Privacy Policy

This Privacy Policy explains how Sonia Vet — the individual business Gilson Martins Santiago, registered as a Microempreendedor Individual (MEI) under CNPJ 22.475.191/0001-80, headquartered in Rio de Janeiro / RJ, Brazil — collects, uses, shares, and protects personal information in connection with sonia.vet (this website) and the sonIA service: an agentic AI veterinary support and teletriage assistant delivered through WhatsApp.

sonIA is built for pet parents in Brazil. We have written this policy with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD, Lei nº 13.709/2018) as the primary framework, with additional accommodations for visitors from the European Union (GDPR) and California (CCPA/CPRA). If you are reading this from outside Brazil, your local law may give you additional rights — we honor them where they apply.

1. Who we are

The data controller (controlador de dados) under LGPD article 5º, VI is:

For LGPD purposes, our designated Data Protection Officer (Encarregado pelo Tratamento de Dados Pessoais) can be reached at dpo@sonia.vet. [confirm DPO name and appointment date]

Sonia Vet operates in association with Vidaah (vidaah.vet), a veterinary teletriage platform that provides software, training data, and clinical methodology used by sonIA. Vidaah acts as a data processor on behalf of Sonia Vet under a data-processing agreement, except where Vidaah operates its own services to which a separate privacy policy applies.

2. Scope of this policy

This policy covers:

• The website sonia.vet and any subdomains we operate.
• The sonIA conversational service delivered through the WhatsApp Business API.
• Email, form, and other communications you send us about either of the above.

It does not cover third-party services we link to (such as Meta's WhatsApp, our hosting and infrastructure providers' consoles, our partners' websites). Those services have their own privacy policies, which we recommend you review.

3. Nature of the service

sonIA is an agentic AI veterinary support and teletriage assistant. Specifically:

• She gathers the information needed to understand what is happening with your animal — through text, voice notes, photos, and videos exchanged on WhatsApp.
• She performs teletriagem: classification of urgency, guidance on what to do next, and recommendations for home care or for seeking in-person veterinary attention.
• When the situation requires a clinical decision, prescription, or hands-on examination, she escalates to a licensed Brazilian veterinarian (CRMV) acting through Sonia Vet's partner network.
• She can route prescriptions or referrals to partner pharmacies, clinics, or hospitals when you ask her to.

sonIA is not a substitute for an in-person veterinary examination, and the support she provides does not replace the professional judgment of a licensed veterinarian. The final clinical decisions are made by humans authorized by the CRMV.

4. Information we collect

4.1 When you visit sonia.vet

• Technical data: IP address, user-agent, referrer, pages visited, timestamps, and basic device information collected automatically by our hosting provider for security, abuse prevention, and aggregate analytics.
• Cookies: we keep cookie use to a minimum. See §14.

4.2 When you join the waitlist or contact us

• Identification & contact: name, email, city, the role you selected (e.g. pet parent, vet, sponsor, investor, press), and anything you type into the free-text field.
• Communications: emails you send us, and our replies.

4.3 When you talk to sonIA on WhatsApp (at launch)

Once the sonIA service is live, the following information will be collected:

• Your WhatsApp identifier: phone number and (where you allow it) WhatsApp profile name and picture, provided to us by Meta as part of the WhatsApp Business API.
• Conversation content: text, voice notes, photos, and videos you send to sonIA, plus sonIA's responses.
• Pet information: details you share about your animal(s) — species, breed, age, weight, symptoms, medical history, photos and videos of the animal, and any related context you choose to share.
• Triage outputs: sonIA's classification of urgency, recommendations, and referrals to partner veterinarians.
• Location (optional): if you share it, we use it to recommend nearby clinics or pharmacies.

4.4 If you are a partner, sponsor, or investor

• Business identification (organization, role, contact details).
• Any information you share in proposals, contracts, or correspondence.

5. How we use information

We use the information described above to:

• Operate and improve sonia.vet and sonIA.
• Reply to your waitlist signup, partner inquiry, press request, or investor question.
• Send you product updates and launch notifications only if you asked for them.
• Provide the sonIA service: teletriage, recommendations, escalation to a licensed veterinarian, and follow-up.
• Route prescriptions or referrals to partner veterinarians, clinics, pharmacies, or sponsors when you ask us to.
• Train, evaluate, and improve sonIA's models. Conversation content used for training is de-identified before it leaves the operational system. You can opt out — see §12.
• Generate aggregated, non-identifying statistics about pet health trends, which we may share with sponsors, public-health partners, and the research community.
• Detect, prevent, and respond to fraud, abuse, security incidents, and legal claims.
• Comply with applicable law, court orders, and regulatory requests — including the obligations that apply to us as a MEI under the Simples Nacional tax regime and ISS recolhido no município do Rio de Janeiro.

6. Legal bases for processing (LGPD / GDPR)

Under the LGPD (article 7) and, where applicable, the GDPR (article 6), we rely on the following legal bases:

• Your consent (LGPD art. 7º, I) — for marketing emails and for any optional features we explicitly ask you to opt into.
• Performance of a contract or pre-contractual steps (LGPD art. 7º, V) — to provide the sonIA service after you initiate a conversation, and to respond to your inquiries.
• Compliance with a legal or regulatory obligation (LGPD art. 7º, II) — e.g., tax-and-accounting obligations of Sonia Vet as a MEI, and responding to lawful requests from authorities.
• Protection of life or physical safety (LGPD art. 7º, VII) — to escalate care when your animal is at imminent risk and the situation requires sharing information with a licensed vet.
• Legitimate interests (LGPD art. 7º, IX) — for security, fraud prevention, aggregated analytics, and product improvement, balanced against your fundamental rights.
• Public health and surveillance (LGPD art. 7º, VIII) — for collaborations with public-health authorities on zoonotic disease surveillance and vaccination campaigns. Such collaborations use anonymized or aggregated data wherever possible.

7. Who we share information with

We share personal information only as described below. We do not sell personal data.

7.1 Service providers (processors)

Vendors who process data on our behalf, under contractual data-processing terms:

• Vidaah — software platform, model orchestration, and clinical-methodology support that powers sonIA, acting as a processor on behalf of Sonia Vet.
• Vercel Inc. — website hosting and serverless functions (United States).
• Meta Platforms, Inc. — WhatsApp Business API delivery of messages between you and sonIA (United States / Ireland).
• AI model providers — for the language, voice, and vision models that power sonIA. [final providers to be listed once selected — e.g., Anthropic, OpenAI, Google, AWS Bedrock]. Inputs are subject to each provider's no-training and data-handling commitments where available.
• Email and analytics providers — [Postmark / Resend / Plausible — to confirm].
• Database & storage — [Supabase / Neon / S3 — to confirm].
• Customer support tooling — [to confirm].

7.2 Licensed veterinarians and clinical partners

When sonIA escalates a case or you ask for a referral, we share the relevant conversation history, pet information, and your contact details with the licensed Brazilian veterinarian (CRMV) or clinic taking the hand-off, so they can continue care without you having to repeat yourself.

7.3 Sponsors and commercial partners

Our model is sponsor-funded: government agencies, food brands, pet retailers, pharmacies, and veterinary hospitals pay to be present in the experience. Sponsors do not receive your personally identifying information by default. We share:

• Aggregated, non-identifying insights (cohort statistics, regional trends, category demand).
• Pseudonymized or anonymized data for joint research or public-health programs.
• Identifiable referrals only when you ask us to route you to a sponsor (e.g., "send the prescription to PetShop X") — and only the information needed to complete that request.

7.4 Legal and safety disclosures

We may share information when we are required to by law, when responding to lawful requests by public authorities, or when necessary to protect the rights, property, or safety of Sonia Vet, our users, an animal in danger, or the public.

7.5 Corporate transactions

If Sonia Vet undergoes a change of legal form (for example, conversion from MEI to another business type), a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you and honor the commitments in this policy.

8. WhatsApp and Meta

sonIA is delivered through the WhatsApp Business API. WhatsApp is operated by Meta Platforms, Inc., not by Sonia Vet, and Meta processes your messages as part of delivering them. Your use of WhatsApp is governed by Meta's WhatsApp Privacy Policy in addition to this one. sonIA, the sonIA name, and the sonIA service are products of Sonia Vet and are not affiliated with, endorsed by, or sponsored by Meta.

End-to-end encryption between you and sonIA may or may not apply to business messaging depending on Meta's current technical implementation; please refer to WhatsApp's documentation for the current state. Once messages reach our systems, they are encrypted in transit and at rest under our control.

9. Sensitive and health-adjacent data

We do not deliberately collect "dados pessoais sensíveis" under LGPD article 5º, II (such as data about your race, religion, political views, health, sex life, or biometrics). If you share such information in free-text conversations with sonIA — for example, mentioning your own health to contextualize your pet's care — we will treat it with elevated confidentiality, restrict access to a strict need-to-know basis, and minimize retention.

Information about your pet's medical history is handled with veterinary-grade confidentiality: stored encrypted, accessible only to sonIA, the licensed veterinarians involved in your case, and the engineers maintaining the system under access controls and auditing.

10. How long we keep information

• Waitlist signups: until the service launches in your region, plus up to 24 months, or until you ask us to delete the record — whichever comes first.
• WhatsApp conversations: kept for the lifetime of your relationship with sonIA so she can remember your pet's history. You can ask us to delete conversation history at any time (subject to legal hold requirements).
• Veterinary records: retained in line with applicable veterinary recordkeeping rules and any contractual or legal obligations of the licensed vets who treated your pet.
• Tax and accounting records: retained for the period required by Brazilian tax and Simples Nacional / MEI obligations (typically at least 5 years).
• Aggregated and anonymized data: may be retained indefinitely.
• Server logs & security data: typically up to 12 months, longer if needed for a specific investigation.

11. International data transfers

Some of our processors are based outside Brazil (including the United States and the European Union). When we transfer personal data internationally, we do so under one of the bases permitted by LGPD article 33 — typically standard contractual clauses approved by the ANPD, the data subject's consent, or the necessity of executing a contract with the data subject. We require equivalent levels of protection from our processors wherever they operate.

12. Your rights

Under the LGPD (article 18) you have the right to:

• Confirm whether we process your personal data, and access that data.
• Correct incomplete, inaccurate, or outdated data.
• Anonymize, block, or delete unnecessary, excessive, or unlawfully processed data.
• Port your data to another service provider, where technically feasible.
• Delete personal data processed on the basis of your consent.
• Be informed about the public and private entities with whom your data has been shared.
• Be informed about the possibility of refusing consent, and the consequences of refusal.
• Revoke consent at any time.
• Request human review of decisions made solely on the basis of automated processing that affect your interests.

To exercise any of these rights, email privacy@sonia.vet. We respond within the timeframe required by applicable law (15 days under the LGPD for most requests). You also have the right to lodge a complaint with the Brazilian data-protection authority — the Autoridade Nacional de Proteção de Dados (ANPD).

Visitors from the EU/EEA have analogous rights under GDPR articles 15–22, including the right to object to processing based on legitimate interests, and the right to lodge a complaint with your national supervisory authority. California residents have analogous rights under the CCPA/CPRA, including the right to know, the right to delete, and the right to opt out of "sale" or "sharing" of personal information — we do not sell or share personal information as those terms are defined in the CCPA/CPRA.

13. Minors

sonia.vet and sonIA are intended for adults (18+) acting on behalf of their pets. We do not knowingly collect personal data from children under 18 without verifiable parental consent. If you believe a child has provided personal information to us, please contact privacy@sonia.vet and we will delete it.

14. Cookies and analytics

sonia.vet uses a minimal set of cookies and similar technologies, limited to what is necessary to operate the site, remember preferences (such as language), and measure aggregate traffic in a privacy-respecting way. [final list of cookies and analytics provider to be filled in here once selected — e.g., Plausible or Vercel Analytics, both cookieless-by-default].

Where the law requires it, we ask for your consent before placing non-essential cookies. You can manage cookies through your browser at any time.

15. Security

We protect personal data with administrative, technical, and physical safeguards proportionate to the risk, including encryption in transit (TLS) and at rest, least-privilege access controls, audit logging, vendor due diligence, secure development practices, and incident-response procedures. No system can be guaranteed perfectly secure — if we ever discover a breach that affects you, we will notify you and the relevant authorities as required by law.

16. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top, and — for material changes — notify you through the site, by email, or through sonIA itself before the changes take effect.

17. Contact & Data Protection Officer