Privacy policy
This is an English translation for convenience. The Portuguese version is the binding version.
This policy explains what data AnestSim keeps, why, who it shares the data with, and what your rights are under the LGPD (Brazil's General Data Protection Law), Law 13.709/2018.
Last updated: October 2026.
1. Who processes the data
The data controller is Mário Turolla Ribeiro, who is responsible for AnestSim. Contact: suporte@anestsim.com.
2. The data that the portal keeps
| Data | Purpose | Legal basis |
|---|---|---|
| Name and email | Create and identify the account, send the service emails | Performance of the contract |
| Who you are (persona) and institution | Adjust the dashboard, identify the institutional affiliation, and unlock free Teach | Performance of the contract |
| Authentication provider identifier and date of last access | Sign in to the account securely | Performance of the contract |
| Subscriptions and invoices | Charge for the plan and show the payment history | Performance of the contract and legal obligation |
| Simulation reports | Show your progress and, in classrooms, show the results to the educator | Performance of the contract |
| Classrooms, invitations, and assignments | Operate Teach | Performance of the contract |
| Log of sent emails | Support and audit of delivery | Legitimate interest |
| Contact messages | Reply to you | Consent |
| Technical access and error logs | Security and correction of faults | Legitimate interest |
AnestSim does not store your card number. AnestSim does not process data of real patients: every patient in the simulator is virtual.
3. Processors
Some services process data on behalf of AnestSim. Each one receives only what it needs.
| Processor | Role | Data |
|---|---|---|
| WorkOS | Authentication | Email, name, and the session identifier |
| Stripe | Payments | Email, name, card details given directly to Stripe, and the billing history |
| Resend | Email delivery | Email, name, and the content of each message |
| Fly.io | Hosting | The portal data, on servers in Brazil |
| Sentry | Error logging | Technical data about the error, without the content of the reports |
Some processors are outside Brazil. The transfer follows the contractual clauses of each processor and Article 33 of the LGPD.
4. How long
- Account data: while the account exists. After deletion, the account stays deactivated for up to 30 days so that the deletion can be reversed, and then it is removed.
- Invoices and billing records: five years, because of a tax obligation.
- Simulation reports in classrooms: while the classroom and the educator's account exist.
- Contact messages: up to one year.
- Technical logs: up to 90 days.
5. Your rights
Under Article 18 of the LGPD, you may request at any time:
- confirmation that we process your data, and access to that data;
- correction of incomplete or incorrect data;
- anonymization, blocking, or deletion of unnecessary data;
- portability of your data in a readable format, including the reports;
- information about who we share the data with;
- withdrawal of consent, where consent is the legal basis;
- deletion of the account, in your profile or by email.
Send the request to suporte@anestsim.com. We reply within 15 days. You can also file a complaint with the National Data Protection Authority, the ANPD.
6. Cookies
The portal uses a single session cookie, which is necessary to keep you signed in. There are no advertising cookies and no cross-site tracking.
7. Security
Data travels with TLS encryption. Passwords do not exist in AnestSim: the provider does the authentication. Administrative access is restricted to the team and logged.
8. Minors
AnestSim is intended for students, health professionals, educators, and adult players. We do not intentionally create accounts for people under 18 years of age.
9. Changes
Changes to this policy are published here, with the date. Significant changes are announced by email.
10. Contact
Data protection officer: Mário Turolla Ribeiro, suporte@anestsim.com.