registry of Legal Entities) under No. 10,393,987/0001-05, exempt from state registration, and with Trade Name: CIS.

MEDCEL Editora e Eventos S.A., headquartered at Alameda Lorena, No.: 269, Bairro: Jardim Paulista, CEP: 01.424-001, São Paulo/SP, registered with CNPJ (National Registry of Legal Entities) under No. 07,164,688/0001-94, exempt from state registration, and with Trade Name: MEDCEL.

UNIVAÇO – União Educacional do Vale do Aço S.A., headquartered at Rua Joao Patrício Araújo, no. 179, Bairro: Veneza, CEP: 35.164-251, Ipatinga/MG, registered with CNPJ (National Registry of Legal Entities) under No. 01,757,902/0001-30, exempt from state registration, and with Trade Name: UNIVACO – União Educacional do Vale do Aço S.A.

Instituto de Educação Superior do Vale do Parnaíba S.A., headquartered at Avenida Evandro Lins e Silva, no. 4.432, Bairro: Sabiazal, CEP: 64.212-790, Parnaíba/PI, registered with CNPJ (National Registry of Legal Entities) under No. 13,783,222/0001-70, exempt from state registration, and with Trade Name: IESVAP.

IPEC Instituto Paraense de Educação e Cultura LTDA, headquartered at Quadra Três, S/N, Complemento: Folha: 32 Quadra: Especial, Lote: 10, Bairro: Nova Marabá, CEP: 68.508-030, Marabá/PA, registered with CNPJ (National Registry of Legal Entities) under No. 07,962,437/0001-55, exempt from state registration, and with Trade Name: IPEC.

ITPAC Porto Nacional – Instituto Tocantinense Presidente Antonio Carlos Porto S.A., with office located at Rodovia Bragança Capanema Avenida Mendonça Furtado, S/N, Quadra: 216, Lote: 530, Bairro: Vila Nova, CEP: 68.600-000, Braganca/PA, registered with CNPJ (National Registry of Legal Entities) under No. 10,261,569/0003-26, exempt from state registration, and with Trade Name: Faculdade ITPAC Braganca.

ITPAC Instituto Tocantinense Presidente Antonio Carlos S.A., with office located at BR 423 KM 79, S/N, Bairro: Heliópolis, CEP: 55.297-130, Garanhuns/PE, registered with CNPJ (National Registry of Legal Entities) under No. 02,941,990/0003-50, exempt from state registration, and with Trade Name: FAMEG.

ITPAC Porto Nacional – Instituto Tocantinense Presidente Antonio Carlos Porto S.A., with office located at Rodovia Dr. Joao Miranda, S/N, KM: 04, Bairro: Bosque, CEP: 68.440-000, Abaetetuba/PA, registered with CNPJ (National Registry of Legal Entities) under No. 10,261,569/0004-07, exempt from state registration, and with Trade Name: Faculdade ITPAC Abaetetuba.

ITPAC Instituto Tocantinense Presidente Antonio Carlos S.A., with office located at Avenida Filadélfia, no. 568, Bloco C, Bairro: Setor Oeste, CEP: 77.816-540, Araguaína/TO,  registered with CNPJ (National Registry of Legal Entities) under No. 02,941,990/0008-64, exempt from state registration, and with Trade Name: ITPAC – CAMETÁ.

ITPAC Instituto Tocantinense Presidente Antonio Carlos S.A., with office located at Avenida 25 de Agosto, S/N, Lote: 02-B, Quadra: 173-B, Bairro: 25 de Agosto, CEP: 69.980-000, Cruzeiro do Sul/AC, registered with CNPJ (National Registry of Legal Entities) under No. 02,941,990/0009-45, exempt from state registration, and with Trade Name: ITPAC – CRUZEIRO DO SUL.

ITPAC Instituto Tocantinense Presidente Antonio Carlos S.A., with office located at Estrada do Sesc, S/N, Bairro: Perímetro de Expansão Urbana, CEP: 69.400-970, Manacapuru/AM, registered with CNPJ (National Registry of Legal Entities) under No. 02,941,990/0010-89, exempt from state registration, and with Trade Name: ITPAC – MANACAPURU.

Instituto de Pesquisa e Ensino Médico do Estado de Minas Gerais LTDA., headquartered at Avenida do Contorno, no. 2088, Loja 01, Bairro: Floresta, CEP: 30.110-012, Belo Horizonte/MG, registered with CNPJ (National Registry of Legal Entities) under No. 07,890,065/0001-07, exempt from state registration, and with Trade Name: IPEMED.

Instituto de Pesquisa e Ensino Médico do Estado de Minas Gerais LTDA., with office at Alameda Lorena, no. 269, Andar: 1, 2, 3, 4, and 5, Sala: 01, Bairro: Jardim Paulista, CEP: 01.424-001, São Paulo/SP, registered with CNPJ (National Registry of Legal Entities) under No. 07,890,065/0002-80, exempt from state registration, and with Trade Name: IPEMED – Instituto de Pesquisa e Ensino Médico.

Instituto de Pesquisa e Ensino Médico do Estado de Minas Gerais LTDA., with office located at Praça Vereador Rocha Leão, no. 10, Sala: 101/401, Bairro: Copacabana, CEP: 22.031-060, Rio de Janeiro/RJ, registered with CNPJ (National Registry of Legal Entities) under No. 07,890,065/0003-60, exempt from state registration, and with Trade Name: IPEMED.

Instituto de Pesquisa e Ensino Médico do Estado de Minas Gerais LTDA., with office located at Setor Sepn 509 Bloco B, S/N, Andar: 01 e 02, Bairro: Asa Norte, CEP: 70.750-502, Brasília/DF, registered with CNPJ (National Registry of Legal Entities) under No. 07,890,065/0005-22, exempt from state registration, and with Trade Name: IPEMED.

Instituto de Pesquisa e Ensino Médico do Estado de Minas Gerais LTDA., with office located at Avenida do Contorno, No. 2,073, Bairro: Santa Tereza, CEP: 30.110-009, Belo Horizonte/MG, registered with CNPJ (National Registry of Legal Entities) under No. 07,890,065/0008-75, exempt from state registration, and with Trade Name: Faculdade IPEMED de Ciências Médicas IPEMED.

IPTAN – Instituto de Ensino Superior Presidente Tancredo de Almeida Neves S.A., headquartered at Avenida Leite de Castro, No. 1.101, Bairro: Fábricas, CEP: 36.301-182, São Joao Del Rei/MG, registered with CNPJ (National Registry of Legal Entities) under No. 03,219,494/0001-98, exempt from state registration, and with Trade Name: IPTAN – Instituto de Ensino Superior Presidente Tancredo de Almeida Neves S.A.

IPTAN – Instituto de Ensino Superior Presidente Tancredo de Almeida Neves S.A., with office at Estrada do Aeroporto, S/N, Complemento: Terreno Poranga, Bairro: Área Rural de Itacoatiara, CEP: 69.109-899, Itacoatiara/AM, registered with CNPJ (National Registry of Legal Entities) under No. 03,219,494/0002-79, exempt from state registration, and with Trade Name: IPTAN – Instituto de Ensino Superior Presidente Tancredo de Almeida Neves S.A.

IPTAN – Instituto de Ensino Superior Presidente Tancredo de Almeida Neves S.A., with office at Rodovia BR-315, No. 346, Bairro: São Cristóvão, CEP: 65.304-770, Santa Inês/MA, registered with CNPJ (National Registry of Legal Entities) under No. 03,219,494/0003-50, exempt from state registration, and with Trade Name: IPTAN – Instituto de Ensino Superior Presidente Tancredo de Almeida Neves S.A.

Instituto Educacional Santo Agostinho S.A., headquartered at Avenida Osmane Barbosa, No. 937, Bairro: Conjunto Residencial JK, CEP: 39.404-006, Montes Claros/MG, registered with CNPJ (National Registry of Legal Entities) under No. 03,735,981/0001- 03, exempt from state registration, and with Trade Name: Instituto Educacional Santo Agostinho.

Instituto Educacional Santo Agostinho S.A., with office located at Avenida Donato Quintino, no. 90, Loja: E-98, Bairro: Cidade Nova, CEP: 39.400-546, Montes Claros/MG, registered with CNPJ (National Registry of Legal Entities) under No. 03,735,981/0005-37, exempt from state registration, and with Trade Name: Instituto Educacional Santo Agostinho.

Instituto Educacional Santo Agostinho S.A., with office located at Avenida Olivia Flores, no. 200, Bairro: Candeias, CEP: 45.028-100, Vitoria da Conquista/BA, registered with CNPJ (National Registry of Legal Entities) under No. 03,735,981/0008-80, exempt from state registration, and with Trade Name: Instituto Educacional Santo Agostinho.

Instituto Educacional Santo Agostinho S.A., with office located at Avenida Ibicaraí, no. 3.270, Bairro: Nova Itabuna, CEP: 45.611-000, Itabuna/BA, registered with CNPJ (National Registry of Legal Entities) under No. 03,735,981/0012-66, exempt from state registration, and with Trade Name: Instituto Educacional Santo Agostinho.

Sociedade Universitária Redentor S.A., headquartered at Estrada BR 356, no. 25, Bairro: Presidente Costa e Silva, CEP: 28.300-000, Itaperuna/RJ, registered with CNPJ (National Registry of Legal Entities) under No. 03,596,799/0001-19, exempt from state registration, and with Trade Name: Sociedade Redentor.

Sociedade Universitária Redentor S.A., with office located at Rua Jose Egydio Tinoco, no. 79, Bairro: Cidade Nova, CEP: 28.300-000, Itaperuna/RJ, registered with CNPJ (National Registry of Legal Entities) under No. 03,596,799/0005-42, exempt from state registration, and with Trade Name: Sociedade Redentor.

Centro de Ensino São Lucas LTDA., headquartered at Rua Alexandre Guimarães, no. 1.927, Bairro: Areal, CEP: 76.804-373, Porto Velho/RO, registered with CNPJ (National Registry of Legal Entities) under No. 84,596,170/0001-70, exempt from state registration, and with Trade Name: Centro de Ensino São Lucas.

Centro de Ensino São Lucas LTDA., with office located at Avenida Engenheiro Manfredo Barata Almeida da Fonseca, no. 542, Bairro: Jardim Aurélio Bernardi, CEP: 76.907-524, Ji-Paraná/RO, registered with CNPJ (National Registry of Legal Entities) under No. 84,596,170/0011-42, exempt from state registration, and with Trade Name: Centro de Ensino São Lucas.

Instituto de Pesquisa e Ensino Médico do Estado de Minas Gerais LTDA., with office located at Avenida Adhemar de Barros, no. 1.194, Bairro: Ondina, CEP: 40.170-110, Salvador/BA, registered with CNPJ (National Registry of Legal Entities) under No. 07,890,065/0004-41, exempt from state registration, and with Trade Name: IPEMED.

PEBMED Instituição de Pesquisa Médica e Serviços Tecnológicos da Área da Saúde S.A., headquartered at Rua da Passagem, no. 123, Sala: 301, Bairro: Botafogo, CEP: 22.290-031, Rio de Janeiro/RJ, registered with CNPJ (National Registry of Legal Entities) under No. 18,355,716 /0001-77, exempt from state registration, and with Trade Name: PEBMED.

Sociedade de Educação, Cultura e Tecnologia da Amazônia S.A., headquartered at Avenida Brasil, no. 1.435, Bairro: Setor Alto Paraná, CEP: 68.550-325, Redenção/PA, registered with CNPJ (National Registry of Legal Entities) under No. 05,074,526/0001-30, exempt from state registration, and with Trade Name: Sociedade de Educação, Cultura e Tecnologia da Amazônia.

Centro de Ciências em Saúde de Itajubá S.A., headquartered at Avenida Rennó Junior, no. 368, Bairro: Medicina, CEP: 37.502-138, Itajubá/MG, registered with CNPJ (National Registry of Legal Entities) under No. 28,946,334/0001-71, exempt from state registration, and with Trade Name: Centro de Ciências em Saúde de Itajubá.

Centro Superior de Ciências da Saúde S/S LTDA., headquartered at Ladeira São Francisco, no. 16, Bairro: Centro, CEP: 58.010-630, João Pessoa/PB, registered with CNPJ (National Registry of Legal Entities) under No. 38,428,487/0001-80, exempt from state registration, and with Trade Name: Centro Nordestino de Ensino Superior.

FADEP – Faculdade Educacional de Pato Branco LTDA., headquartered at Rua Benjamin Borges dos Santos, no. 1.100, Bairro: Fraron, CEP: 85.503-350, Pato Branco/PR, registered with CNPJ (National Registry of Legal Entities) under No. 03,420,225/0001-95, exempt from state registration, and with Trade Name: FADEP – Faculdade Educacional de Pato Branco.

2. WHAT CONCEPTS ARE IMPORTANT FOR UNDERSTANDING THIS PRIVACY POLICY?

2.1We know that some terms used in this Privacy Policy may not be usual in your daily life. Thus, we have prepared a short glossary for you to check the definitions:

A

Adolescents: Students or Prospective Students of the Educational Units between twelve and eighteen years of age;

Afya: Afya Limited, a company headquartered in the Cayman Islands, parent company of Afya Participações S.A., a privately-held corporation registered with CNPJ (National Registry of Legal Entities) under No. 23,399,329/0001-72;

Processing Agents: the agents responsible for Processing Personal Data, namely, the Controller and the Operator;

Student: a person who takes course(s) in any of the Educational Units of Afya Group, including Adolescent Students;

Anonymization: technique whereby data loses the possibility of being associated, directly or indirectly, with an individual, so that it becomes impossible to identify the Subject of the anonymized data;

ANPD: National Data Protection Authority, a federal public administration body with attributions related to the protection of Personal Data and privacy, including the inspection for compliance with the LGPD (General Data Protection Law) across the national territory.

C

Consent: free, informed and unambiguous manifestation by which a Subject agrees to the Processing of their Personal Data for a specific purpose;

Controller: refers to an individual or legal entity responsible for the decisions regarding the Processing of Personal Data;

D

Personal Data: all information that allow identifying an individual directly or that can make such person identifiable. Examples of Personal Data are the name, address, CPF (SSN), RG (Id), email, identity documents in general, telephone, Internet application access records (date and time of use of a specific Internet application, IP address used for access), among others;

Sensitive Data: Personal Data related to racial or ethnic origin, religious faith, political opinion, membership to a union or organization of a religious, philosophical or political nature, data related to health or sexual life, genetic or biometric data when linked to an individual;

Device: means any electronic device used by a User to access the products and services offered by the Afya Group, such as desktop computers, laptops, televisions, cell phones, tablets, smartphones and/or other devices connected to the Internet;

E

Data Officer: person designated by the Processing Agents to act as a communication channel between the Controller, the Personal Data Subjects and the ANPD, and to ensure that the Processing Agents comply with the data privacy laws and regulations. The Afya Group Data Officer’s contact details are available in Section 12 of this Privacy Policy;

IP address: number assigned to each Device connected to the Internet, known as an Internet Protocol (Internet Protocol or IP) address. These numbers are usually assigned in geographic blocks. An IP address can be used to identify, for example, from which location a Device is connecting to the Internet;

G

Geolocation: feature that, when activated by the User, allows establishing the precise or approximate position of a Device and includes information such as the country, state, city and street where the Device is located, in addition to the time of access;

Afya Group: group composed of Afya and all its Educational Units, together, as detailed in Section 1 of this Privacy Policy;

L

LGPD: means the General Personal Data Protection Law, Federal Law No. 13,709, published on August 14, 2018, which regulates Personal Data Processing activities, including in digital media, by an individual or legal entity governed by public or private law, with the aim of protecting the fundamental rights of freedom and privacy and the unencumbered development of an individual’s personality. The full content of the LGPD can be consulted on this link;

O

Operator: individual or legal entity that Processes Personal Data on behalf of the Controller, according to its instructions;

P

Platform: means the electronic platform or website owned by the Educational Units of the Afya Group and/or Afya;

Prospective Student: individuals who are not enrolled in any Educational Unit belonging to the Afya Group, but are in the stage of admission exams, pre-enrollment or learning about the services provided by the Afya Group, which may include Adolescents;

Prospective Employee: individuals who are interested in working or providing services for any company of the Afya Group, and send a professional resume through the channels indicated in the Platforms;

R

Representative: the parents, legal and/or financial representatives or persons who appear as guarantors (guarantors, surety and the like) of the Students or Prospective Students;

S

Educational Services: educational services provided by the Educational Units of the Afya Group;

T

Data Subject: individual to whom the Personal Data undergoing Processing refer;

Processing: any operation performed with Personal Data, whether automated or not. That is, the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, storage, archiving, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction of Personal Data;

U

Educational Unit: educational institutions, video lesson platforms, schools and companies focused on conducting open courses that comprise the Afya Group, as listed in Section 1 of this Privacy Policy, when referred to individually or collectively;

User: term we use in this Privacy Policy to refer, without distinction, to Students, Prospective Students, Representatives and/or Prospective Employees. In this Privacy Policy, the terms “you”, “your” and “yours” are used in relation to any User who consults this document.

V

Visitor: individual who is not a Student, Prospective Student, Representative or Prospective Employee, but who accesses the Platforms.

2.2 If you still have questions after reading the terms defined above, please talk to us through our contact channel indicated in Section 12 of this Privacy Policy.

3. HOW DOES THE AFYA GROUP COLLECT YOUR PERSONAL DATA?

3.1. Method of collecting a Student’s Personal Data. Student’s Personal Data can be collected during the provision of Educational Services, in enrollment, enrollment renewal, assessments, tests, simulations, classroom notes, registrations for accessing the Educational Units, behavioral assessments, interviews and meetings with the faculty and the administration of the Educational Units, communications with the Educational Units and/or with Afya, as well as through using the educational tools employed by the Afya Group and any other usual means related to the provision of Educational Services.

3.2. Method of collecting a Prospective Student’s Personal Data. Prospective Student’s Personal Data can be collected upon their participation in events, in person and/or virtual, through procedures related to the admission processes of the Educational Units of the Afya Group, in communications with the Afya Group and/or by filling in the forms, registration sheets, questionnaires, attendance lists and the like on occasions related to the promotion of Afya Group’s products and services.

3.3. Method of collecting Representatives’ Personal Data. Representatives’ Personal Data may be collected as follows:

  1. Of the Representative of a Prospective Student – by filling in forms, registration sheets, questionnaires, or by providing documents and/or copying documents that contain their own Personal Data and/or of the represented Prospective Student.
  2. Of the Representative of a Student, in addition to the provisions of item (i), in the interactions necessary for enabling the provision of Educational Services by an Educational Unit to the Student, as well as through participation in events and/or through communications with the Afya Group.

3.4. Method of collecting a Prospective Employee’s Personal Data. Prospective Employee’s Personal Data can be collected by filling in forms, answering questionnaires and/or providing documents containing Personal Data, such as professional resumes, in events to advertise professional opportunities in the Afya Group and/or in procedures related to the selection processes of the Afya Group.

3.5. Personal Data collected automatically via Platform. We may collect some files and/or information stored on your Devices when you visit the Afya Group websites and/or when you use any Afya Group service or product online. These files or information are called “cookies” and they are employed to facilitate and optimize the use of our websites according to your interests, preferences and needs. Users may disable cookies in the settings of the browser used to access the Platforms if they so wish.

3.6. Personal Data collected automatically via Platform. A User may, at any time, request specific information about the Processing of their Personal Data by the Afya Group, through the contact channel indicated in Section 12 of this Privacy Policy.

4. WHAT PERSONAL DATA ARE PROCESSED BY THE AFYA GROUP?

4.1. Personal Data collected automatically via Platform. The Afya Group will Process the Personal Data and Sensitive Data indicated below, insofar as they are necessary to achieve any of the Processing purposes set out in Section 5 of this Privacy Policy. Sensitive Data are the ones highlighted in the table below:

Personal Data Subject Personal Data/Sensitive Data processed
Student Full name, CPF (SSN), RG (Id), date of birth, place of birth, nationality, gender, marital status, email, full residential address, zip code, 3×4 photo, medical and health data, program, enrollment number, Educational Unit, year of graduation, telephone, academic information (performance, assessments, tests), academic record, military enlistment certificate, voter registration, voice, image, academic and professional interests, and socio-economic information for scholarship students.
Prospective Student Full name, CPF (SSN), RG (Id), date of birth, place of birth, nationality, gender, marital status, e-mail, full residential address, zip code, Educational Unit of origin, academic history, cell phone, performance report at ENEM (National High-School Exam), medical and health data, voice, image, military enlistment certificate, voter registration, academic and professional interests.
Representatives Full name, marital status, date of birth, nationality, gender, place of birth, RG (Id), CPF (SSN), full address, zip code, telephones, e-mail, education, profession, information contained in the income tax return.
Prospective Employee Full name, date of birth, gender, email, full address, zip code, disability (disease), picture, telephones, education, professional and academic background.
Personal Data automatically collected by Platforms User’s browser, IP Address, date and time of access, Geolocation, operating system of the Device used and the User’s actions on the Platform

4.2. Afya Group undertakes to use the minimum amount of information necessary to achieve the intended purpose of Processing, therefore limiting itself to the use of pertinent, proportional and not excessive data.

4.3. Afya Group may collect other Personal Data and/or Sensitive Data of the Subject, as necessary to achieve the purposes set out in Section 5 below and always in accordance with the criteria and procedures established in the LGPD.

4.4. You may, at any time, request specific information about which Personal Data are processed by the Afya Group, through the contact channel indicated in Section 12 of this Privacy Policy.

5. FOR WHAT PURPOSES DOES THE AFYA GROUP PROCESS PERSONAL DATA?

5.1. The Afya Group seeks to Process your Personal Data always based on legitimate, specific, explicit and informed purposes. Therefore, we detail below the main purposes underlying the Processing of Personal Data and the data involved in each case:

Purpose for Processing Data Involved
Students Prospective Students Representative Prospective Employee
Carry out the admission process of the Educational Units ✓ ✓

5.2. User information may be used in other services provided directly by the Afya Group, respecting the purposes set forth above.

5.3. You may, at any time, request specific information about the Processing of your Personal Data by the Afya Group, through the contact channel indicated in Section 12 of this Privacy Policy.

6. WHAT IS THE LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA?

6.1. In accordance with the provisions of the LGPD, the Processing of Personal Data may be carried out:

  1. Upon Consent by the Personal Data Subject;
  2. In compliance with a legal or regulatory obligation by the Controller;
  3. By the public administration, for the processing and shared use of data necessary for the execution of public policies provided for in laws and regulations or backed by contracts, agreements or similar instruments;
  4. For conducting studies by research bodies;
  5. When necessary for the performance of a contract or preliminary procedure related to a contract;
  6. For regularly exercising rights in judicial, administrative or arbitration proceedings;
  7. To protect the life or physical safety of the Data Subject or a third party;
  8. To safeguard health, exclusively, in a procedure performed by health professionals, health services or health authority;
  9. When necessary to meet the legitimate interests of the Controller or third parties;
  10. For credit protection;

6.2. Sensitive Data, in turn, pose greater risks to the Personal Data Subject and the LGPD provides specific legal basis for its Processing, as follows:

  1. Consent by the Personal Data Subject or its legal guardian;
  2. Without Consent, in cases where the Processing is essential for;
  3. Fulfillment of a legal or regulatory obligation by the Controller;
  4. Shared processing of data necessary for the execution, by the public administration, of public policies provided in laws or regulations;
  5. Conduction of studies by research bodies;
  6. Regular exercise of rights, including in contracts and in judicial, administrative and arbitration proceedings;
  7. Protection of the life or physical safety of the Data Subject or third party;
  8. Safeguard health, exclusively, in a procedure performed by health professionals, health services or health authority; or
  9. Guaranteeing the prevention of fraud and the security of the Data Subject, in the authentication processes of electronic systems.

6.3. All Processing of Personal Data and/or Sensitive Data conducted by the Afya Group is legitimized by one of the aforementioned legal bases. To ensure this adequacy, we periodically review our processes, considering the context in which they operate, the risks and benefits that may be posed to the User. In addition, we keep a record of all our Processing operations, which may be subject to requests for clarification by the Personal Data Subject, as well as by competent public authorities.

6.4. It is important for you to be aware that, as detailed in items 6.1 and 6.2 of this Policy, we do not always need your Consent to use your Personal Data. As exposed above, there are situations in which, for multiple reasons, we may use your information without your Consent (such as, if we are required by law to use your Personal Data or if we need your Personal Data for the purposes set forth in a contract).

6.5. However, whenever we need your Consent to use your Personal Data for a specific purpose, you will be informed before any information is collected. At that moment, we will make it clear to you why we need your Personal Data and you will be able to choose whether to provide us with your information.

6.6. If you choose to Consent with the Processing purpose informed, we will formalize your expression of will through your signature and/or acceptance of a term describing the situation. If you do not wish to Consent, we will inform you of the consequence of this refusal.

6.7. You may, at any time, revoke your consent to the Afya Group, by expressly stating so through the contact channel indicated in Section 12 of this Privacy Policy.

7. WHO CAN WE SHARE YOUR PERSONAL DATA WITH?

7.1. For the purposes described in Section 5 of this Privacy Policy, your Personal Data may be shared with certain recipients, such as:

  1. The legal entities comprising the Afya Group, when necessary for the regular provision of services and/or supply of products by the Afya Group;
  2. Educational Units that are not part of the Afya Group, when necessary to meet the interests of the Students;
  3.  Our business partners and service providers, when necessary for enabling the services provided by the Afya Group, such as, for example, service providers of
    1. educational software licensing;
    2.  infrastructure and technology required for the operational performance of the Platforms and other educational tools used by the Educational Units;
    3.  cloud computing;
    4. nstitutional and pedagogical research, analysis and evaluations;
    5. solutions for selection processes;
    6. external audits;
    7. marketing and advertising platforms;
    8. financial services;
    9. billing services;
    10. recruitment and selection;
    11. organization of events, fairs and workshops;
  4. Public bodies and competent authorities, when necessary for the fulfillment of legal and/or regulatory obligations and/or for the regular exercise of Afya Group’s rights in arbitration, administrative or judicial proceedings.

7.2. The service providers mentioned in item (iii) above are hired by Afya Group as Personal Data Operators.

7.3. In order to provide maximum security to commercial relations involving the Processing of Personal Data, Afya Group certifies, before hiring an Operator, that it has an adequate technical, legal and organizational structure that is compatible with strict governance, security and privacy criteria on Personal Data.

7.4. Operators shall only be authorized to Process Personal Data upon receipt of lawful instructions from the Afya Group, which will occur in strict compliance with the provisions set forth in this Privacy Policy and the LGPD.

7.5. Any sharing of Personal Data shall be carried out in the minimum amount necessary to achieve a legitimate purpose, in accordance with the security and confidentiality standards established by the LGPD and other laws, rules and regulations related to the protection and privacy of Personal Data.

7.6. In situations where Personal Data has been collected upon Consent, the Afya Group undertakes to obtain your specific Consent for the purposes of sharing your Personal Data with other Controllers and Operators, except for the cases in which Consent is waived according to the LGPD.

7.7. You may, at any time, request specific information about the third parties with whom the Afya Group shares your Personal Data, through the contact channel indicated in Section 12 of this Privacy Policy.

8. TRANSFER OF YOUR PERSONAL DATA OUTSIDE BRAZIL

8.1. The Afya Group may transfer your Personal Data to business partners and/or service providers located outside Brazil, such as, for example, cloud document storage service providers, or any Educational Units related to Student exchanges and/or academic cooperation. Whenever it is necessary to transfer Personal Data outside Brazil, we will adopt all necessary measures to ensure the adequate protection and security of all information, within the limits provided for by the LGPD and other laws, rules and regulations related to the protection and privacy of Personal Data.

9. HOW LONG DO WE STORE YOUR PERSONAL DATA?

9.1. The Personal Data provided by you to the Afya Group are stored in our own servers or in servers contracted in the country or abroad, for a period defined as follows:

  1. period required by law;
  2. time required to fulfill the purpose for Processing the Personal Data, as listed in Section 5 of this Privacy Policy;
  3. time required to preserve the legitimate interests of the Afya Group, as appropriate; or
  4. time necessary to safeguard the regular exercise of the rights of Afya Group in judicial, administrative or arbitration proceedings, including in accordance with the applicable statute of limitations.

9.2. Except for cases in which the legislation authorizes the Afya Group to keep your Personal Data, they will be deleted when:

  1. the Processing purpose is fulfilled;
  2. the Personal Data are no longer required or relevant for the fulfillment of the specific purpose sought;
  3. a User exercises their right to revoke Consent, upon express communication and in the applicable cases; or
  4. under determination of the ANPD, in case of violation of the LGPD.

9.3. You may, at any time, expressly request the deletion of your Personal Data stored by Afya Group upon your Consent, through the contact channel indicated in Section 12 of this Privacy Policy.

9.4. The Afya Group undertakes to employ its best efforts to respond to all requests for the deletion of Personal Data as quickly as possible, provided that they are accepted in accordance with the applicable legislation.

10. WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?

10.1. You, as a Personal Data Subject, are entitled to several rights provided for by the LGPD, which are:

  1. Confirmation of the existence of Processing: you can ask the Afya Group to confirm that your Personal Data are being processed.
  2. Access to Personal Data: you can request the Afya Group to access your Personal Data being Processed. In this case, the Afya Group will provide, by electronic or physical means, a copy of your Personal Data stored by us. The Afya Group cannot provide the Personal Data of other Users and/or third parties.
  3. Rectification or update of Personal Data: you may request the rectification or update of your Personal Data when they are inaccurate, incomplete or out of date. Before updating your Personal Data, Afya Group may request documents and/or information that substantiate the information provided.
  4. Request Anonymization, blocking or deletion of Personal Data: you may request that Personal Data that are unnecessary, excessive or processed in violation with the LGPD be anonymized, blocked or deleted from the Afya Group’s database.
  5. Portability of Personal Data: you may request the migration of your Personal Data collected by Afya Group to another organization after this matter is regulated by the ANPD.
  6. Deletion of Personal Data: you may request the deletion of your Personal Data processed by Afya Group upon your Consent, at any time, through a free and facilitated express of will, however, your Personal Data shall not be deleted in the cases in which its preservation is authorized by the LGPD.
  7. Information on Personal Data sharing: you may request information about the sharing of your Personal Data with third parties.
  8.  Information about the possibility of not Consenting: you may request information about the possibility of not Consenting with the Processing of your Personal Data by Afya Group, at which time Afya Group will inform you about the consequences of such refusal, which, in some situations, may render it unfeasible for us to offer certain products and services.
  9. Revocation of Consent: you may revoke your Consent to the Afya Group for Processing your Personal Data for specific purposes at any time. It is important to emphasize that the request to revoke Consent does not imply the elimination of the Personal Data that are kept by the Afya Group based on other legal grounds.
  10. Objection to Processing: you may object to the Processing of Personal Data carried out by the Afya Group based on one of the legal hypotheses for waiver of Consent or if not in accordance with the provisions of the LGPD.
  11. Reporting to the ANPD and consumer protection agencies: you may report to the ANPD and/or consumer protection agencies any incidents related to your Personal Data.
  12.  Review of Automated Decisions: you may request the Afya Group to review decisions solely based on Automated Processing of Personal Data and that affect your interests, including decisions aimed at defining your personal, professional, consumer, credit profile, or aspects of your personality.

10.2. To exercise the aforementioned rights, you must send a communication via email to [[email protected]]

10.3. In order to comply with the rights exercised under this section and in order to guarantee the security of the User’s Personal Data, the Afya Group may request information and documents for the purpose of verifying the identity and authenticity of the requesting User.

11. HOW DO WE KEEP YOUR PERSONAL DATA SECURE?

11.1. Afya Group employs all reasonable market efforts to ensure the security of the systems used for Processing Personal Data, such as:

  1. technical measures capable of keeping Personal Data safe and protected from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any other form of inappropriate or unlawful Treatment, in compliance with the applicable data protection and information security rules.
  2. authorizing only previously defined persons to access the places where the Afya Group stores information;
  3. raising awareness of the Afya Group employees on good compliance practices and Personal Data protection, in accordance with the LGPD; and
  4. entering into contracts with employees and service providers who have access to User information, that have data protection clauses, in order to establish an obligation to maintain absolute secrecy and confidentiality of the data accessed, under penalty of civil and criminal liability, in the terms provided for in Brazilian law.

11.2. The Platforms may have links that will direct the User to other sites, including those of partners, which have policies with provisions different from those set out in this Privacy Policy. Therefore, Afya Group is not responsible for the collection, use, sharing and storage of your data by those responsible for such sites outside the Platforms controlled by Afya Group.

12. HOW CAN YOU CONTACT THE AFYA GROUP?

12.1. If you have questions, complaints and/or need to communicate with the Afya Group regarding issues related to the protection of Personal Data, please contact our Data Officer:

Data Officer: Ricardo Matos

[[email protected]]

13. GENERAL PROVISIONS

13.1. The Afya Group may change this Privacy Policy at any time. If you wish to check which version of the Privacy Policy is in effect at the time of your inquiry, just check this information in the “Last updated” box at the top of this Privacy Policy.

13.2. This Privacy Policy shall be governed and construed in accordance with the laws of the Federative Republic of Brazil.

13.3. If any provision contained in this Privacy Policy is considered invalid, illegal or unenforceable in any respect, the validity, legality or enforceability of the other provisions contained in this Privacy Policy shall not be affected or impaired in any way as a result of such fact.

13.4. The venue of the district of Belo Horizonte, state of Minas Gerais, is elected as solely competent to settle any disputes regarding the interpretation and compliance with this Privacy Policy. However, before filing a formal suit, you may always count on the support of the Afya Group team to solve your problems in a more agile and non-litigating way, simply contacting us through the contact channel indicated in Section 12 of this Privacy Policy.